Part 1: The OSI Model (The Security Architect’s View)

Layer 7: Application Layer

• What it does: Provides network services directly to end-user applications (browsers, email clients, APIs).
• Protocols: HTTP/HTTPS, DNS, SMTP, FTP, SSH, SNMP.
• Security Focus: This is where the vast majority of modern attacks occur.
  • Threats: SQL Injection, Cross-Site Scripting (XSS), API abuse, DNS spoofing.
  • Controls: Web Application Firewalls (WAF), API Gateways, Input Validation, OAuth/OIDC.

Layer 6: Presentation Layer

• What it does: Translates, encrypts, and compresses data so the Application layer can understand it. It ensures data is sent in a usable format.
• Protocols/Technologies: SSL/TLS, JPEG, ASCII, encryption algorithms.
• Security Focus: This is the realm of Cryptography.
  • Threats: TLS downgrade attacks, weak cipher suites, expired certificates, unencrypted data in transit.
  • Controls: TLS 1.3 enforcement, HSTS (HTTP Strict Transport Security), Key Management Services (KMS), Data Loss Prevention (DLP) for data formatting.

Layer 5: Session Layer

• What it does: Establishes, manages, and terminates communication sessions between applications.
• Protocols: NetBIOS, RPC, PPTP, SQL sessions.
• Security Focus: Managing the lifecycle of a user’s connection.
  • Threats: Session hijacking, session fixation, token theft.
  • Controls: Strict session timeouts, secure session token generation (cryptographically random), single sign-on (SSO) session management.

Layer 4: Transport Layer

• What it does: Ensures end-to-end data transfer between hosts, handling segmentation, flow control, and error recovery. (This is where TCP and UDP live—detailed below).
• Protocols: TCP, UDP, SCTP.
• Security Focus: Managing the state of connections and preventing transport-level denial of service.
  • Controls: Stateful Firewalls, SYN Cookies, Port knocking.

Layer 3: Network Layer

• What it does: Handles logical addressing (IP) and routing (finding the best path across networks).
• Protocols: IPv4, IPv6, ICMP, IPsec, OSPF, BGP.
• Security Focus: Controlling traffic flow between subnets and protecting routing infrastructure.
  • Threats: IP spoofing, BGP hijacking, volumetric DDoS (L3/L4 floods), ICMP tunneling.
  • Controls: Network ACLs, uRPF (Unicast Reverse Path Forwarding), IPsec VPNs, DDoS scrubbing centers.

Layer 2: Data Link Layer

• What it does: Handles physical addressing (MAC), framing, and error detection on the local network segment.
• Protocols: Ethernet, Wi-Fi (802.11), ARP, VLANs (802.1Q).
• Security Focus: Securing the local broadcast domain and physical access.
  • Threats: ARP spoofing/poisoning, MAC flooding, VLAN hopping, rogue access points.
  • Controls: 802.1X (Port-based Network Access Control), Dynamic ARP Inspection (DAI), MAC address limiting.

Layer 1: Physical Layer

• What it does: Transmits raw bitstreams over a physical medium (cables, fiber, radio waves).
• Hardware: Ethernet cables, fiber optics, NICs, Hubs.
• Security Focus: Physical security.
  • Controls: Locked server racks, badge access to data centers, port security (disabling unused switch ports).

---

Part 2: Deep Dive into Layer 4 (Transport Layer) – TCP vs. UDP

The Transport layer is the critical bridge between the network (routing) and the application (data). Understanding the fundamental differences between TCP and UDP is vital for designing secure, high-performance Fintech architectures and configuring firewalls.

1. TCP (Transmission Control Protocol)

TCP is a connection-oriented, reliable protocol. It guarantees that data arrives intact, in order, and without errors.

• How it Works (The 3-Way Handshake): Before any data is sent, TCP establishes a connection:
  1. SYN: The client sends a synchronize packet to the server. (“I want to talk.”)
  2. SYN-ACK: The server replies with a synchronize-acknowledge packet. (“I hear you, I am ready.”)
  3. ACK: The client sends an acknowledge packet. (“Great, let’s start sending data.”)
• Key Mechanisms:
  • Sequence Numbers & Acknowledgments (ACKs): Every packet sent must be acknowledged. If an ACK isn’t received, the packet is retransmitted.
  • Flow & Congestion Control: TCP dynamically adjusts the speed of data transfer based on network congestion and the receiver’s buffer capacity.
• Use Cases: HTTP/HTTPS (Web traffic), SSH, FTP, APIs, Email (SMTP/IMAP). Any application where data loss is unacceptable.

Security Implications of TCP:

• Stateful Firewalls: Because TCP has a clear start (SYN) and end (FIN/RST), firewalls can track the “state” of a connection. A Stateful Firewall will only allow return traffic if it matches an existing, established TCP session in its state table.
• SYN Flood Attacks (DDoS): Attackers exploit the 3-way handshake by sending thousands of SYN packets but never sending the final ACK. The server keeps half-open connections in its memory until it runs out of resources and crashes. Mitigation: SYN Cookies.
• Session Hijacking: Because TCP relies on sequence numbers to order data, attackers who can predict or intercept these sequence numbers can hijack an active TCP session (e.g., taking over an SSH session).

2. UDP (User Datagram Protocol)

UDP is a connectionless, unreliable protocol. It is “fire-and-forget.” It sends data (called datagrams) without checking if the receiver is ready or if the data arrived.

• How it Works: There is no handshake. The client simply starts sending packets to the server. If a packet gets lost or corrupted in transit, UDP does not care, and it does not retransmit it.
• Key Mechanisms:
  • No Sequencing or ACKs: Packets may arrive out of order, or not at all.
  • Low Overhead: Because it lacks error-checking, flow control, and handshakes, the UDP header is much smaller (8 bytes vs. TCP’s 20+ bytes). This makes it incredibly fast and lightweight.
• Use Cases: DNS, DHCP, VoIP (Zoom/Teams), Video Streaming, Gaming, and increasingly, QUIC (the foundation of HTTP/3). Used where speed is more critical than perfect accuracy (a dropped video frame is fine; a dropped financial transaction is not).

Security Implications of UDP:

• Stateless Firewalls: Because there is no handshake, firewalls cannot track UDP “sessions” the same way they track TCP. Firewalls must use heuristic rules (e.g., “If an internal IP sends a UDP packet to an external DNS server on port 53, allow the return UDP packet back for 5 seconds”).
• UDP Amplification / Reflection Attacks (DDoS): This is a massive threat. Attackers send small UDP requests to public servers (like DNS or NTP servers) but spoof the source IP address to be the victim’s IP. The server sends a massive UDP response to the victim. If the response is 50x larger than the request, the attacker has amplified their attack power by 50x.
• IP Spoofing: Because UDP doesn’t require a 3-way handshake to establish a connection, it is incredibly easy for attackers to forge (spoof) the source IP address in a UDP packet. (TCP spoofing is much harder because the attacker would have to receive the SYN-ACK to complete the handshake).

---

Summary Comparison Table for Architects

Feature	TCP (Transmission Control Protocol)	UDP (User Datagram Protocol)
Connection Type	Connection-oriented (Requires Handshake)	Connectionless (Fire-and-Forget)
Reliability	High (Guarantees delivery and order)	Low (No delivery guarantee)
Speed / Overhead	Slower, Heavy overhead (20+ byte header)	Very Fast, Lightweight overhead (8 byte header)
Flow/Congestion Control	Yes (Dynamic adjustment)	No (Sends as fast as the app generates data)
Primary Use Cases	Web (HTTP/S), APIs, SSH, Databases	DNS, DHCP, VoIP, Video, Streaming, QUIC
Firewall Handling	Stateful Inspection (Tracks exact session state)	Stateless / Heuristic tracking (Time-based allowances)
Primary Security Risks	SYN Floods, Session Hijacking	Amplification/Reflection DDoS, Easy IP Spoofing

Strategic Takeaway for Fintech & Platform Security

When designing a Fintech platform, we must choose the right transport protocol based on the risk profile:

• Core Banking & Payments: Strictly TCP/TLS. We need the guaranteed delivery, strict ordering, and stateful tracking to ensure a $10,000 transfer isn’t duplicated or lost.
• Real-time Market Data / Trading Feeds: Often UDP (or specialized multicast). If a stock ticker drops a millisecond of data, the system must keep moving. The latency of TCP retransmissions is unacceptable here.
• Modern API Security: The industry is moving toward HTTP/3 (which uses QUIC over UDP). we must realize that traditional firewalls that only inspect TCP traffic will become blind to HTTP/3 traffic. we need to upgrade the WAFs and Proxies to inspect UDP-based QUIC traffic to maintain security visibility.