The 7 Layers of Cybersecurity: A Comprehensive Guide to Ensure Your Protection Up to the Human Layer

We must admit, a network-only approach to cybersecurity is becoming irrelevant and outdated. The vulnerabilities across your communication transactions mesh are expanding from network-vectored only to applications and humans alike. Focusing exclusively on the network layer leaves a range of entry points for cybercriminals on your attack surface. This is why MHE decided to curate this guide — to give security officers and professionals a full view over the security landscape in a fully digitally enabled and online-facing business.

Back to the basics: when we tried to categorise the cybersecurity domains, we couldn't start by jumping immediately into the map. We first had to go back to the OSI and the TCP/IP models to have a clearer view over which attacks take place where and where exactly do the vulnerabilities reside.

The OSI and TCP/IP Models

The Open System Interconnection (OSI) model elaborates the 7 layers of communication between computer systems over a network. It was the first standardised model for such communication to be adopted by computer and telecom companies in the 1980s. While modern communication systems do not exactly follow the same model, a simpler TCP/IP model started to get widely used. There are no fundamental differences between both models, but rather a simpler way to categorise the communication protocol and its components with just minor differences.

The core differences between OSI and TCP/IP models:

1. TCP/IP is simpler, more widely adopted and is utilised in practical, rather than academic or theoretical, settings.
2. Layers 1 & 2 in the OSI model are combined into the Network Access Layer in the TCP/IP protocol; sequencing and acknowledgment functions aren't within the responsibilities of TCP/IP but rather of the transport layer.
3. In the TCP/IP model, applications use all layers by default, unlike the OSI model, where layers 1, 2 and 3 are the only mandatory layers to enable any data communication.

How does this relate to the 7 layers of cybersecurity?

By evolving the OSI model to the TCP/IP model, and now that we have established that all layers are used by default, the 7 layers of cybersecurity places the TCP/IP layers in the middle, encloses them within the human layer, and places "Mission Critical Assets" at the core of the map.

Are there only 7 layers of cybersecurity?

There is no one standard for cybersecurity or framework that fits all purposes. Different entities and organisations categorise the domains or functions of cybersecurity differently. The NIST Cybersecurity Framework classifies the various aspects following a 5-functions model (Identify, Protect, Detect, Respond and Recover) while MITRE ATT&CK and SANS frameworks break those down to 20 Critical Security Controls. The Cyber Kill Chain model uses 7 stages to describe the different phases a cyber-attack typically goes through. In short, all these models are intended to help professionals and businesses prioritise and allocate their cybersecurity strategies. We are presenting this guide particularly for that reason — a comprehensive view over the available technologies and layers to help you map your strategy and find your security gaps.

What Assets are Considered Mission Critical?

Mission Critical Assets are any physical or digital assets that are vital to achieving an organisation's mission or business operations. Any loss, damage, or compromise to such assets would disrupt business operations and cause significant harm. They are naturally the most valuable targets for cybercriminals and attackers. Examples include:

• Proprietary software code, intellectual property and patents
• Systems and applications related to customer databases and supply chain management
• Equipment, servers, or industrial systems
• Payment processing systems
• Classified data such as personally identifiable information or financial records

By prioritising the most important assets for an organisation, cybersecurity strategy has a methodical starting point for drafting and implementation.

I. Data Security

1. PKI: Public Key Infrastructure — used to manage digital certificates and public key encryption.
2. DAR: Dissemination Control and Release — refers to controlling the dissemination and release of information classified as Confidential, Secret or Top Secret.
3. DIM: Destruction, Inactivation, and Disposal — used for classified information that is no longer needed.
4. DIU: Declassification and Information Security Education — refers to the process used to deal with information that is no longer required to be kept classified.
5. Identity & Access Management (IAM): A framework of policies and technologies that organisations use to manage and control access to resources and data. Typically involves four key activities: Identification, Authentication, Authorisation and Administration.
6. Enterprise Rights Management (ERM): Also known as Information Rights Management (IRM) — a technology to control and track access to sensitive data and intellectual property at the file and document level. Its cycle spans access control (viewing, editing, printing or copying rights) to expiration and revocation.
7. Data Classification: A process of categorising data based on its level of sensitivity, value, and confidentiality. This helps an organisation apply the appropriate security controls. The process has five phases: Inventory, Categorisation, Labelling, Access Control and Protection.
8. Integrity Monitoring: Detects any changes made to a system or data entries that could affect the system's stability, security or function. A baseline is created through a system snapshot before continuous monitoring starts tracking any changes. Any changes detected trigger alerts, followed by investigation and response.
9. Encryption: At the data and drive level, encryption is a powerful measure to stop data breaches. Even if an attacker reaches the data destination, they will still need the decryption key to interpret and decipher the data.
10. DLP: Data Loss Prevention (or Data Leak Prevention) appears in multiple layers. On all layers the goal is to protect an organisation's data from being lost or leaked, encompassing Data Discovery, Classification, Monitoring, Protection and Incident Response.

II. Application Security

1. Static Application Testing and Code Review: Techniques used by software developers and DevSecOps teams on source code to identify and fix possible code-level vulnerabilities before release. Such vulnerabilities include SQL injections, cross-site scripting and buffer overflows. Running static tests and code reviews early in the development cycle is more cost-effective than addressing them in production.
2. Dynamic Application Testing: While static testing is done on the source code, dynamic testing takes place on an already-running application. It involves performing penetration tests and automated scans to identify weaknesses and potential attack vectors.
3. Web Application Firewall (WAF): A tool designed to monitor, filter and protect servers from HTTP traffic attacks. It analyses request headers, payloads and other data to detect known attack patterns like XSS, SQL Injection and Cross-Site Request Forgery (CSRF). A WAF should not be relied upon as the sole means of securing a web application and should be part of a broader defence-in-depth strategy.
4. Database Monitoring/Scanning: A set of rules and policies for creating and storing data within an organisation's database. It involves real-time tracking of database activity to identify and alert on malicious behaviour — including failed logins, access attempts and data modification. Restricting access using strong passwords, 2FA and role-based access control is a key first step, along with encryption, patching, auditing and activity logging.
5. Database Secure Gateway (Shield): An interface between a database and the applications accessing and modifying data within it, specifically designed to ensure that communicating applications do not cause any compromise or breaches. Secure gateways can also enforce access control policies and monitor database activity.

III. Endpoint Security

1. Desktop Firewall: A software-based firewall installed on the organisation's endpoint(s), controlling incoming and outgoing traffic through rules and policies. It can include additional features like intrusion prevention and detection, packet filtering and application control.
2. Host IDS/IPS: Intrusion Detection and Prevention Systems designed to detect intruders to a device or network and prevent their access to sensitive data. A host IDS/IPS (HIDS/HIPS) acts the same way as perimeter IDS/IPS solutions, with the difference being where they reside within the organisation's communication mesh.
3. Content Security: Content security and filtering protects different types of content on an endpoint — files, images, documents, video or audio files. In firewalls, content security refers to the policies that allow or deny users access to certain types of content on the web.
4. Antivirus & Anti-Malware: Antivirus software is one of the oldest known technologies for protecting endpoints against known threats. An antivirus solution uses a signatures database that marks certain files as malicious and blocks or quarantines them. An anti-malware solution targets a wider range of file types including spyware, adware, trojans, worms and other files that do not necessarily spread like a virus.
5. EDR: Endpoint Detection and Response could be considered an evolved Anti-Virus/Anti-Malware solution. The core difference is that EDR solutions react to malicious behaviour, not just malicious files. EDR solutions detect and respond to more advanced threats through detailed visibility into activity and behaviour on endpoints, using machine learning and advanced techniques to perform threat hunting, incident response and forensics analysis.
6. FDCC Compliance: The Federal Desktop Core Configuration standard was established by the US Government to provide a baseline for security settings on desktops and laptops used by federal agencies. This is not widely adopted in the MENA region except for organisations that have contracts with or are partners of US government agencies.
7. Patch Management: Patches are released by software vendors primarily to address security gaps or vulnerabilities. Effective patch management follows a structured process of Patch Inventory, Vulnerability Assessment, Testing, Deployment and Verification — critical in organisations with large numbers of endpoints.

IV. Network Security

When we talk about the network layer, we mean the corporate network — the organisation-wide set of hardware, software and applications designed to communicate directly with one another, depending on segmentation and access level. Think more datacentres and less internet and endpoints.

1. Enclave/Datacentre Firewall: Monitors and controls traffic coming in and out of a datacentre. Unlike endpoint firewalls, datacentre firewalls can be offered in a variety of forms including hardware and as-a-service, depending on the organisation's topology and setup.
2. Enterprise IDS/IPS: Intrusion Detection and Prevention systems that monitor network traffic for potential security threats and remediate with the appropriate preventative action. They are designed to stop attacks such as Denial of Service (DoS), intrusions and malware.
3. VoIP Protection: A Voice-over-IP system is usually organisation-wide and is one of the most vulnerable vectors for cyber-attackers. Typical attacks on VoIP systems include eavesdropping and DoS attacks.
4. Inline Patching: A security mechanism for seamless and immediate installation of software patches to mitigate known security vulnerabilities with little to no downtime, usually done by advanced IPS systems.
5. Web Proxy Content Filtering: A security mechanism used to monitor and control access to web content by enforcing policies and rules set by the organisation to deny access to malicious or non-business-related content.
6. NAC: Network Access Control is a network-wide, device-specific security solution that allows an organisation to control access of devices connected to the corporate network following a set of security policies. Non-compliant devices with outdated software or OS patch versions can be denied access.
7. Enterprise Message Security: Solutions designed to scan and inspect inbound and outbound messages to and from the corporate network, ensuring that the enterprise security policy is met.
8. Enterprise Wireless Security: Policy, procedures, hardware and software designed to defend wireless networks from malicious activity and intrusion. For example, connectivity to the enterprise wireless network may only be accomplished using a VPN (encrypted tunnel) connection.
9. Enterprise Remote Access: Achieved through a set of policies, hardware and software tools to ensure the security of remote access connectivity, especially important for organisations with a large distributed or remote workforce. These policies can be combined with endpoint and NAC policies to achieve higher standards of preventative protection.
10. DLP: At the network level, DLP refers to systems that identify, monitor and protect data in motion (network), ensuring that data not meant to leave the organisation doesn't actually leave it.

V. Perimeter Security

1. Perimeter Firewall: Firewall(s) at the extreme end of the network, configured with rules and policies that govern data transmission from and to the entirety of the enterprise's network(s). They ensure no unauthorised access to network resources and are the first gate to the network from the internet.
2. Perimeter IDS/IPS: An IDS is a passive system that constantly monitors the perimeter and compares traffic to a set of patterns (signatures) associated with intrusive or malicious behaviour, then identifies and reports. An IPS is the active component — it scans perimeter traffic as it is transmitted and immediately denies access when a pattern is identified.
3. Secure DMZs: Demilitarised Zones are used by organisations that need to keep certain services at the edge or internet-facing (such as email, web servers or honeypots), since users of such services have no need to be within the perimeter bounds. This is a widely practised strategy to protect internal resources.
4. Message Security: Scanning and inspection of messages at the perimeter level (see Enterprise Message Security in the network layer).
5. Honeypot: A server or group of servers in a DMZ that imitate servers inside the enterprise to trick malicious intruders. They are used to observe and obtain intruders' Tactics, Techniques and Procedures (TTPs).
6. DLP: At the perimeter level, DLP monitors outbound traffic to prevent sensitive data from leaving the organisation (see Data Security layer for full details).
7. DHS Einstein: A suite of cybersecurity tools and services developed by the United States Department of Homeland Security to provide real-time situational awareness and threat detection capabilities to government agencies by monitoring network traffic and identifying known and suspected cyber threats.

VI. Human Layer — Prevention

Prevention is defined by the set of policies, procedures and practices conducted by the organisation, directed towards both human and technology assets, to ensure that security will not be compromised due to malpractice or ignorance. It should be inclusive, sustainable and continuous as threats evolve.

Almost 48% of malicious email attachments are MS-Office files (Symantec) and 90% of security breaches are a result of phishing attacks — which is why both proactive and preventative measures need to be constantly taken by cybersecurity professionals to keep their workforce, and consequently their organisation's data, safe and secure.

1. IT Security Governance: The set of IT/cybersecurity laws and policies set by an authority or government body, communicated to organisations as directives or regulations. Example: In Egypt, the CBE mandates all banks and financial institutions to deploy a Web Application Firewall.
2. Security Policies and Compliance: Organisations operating in the finance or healthcare sectors may be subject to specific security regulations and standards, such as PCI DSS or HIPAA. These policies are set by a governing body and regularly updated, with companies audited to ensure compliance.
3. Security Architecture and Design: All the elements and layers of security decided upon by an organisation's management or security professional, in accordance with the type of organisation, type of data and topology of the network.
4. Continuous C&A: Certification and Accreditation are mandatory in some organisations for cybersecurity professionals and systems. Some need to be updated on an annual basis, while others need to be re-accredited every three years due to the changing nature of the landscape.
5. Cyber Threat Intelligence: The process of gathering, analysing and examining cyber threat data from various sources including sensors, organisations and other intelligence sources.
6. Threat Modelling: This can take different shapes including Qualitative/Quantitative Information Assurance models, Attack Tree Models, and Multiple Objective Decision Analysis models, with the core goal of developing threat scenarios that guide the security measures and controls to be deployed.
7. Awareness & Training: Training and educating employees at all levels of the organisation on how to be more security-conscious and how to ensure their own and ultimately the organisation's safety in cyberspace.
8. Risk Management: Developed by NIST (Publication 800-37) — a System Life Cycle Approach for Security and Privacy aimed at reducing cyber risks that could occur from misconfiguration and code-level threats.
9. Penetration Testing: Done by offensive security teams, a system is tested against methodical and ethical hacking techniques to find vulnerabilities and security gaps before a real attack takes place.
10. Vulnerability Assessment: Similar to penetration testing, but instead of offensively attacking it, the responsible team scans the full system to identify, categorise and prioritise the vulnerabilities found within.

VII. Human Layer — Monitoring, Operations and Response

1. SOC/NOC Monitoring 24×7: Security Operations Centre / Network Operations Centre monitor all the events, incidents and transactions around the clock. This depends heavily on the expertise that operate within these two teams and can be a key factor in detecting, protecting, responding and sustaining the security best practices in an organisation.
2. Incident Reporting, Detection and Response: Also known as CIRT (Computer Incident Response Team) — trained to handle and respond to incidents detected on computer systems. Detection includes Correct Event Detection, Information Gathering, Event Triage, Escalation and Optimisation. Response encompasses Preliminary Incident Analysis, Containment, Analysis, Eradication, Recovery and Post-Incident Process Improvement.
3. Security Dashboard: An executive information screen designed to collect and present key information about systems, security and incidents.
4. Security SLA/SLO: Service Level Agreements and Objectives — reports show the key metrics delivered by said services and whether or not they met the contract terms.
5. Continuous Monitoring and Assessment: Constantly collecting security data, monitoring security events and alerts, and assessing system security state in real or near real-time, with risk scored and displayed on dashboard.
6. Situational Awareness: The level of awareness to security incidents and their impact on an organisation depends heavily on people. How an incident relates to other aspects of the systems and the time sensitivity of the compromise could differ from one person to another.
7. Focused Ops: A team utilised when an attack takes place, focused on analysing a specific attacker's Tactics, Techniques and Procedures (TTPs).
8. Digital Forensics: When data is lost or a system's security is compromised, the Digital Forensics team analyses the devices and systems to recover and investigate material that could relate to the incident.
9. Escalation Management: After an incident takes place, there needs to be a clear set of rules, policies or procedures for how the incident is managed, responded to and escalated.
10. SIEM: Security Information and Event Management — the real-time analysis of alerts and logs generated by security devices, applications and hardware. Used for both analysis and reporting of incidents, and sometimes for compliance purposes.

Now that you have a broad view of the different layers of cybersecurity and the practices and technologies available to enhance your organisation's security posture, you can begin mapping your strategy. In an upcoming post we will be elaborating further on the types of attacks that primarily target human behaviour — social engineering tactics have been growing both in quantity and sophistication.

Need help mapping your organisation's security posture against the 7 layers? Contact our team to discuss a comprehensive security assessment.