# CISSP Domain 4 — Secure the path, not the castle

Source: https://ai.techclick.in/blog_cissp_d4_network_security
Markdown: https://ai.techclick.in/blog_cissp_d4_network_security.md
Publisher: Techclick Infosec Pvt Ltd

CISSP Domain 4 (13%): map OSI to TCP/IP, pick TLS vs IPsec vs SSH, choose physical vs logical vs micro-segmentation, and brief SDN planes to a CISO and an engineer.

Quick answer

   Domain 4 is not “know the seven layers.” It is  match the control to what the layer can see , then  encrypt the right hop , then  contain east-west blast radius . OSI is the exam’s inspection language; TCP/IP is what the packet actually rides. TLS 1.3 protects applications; IPsec ESP in tunnel mode protects whole packets over an untrusted path; SSH replaces Telnet. VLANs split broadcast domains. They do not stop a neighbour. Micro-segmentation and zero-trust policy do. SDN moves the decision to a controller — northbound APIs take intent from apps, southbound APIs program the data plane. A manager’s first move after a flat-network breach is a data-flow map and a segmentation policy, not a purchase order for OpenFlow.

## 1. Why Domain 4 matters

 ISC2 weights  Communication and Network Security  at  13%  of the CISSP CAT (exam outline effective 15 April 2024). The official objectives are three verbs: apply secure design in network architectures, secure the components, and implement secure channels. The exam — and a real board review — punish the same mistake: treating “inside the firewall” as trusted.

 That is the ticket in this lesson. A contractor lands on a flat  10.20.0.0/16  over VPN. Identity was checked at the gate. Nothing re-checked the hop from a finance laptop to a database two subnets away. North-south looked fine. East-west was a highway.

   Hero · who talks to whom

   Notice: the user never gets “the network.” They get a path to one resource. Location is not trust.

#### Manager lens

 Blast radius, residual risk, and who owns the data flow. Buy nothing until the asset list and the allowed conversations exist on paper.

#### Engineer lens

 Layer, header, and enforcement point. If the control cannot see the field, it cannot stop the abuse — no matter how expensive it is.

   Official outline (what this page covers)

    4.1  OSI and TCP/IP, IPv4/IPv6 casts, secure protocols, traffic flows, physical / logical / micro-segmentation, SDN (API, SD-WAN, NFV).  4.2  NAC and endpoint as component controls.  4.3  Remote access and third-party channels. Source:  ISC2 CISSP Certification Exam Outline .

## 2. Mental model — OSI vs TCP/IP

 Pre-train three words before the diagram.  Encapsulation  is wrapping a payload in the next header as data goes down the stack.  Decapsulation  is unwrapping on the way up.  The layer a control lives on  is the set of fields it is allowed to read. A packet filter that only sees IP and port cannot rate-limit a login POST. A WAF that never sees Layer 2 cannot stop ARP spoofing.

 OSI is seven boxes so the exam can ask “what can this control inspect?” TCP/IP is four boxes because that is how the internet is implemented. You need both: OSI for judgment, TCP/IP for the packet.

   Feel · packet through the stack

   Feel the descent: application data, then transport, then IP, then bits on a wire. Exact mapping is in the SVG below.

   Flow 1 · OSI 7 mapped to TCP/IP 4

       OSI seven layers mapped onto the TCP/IP four-layer model

- OSI (exam language) TCP/IP (the packet) 7 Application HTTP, DNS, SMTP · WAF, proxy, NGFW app-ID 6 Presentation — TLS record, encoding, compression 5 Session — dialogs, RPC, SIP setup Application TLS · SSH · DNS · HTTP 4 Transport TCP / UDP · ports, handshake, stateful FW Transport 3 Network IP, ICMP, IPsec · router, ACL, packet filter Internet 2 Data Link — MAC, 802.1Q, switch, ARP, 802.1X 1 Physical — fibre, copper, radio, hub, media lock Link / Network Access Ethernet · Wi-Fi · VLAN tag If the question names a field (MAC, IP, port, URL), that field names the layer. Read left → right. OSI 5–7 collapse into TCP/IP Application. OSI 1–2 collapse into Link. IPsec lives at Network / Internet so it can protect any upper protocol. Say this out loud The layer decides what the control can see. MAC is Layer 2. IP is Layer 3. Ports and the TCP handshake are Layer 4. URLs and login bodies are Layer 7. IPsec is Layer 3 so it can wrap anything above it. ### IPv4 and IPv6 casts (outline 4.1) ISC2 lists four delivery types. Unicast is one-to-one. Multicast is one-to-many who subscribed. Anycast is one-to-nearest instance of the same address (how anycast DNS and many CDNs work). Broadcast is one-to-all on the local network — IPv4 only. IPv6 has no broadcast; it uses multicast instead. IPsec is an add-on in IPv4 and a native architectural capability in IPv6. Control inspects OSI layer What it can stop What it cannot see Cable lock, port disable, fibre vs copper 1 Physical Tap, jam, unlocked patch panel Anything in the frame DAI, DHCP snooping, 802.1X, port security 2 Data Link ARP spoof, MAC flood, rogue jack IP payload, HTTP body Router ACL, IPsec, packet filter 3 Network Spoofed routes, clear IP on the WAN Application verbs Stateful firewall, SYN cookies 4 Transport Blind scans, some floods Encrypted or L7 abuse on 443 WAF, proxy, NGFW app-ID, DNSSEC validator 7 Application Credential stuffing, SQLi, poison DNS L2 neighbour tricks Classic miss Buying a Layer-3 firewall to stop credential stuffing. The box only sees 10.20.4.0/24:443 . The abuse is in the HTTP body. Add a Layer-7 control, or you paid for a door that cannot read the letter. ## 3. Decision flow — layer, protocol, cut Draw this before you buy a box or write a standard. First decide what field you must see. Then pick the protocol that protects that hop. Then pick the cut that contains blast radius if the hop still fails. Feel · two paths from one decision Path A is “trust the inside.” Path B is “verify the resource.” Domain 4 lives on Path B. Flow 2 · What are you containing? Segmentation decision flow from isolation need to control type What must not talk if one host dies? Isolation need? Physical OT, classified, mgmt Logical Dept, tenant, WAN path Workload East-west after login Air-gap · OOB · in-band Separate media / plane No shared forwarding path VLAN · VPN · VRF Virtual domain Still coarse inside a zone Micro-seg + ZT Distributed FW · overlay Identity per flow ZTNA / SASE gets the user IN. It does not police east-west. If the attacker is already authenticated, only a workload cut stops the next hop. Read top → down. Diamond is the isolation question. Right column is the exam trap: “we deployed SASE” is not an east-west answer. North-south vs east-west North-south is client to data centre or internet — the classic perimeter. East-west is workload to workload inside the same plant. Most modern damage is east-west after one phish. NIST SP 800-207 is blunt: do not grant implicit trust from network location. ## 4. How to choose protocols and segments ISC2 names the secure-protocol family explicitly: IPsec, SSH, SSL/TLS . SSL is historic. TLS is the living standard. TLS 1.0 and 1.1 are retired; treat them as audit findings. TLS 1.3 (RFC 8446) mandates forward secrecy and a shorter handshake. SSH (RFC 4251) is the remote-admin channel that replaces Telnet. IPsec (RFC 4301) sits at Layer 3. Flow Prefer Why Do not pick Browser to SaaS / internal HTTPS TLS 1.3 (1.2 minimum) Application confidentiality + integrity; PFS SSL, TLS 1.0/1.1, clear HTTP Site-to-site or host VPN over internet IPsec ESP, tunnel mode, IKEv2 Encrypts payload and original IP header AH (no encryption); transport mode (header in the clear) Router / switch / Linux admin SSH Encrypted remote shell and file copy Telnet, rsh, unauthenticated HTTP UI File move SFTP or FTPS Auth + confidentiality FTP, TFTP Device telemetry SNMPv3 Auth and privacy options SNMPv1 / v2c community strings DNS authenticity DNSSEC Signed records, stops cache poison Claiming DNSSEC is “private” DNS confidentiality DoT or DoH Encrypts the query path DNSSEC alone ### IPsec in one breath AH (Authentication Header) gives integrity and origin authentication. It encrypts nothing. ESP (Encapsulating Security Payload) adds confidentiality. Transport mode protects the payload between two hosts and leaves the original IP header visible. Tunnel mode wraps the entire original packet in a new IP header — that is the site-to-site and remote-access pattern. IKE (usually IKEv2) builds the security associations. If the stem wants confidentiality across an untrusted network, the answer is almost always ESP in tunnel mode. ### Segmentation menu (outline words, not vendor words) ISC2 term What it actually is Use when Limit Physical — air-gapped No shared forwarding path at all OT, classified, crown-jewel backups Expensive; sneaker-net becomes the risk Physical — out-of-band Management plane on separate media Network admin when the data plane is sick or hostile In-band mgmt dies with the attack Logical — VLAN (802.1Q) Tagged broadcast domain on a switch HR vs Finance on the same closet Hosts in the VLAN still talk freely Logical — VPN Encrypted overlay across untrusted path Branch, partner, remote admin Classic VPN drops you on a subnet Logical — VRF / virtual domain Separate routing tables or virtual FW Multi-tenant, partner VRF, overlapping IPs Still coarse inside each VRF Micro-segmentation Distributed FW, overlay, identity per flow Stop east-west after one host is owned Needs a flow map or you brick production Exam trap “We deployed SASE / ZTNA, so lateral movement is solved.” ZTNA verifies the user to one application (north-south). It does not write the east-west rule between two servers in the same subnet. Full zero trust in Domain 4 language is identity plus micro-segmentation, not a new remote-access brand. ## 5. Runbook — manager, then engineer, then prove This is not a CLI lab. It is the review-board sequence ISC2 wants when the stem says FIRST or BEST after a flat-network incident. Source for the manager half: NIST SP 800-207 (protect the resource, not the segment). Source for the protocol half: RFC 4301 and the ISC2 secure-protocol list. ### Side A — Manager / CISO (scope before spend) #### Name the asset and the owner Payroll DB, OT historian, partner VRF — not “the network.” The data owner classifies. Security does not invent the label.

- #### Map allowed conversations Who may talk to whom, on which port, from which identity, in which direction. If this sheet does not exist, any SDN purchase is decoration.

- #### Choose the cut from residual risk Air-gap if a wrong packet is catastrophic. VLAN + ACL if the zone is coarse and the budget is real. Micro-segmentation if one phish must not become a plant-wide event. Record the residual risk the board accepts.

- #### Write the standard, then fund the tool Policy → standard → procedure. “Buy OpenFlow” is not a first move. “No implicit trust from RFC1918 location” is.

### Side B — Engineer (design the path)

- #### Match each threat to a layer Rogue jack → 802.1X + NAC. ARP spoof → DAI + DHCP snooping. WAN sniff → IPsec ESP tunnel. Login abuse → L7. Management plane → SSH + OOB.

- #### Retire the cleartext twins Telnet → SSH. FTP → SFTP/FTPS. SNMPv1/v2c → SNMPv3. HTTP admin → TLS 1.2+ (prefer 1.3). Prove with a port scan and a config dump, not a slide.

- #### Build the cut you were given VLAN + SVI ACL for coarse zones. VRF when routing tables must not leak. Distributed or host FW for micro-seg. Never put in-band management on the same VRF the attacker just owned.

- #### If SDN is the vehicle, lock the controller The controller is now a crown jewel. Northbound APIs take intent from apps. Southbound APIs program switches. Compromise the controller and you program the plant. Authenticate both APIs, separate the management plane, monitor southbound change rate.

### Side C — Prove (pilot, then expand)

- #### Pick one blast-radius story Compromised contractor laptop must not reach the payroll DB. Write that as a fail/pass test before go-live.

- #### Instrument the path Flow logs (who talked to whom), IPsec SA up, TLS version on the VIP, 802.1X auth success/fail, SDN controller audit of southbound writes.

- #### Break it on purpose From the pilot host, attempt the forbidden hop. Expect deny + log. If it succeeds, the VLAN was a costume.

   Pilot evidence — fields a reviewer should see
   src_identity=contractor.jdoe
src_ip=10.20.14.55
dst_ip=10.20.80.12
dst_port=5432
action=deny
enforcement=distributed-fw | microseg-policy payroll-db-only
reason=no identity grant
ipsec=esp-tunnel ikev2 sa=up
tls_vip=1.3
mgmt=ssh + oob-only

## 6. Runtime path — packet and SDN planes

 Two pictures. First the packet. Then the controller that may be steering it.

   Feel · controller above the switches

   Apps state intent. The controller decides. The data plane only forwards. That split is the whole SDN idea.

   Flow 3 · SDN planes and a packet on the wire

       SDN application, control, and data planes with northbound and southbound APIs

- Application plane — orchestration, security apps, intent “Payroll DB only accepts the app tier on 5432” Northbound API ↑ apps talk to the controller Control plane — SDN controller Crown jewel · authenticates APIs · programs forwarding Southbound API ↓ controller programs devices Switch A Data plane Switch B Forward only NFV / SD-WAN edge Virtual function On the wire, the same packet still looks like: Ethernet → IP (or ESP+new IP) → TCP → TLS → HTTP SD-WAN = software-defined WAN path. NFV = firewall / LB as software. Neither replaces identity policy. Northbound = apps ↔ controller. Southbound = controller ↔ devices. Reverse them on the exam and the whole answer is wrong. #### Transport architecture (4.1) Data plane forwards. Control plane decides routes and policy. Management plane is how humans and tools change the box — keep it OOB. Cut-through switches start forwarding before the whole frame arrives (low latency, less check). Store-and-forward buffers the frame (more check, more latency). #### Metrics the outline names Bandwidth, latency, jitter, throughput, signal-to-noise. VoIP and collaboration (4.3) die on jitter, not on “the firewall is up.” QoS is an availability control, not decoration. Converged and multilayer protocols VoIP, iSCSI, InfiniBand-over-Ethernet, and CXL ride IP or Ethernet and inherit that path’s threats. If storage (iSCSI) shares the user LAN, a laptop can reach a LUN. Separate the fabric. Multilayer means a control at one layer cannot see another — TLS will not save you from a poisoned ARP table under it. ## 7. Traps and proof Proof · the desk that closes the ticket Green is not a vibe. Green is deny on the forbidden hop, SA up, TLS 1.3 on the VIP, SSH-only on management. Trap What people say What is actually true Fix Castle-and-moat “Inside the firewall is trusted.” Location is not trust (NIST SP 800-207). Identity + east-west policy. VLAN as a security boundary “They’re on VLAN 40, we’re safe.” Same VLAN is a free LAN. VLAN hopping is a thing. ACL / FW between zones; micro-seg inside. AH for a VPN “IPsec is on.” AH authenticates. It does not encrypt. ESP, usually tunnel mode. DNSSEC as privacy “DNS is now confidential.” DNSSEC signs. Queries stay readable. Add DoT or DoH. ZTNA without east-west “SASE solved lateral movement.” ZTNA is entry to one app. Add micro-segmentation. In-band management “We’ll SSH over the production VRF.” The attacker owns your keyboard. OOB management plane. Split tunnel “Internet direct is faster.” Bypasses inspection and DLP. Full tunnel or explicit SWG exception list. Unprotected SDN controller “Software defined, so agile.” One API key programs the plant. Lock northbound/southbound; monitor writes. Pilot checklist — print this Data-flow sheet signed by the asset owner (who may talk to whom).

- Cleartext twins gone: Telnet, FTP, SNMPv1/v2c, HTTP-on-mgmt.

- WAN path: IPsec ESP + tunnel + IKEv2, SA up in both directions.

- VIP / browser path: TLS 1.2+ only, 1.3 preferred; old protocols fail the handshake.

- Access: 802.1X NAC on the conference-room jack; unknown MAC gets no IP.

- Management: SSH + OOB; in-band admin disabled on production VRFs.

- East-west: pilot host denied to crown-jewel port; deny is logged with identity.

- If SDN: controller on a dedicated plane; southbound change log reviewed.

- Wireless (if in scope): WPA3-SAE, not WPA2-PSK transition mode in high-security zones.

- Third-party / telecom path (4.3): contract names encryption, no shared jump host onto the LAN.

   Interview pair — weak vs strong

    Weak:  “We use VLANs and a firewall, plus VPN for remote users.”  Strong:  “We mapped allowed conversations, encrypted the untrusted hop with ESP-tunnel or TLS 1.3, gated the jack with 802.1X, and wrote identity-aware east-west denies so a phished contractor cannot walk to payroll. SDN, if we use it, is a controller we treat as a crown jewel, not a feature checkbox.”

## Knowledge check

   Six judgment items. Same traps the CAT uses: layer blindness, AH vs ESP, ZTNA as a lateral-movement cure, northbound vs southbound, manager FIRST, DNSSEC as privacy. Check answers, then reset if you miss any.

       Q1
       A login API is being credential-stuffed. The Layer-3 firewall only shows a rise in 443 to the VIP. Which control can actually see the abuse?

           Dynamic ARP Inspection on the access switch
           A Layer-7 WAF or reverse proxy that reads the HTTP body
           IPsec AH in transport mode between the client and the VIP
           An 802.1Q VLAN tag on the server port

       Correct:  b . The layer decides what the control can inspect. L3 sees IP and port. Credential stuffing is in the application payload. Re-read  OSI vs TCP/IP .

       Q2
       Two data centres need a site-to-site VPN over the public internet. The original IP headers and payload must stay confidential. Which IPsec design do you deploy?

           AH in transport mode
           ESP in tunnel mode
           AH in tunnel mode
           ESP in transport mode

       Correct:  b . ESP provides confidentiality; AH does not encrypt. Tunnel mode wraps the original packet so the inner header is not visible on the WAN. Transport mode leaves that header in the clear. Re-read  How to choose .

       Q3
       ZTNA over a SASE edge is live. Months later, malware on an already-authenticated finance laptop reaches other servers in the same data-centre subnet. What do you add to stop that hop?

           A stronger VPN with MFA at the gateway
           A larger subnet so more hosts share one broadcast domain
           Micro-segmentation with identity-aware east-west denies
           Another secure web gateway for outbound browsing

       Correct:  c . ZTNA / SASE controls how a user gets in. It does not police east-west once the session is inside a flat subnet. MFA and SWG do not write the server-to-server deny. Re-read  Decision flow .

       Q4
       In an SDN design, orchestration apps push intent (“only the app tier may reach payroll on 5432”) to the controller. Which interface is that?

           Northbound APIs
           Southbound APIs
           A GRE tunnel between leaf switches
           802.1X between the controller and RADIUS

       Correct:  a . Northbound = applications ↔ controller. Southbound = controller ↔ forwarding devices. GRE is an overlay; 802.1X is access control, not the SDN intent channel. Re-read  Runtime path .

       Q5
       After a phished contractor walks two subnets to a database, the CISO asks what the security professional does FIRST before anyone buys SDN fabric.

           Enable OpenFlow on every access switch this weekend
           Purchase a next-generation firewall for the data-centre core
           Disable IPv6 so broadcast attacks go away
           Map data flows with the asset owner and write the segmentation policy

       Correct:  d . Manager FIRST is risk and allowed conversations, then policy, then a tool. OpenFlow and a new NGFW without a flow map just relocate the flat network. IPv6 is a red herring. Re-read  Side A .

       Q6
       An engineer turns on DNSSEC on every resolver and tells the auditor that branch DNS is now private and tamper-proof. How do you evaluate that claim?

           Partly right — DNSSEC proves authenticity, not confidentiality; add DoT or DoH for privacy
           Correct — DNSSEC encrypts queries and responses end to end
           Wrong — DNSSEC only hardens the server operating system
           Correct as long as the company website also uses TLS 1.3

       Correct:  a . DNSSEC signs records so a poisoned answer fails validation. The query is still readable on the wire. Confidentiality is DoT or DoH. Website TLS does not wrap DNS. Re-read  How to choose .

       Check answers
       Reset

## Sources

- ISC2, CISSP Certification Exam Outline (effective 15 April 2024) — Domain 4: Communication and Network Security (13%). PDF: CISSP-Exam-Outline-April-2024-English.pdf .

- NIST SP 800-207, Zero Trust Architecture — no implicit trust from network location; protect the resource.

- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs — AH vs ESP, transport vs tunnel.

- IETF RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3 .

- IETF RFC 4301, Security Architecture for the Internet Protocol (IPsec).

- IETF RFC 4251, The Secure Shell (SSH) Protocol Architecture .

- IEEE 802.1Q — VLAN tagging; IEEE 802.1X — port-based NAC.

 Related:  Domain 3 · Architecture and Engineering  ·  Domain 5 · IAM  ·  All 8 domains map  ·  Domain 4 timed assessment

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt