Domain 4 is not “know the seven layers.” It is match the control to what the layer can see, then encrypt the right hop, then contain east-west blast radius. OSI is the exam’s inspection language; TCP/IP is what the packet actually rides. TLS 1.3 protects applications; IPsec ESP in tunnel mode protects whole packets over an untrusted path; SSH replaces Telnet. VLANs split broadcast domains. They do not stop a neighbour. Micro-segmentation and zero-trust policy do. SDN moves the decision to a controller — northbound APIs take intent from apps, southbound APIs program the data plane. A manager’s first move after a flat-network breach is a data-flow map and a segmentation policy, not a purchase order for OpenFlow.
1. Why Domain 4 matters
ISC2 weights Communication and Network Security at 13% of the CISSP CAT (exam outline effective 15 April 2024). The official objectives are three verbs: apply secure design in network architectures, secure the components, and implement secure channels. The exam — and a real board review — punish the same mistake: treating “inside the firewall” as trusted.
That is the ticket in this lesson. A contractor lands on a flat 10.20.0.0/16 over VPN. Identity was checked at the gate. Nothing re-checked the hop from a finance laptop to a database two subnets away. North-south looked fine. East-west was a highway.
Manager lens
Blast radius, residual risk, and who owns the data flow. Buy nothing until the asset list and the allowed conversations exist on paper.
Engineer lens
Layer, header, and enforcement point. If the control cannot see the field, it cannot stop the abuse — no matter how expensive it is.
4.1 OSI and TCP/IP, IPv4/IPv6 casts, secure protocols, traffic flows, physical / logical / micro-segmentation, SDN (API, SD-WAN, NFV). 4.2 NAC and endpoint as component controls. 4.3 Remote access and third-party channels. Source: ISC2 CISSP Certification Exam Outline.
2. Mental model — OSI vs TCP/IP
Pre-train three words before the diagram. Encapsulation is wrapping a payload in the next header as data goes down the stack. Decapsulation is unwrapping on the way up. The layer a control lives on is the set of fields it is allowed to read. A packet filter that only sees IP and port cannot rate-limit a login POST. A WAF that never sees Layer 2 cannot stop ARP spoofing.
OSI is seven boxes so the exam can ask “what can this control inspect?” TCP/IP is four boxes because that is how the internet is implemented. You need both: OSI for judgment, TCP/IP for the packet.
Read left → right. OSI 5–7 collapse into TCP/IP Application. OSI 1–2 collapse into Link. IPsec lives at Network / Internet so it can protect any upper protocol.
The layer decides what the control can see. MAC is Layer 2. IP is Layer 3. Ports and the TCP handshake are Layer 4. URLs and login bodies are Layer 7. IPsec is Layer 3 so it can wrap anything above it.
IPv4 and IPv6 casts (outline 4.1)
ISC2 lists four delivery types. Unicast is one-to-one. Multicast is one-to-many who subscribed. Anycast is one-to-nearest instance of the same address (how anycast DNS and many CDNs work). Broadcast is one-to-all on the local network — IPv4 only. IPv6 has no broadcast; it uses multicast instead. IPsec is an add-on in IPv4 and a native architectural capability in IPv6.
| Control inspects | OSI layer | What it can stop | What it cannot see |
|---|---|---|---|
| Cable lock, port disable, fibre vs copper | 1 Physical | Tap, jam, unlocked patch panel | Anything in the frame |
| DAI, DHCP snooping, 802.1X, port security | 2 Data Link | ARP spoof, MAC flood, rogue jack | IP payload, HTTP body |
| Router ACL, IPsec, packet filter | 3 Network | Spoofed routes, clear IP on the WAN | Application verbs |
| Stateful firewall, SYN cookies | 4 Transport | Blind scans, some floods | Encrypted or L7 abuse on 443 |
| WAF, proxy, NGFW app-ID, DNSSEC validator | 7 Application | Credential stuffing, SQLi, poison DNS | L2 neighbour tricks |
Buying a Layer-3 firewall to stop credential stuffing. The box only sees 10.20.4.0/24:443. The abuse is in the HTTP body. Add a Layer-7 control, or you paid for a door that cannot read the letter.
3. Decision flow — layer, protocol, cut
Draw this before you buy a box or write a standard. First decide what field you must see. Then pick the protocol that protects that hop. Then pick the cut that contains blast radius if the hop still fails.
Read top → down. Diamond is the isolation question. Right column is the exam trap: “we deployed SASE” is not an east-west answer.
North-south is client to data centre or internet — the classic perimeter. East-west is workload to workload inside the same plant. Most modern damage is east-west after one phish. NIST SP 800-207 is blunt: do not grant implicit trust from network location.
4. How to choose protocols and segments
ISC2 names the secure-protocol family explicitly: IPsec, SSH, SSL/TLS. SSL is historic. TLS is the living standard. TLS 1.0 and 1.1 are retired; treat them as audit findings. TLS 1.3 (RFC 8446) mandates forward secrecy and a shorter handshake. SSH (RFC 4251) is the remote-admin channel that replaces Telnet. IPsec (RFC 4301) sits at Layer 3.
| Flow | Prefer | Why | Do not pick |
|---|---|---|---|
| Browser to SaaS / internal HTTPS | TLS 1.3 (1.2 minimum) | Application confidentiality + integrity; PFS | SSL, TLS 1.0/1.1, clear HTTP |
| Site-to-site or host VPN over internet | IPsec ESP, tunnel mode, IKEv2 | Encrypts payload and original IP header | AH (no encryption); transport mode (header in the clear) |
| Router / switch / Linux admin | SSH | Encrypted remote shell and file copy | Telnet, rsh, unauthenticated HTTP UI |
| File move | SFTP or FTPS | Auth + confidentiality | FTP, TFTP |
| Device telemetry | SNMPv3 | Auth and privacy options | SNMPv1 / v2c community strings |
| DNS authenticity | DNSSEC | Signed records, stops cache poison | Claiming DNSSEC is “private” |
| DNS confidentiality | DoT or DoH | Encrypts the query path | DNSSEC alone |
IPsec in one breath
AH (Authentication Header) gives integrity and origin authentication. It encrypts nothing. ESP (Encapsulating Security Payload) adds confidentiality. Transport mode protects the payload between two hosts and leaves the original IP header visible. Tunnel mode wraps the entire original packet in a new IP header — that is the site-to-site and remote-access pattern. IKE (usually IKEv2) builds the security associations. If the stem wants confidentiality across an untrusted network, the answer is almost always ESP in tunnel mode.
Segmentation menu (outline words, not vendor words)
| ISC2 term | What it actually is | Use when | Limit |
|---|---|---|---|
| Physical — air-gapped | No shared forwarding path at all | OT, classified, crown-jewel backups | Expensive; sneaker-net becomes the risk |
| Physical — out-of-band | Management plane on separate media | Network admin when the data plane is sick or hostile | In-band mgmt dies with the attack |
| Logical — VLAN (802.1Q) | Tagged broadcast domain on a switch | HR vs Finance on the same closet | Hosts in the VLAN still talk freely |
| Logical — VPN | Encrypted overlay across untrusted path | Branch, partner, remote admin | Classic VPN drops you on a subnet |
| Logical — VRF / virtual domain | Separate routing tables or virtual FW | Multi-tenant, partner VRF, overlapping IPs | Still coarse inside each VRF |
| Micro-segmentation | Distributed FW, overlay, identity per flow | Stop east-west after one host is owned | Needs a flow map or you brick production |
“We deployed SASE / ZTNA, so lateral movement is solved.” ZTNA verifies the user to one application (north-south). It does not write the east-west rule between two servers in the same subnet. Full zero trust in Domain 4 language is identity plus micro-segmentation, not a new remote-access brand.
5. Runbook — manager, then engineer, then prove
This is not a CLI lab. It is the review-board sequence ISC2 wants when the stem says FIRST or BEST after a flat-network incident. Source for the manager half: NIST SP 800-207 (protect the resource, not the segment). Source for the protocol half: RFC 4301 and the ISC2 secure-protocol list.
Side A — Manager / CISO (scope before spend)
-
Name the asset and the owner
Payroll DB, OT historian, partner VRF — not “the network.” The data owner classifies. Security does not invent the label.
-
Map allowed conversations
Who may talk to whom, on which port, from which identity, in which direction. If this sheet does not exist, any SDN purchase is decoration.
-
Choose the cut from residual risk
Air-gap if a wrong packet is catastrophic. VLAN + ACL if the zone is coarse and the budget is real. Micro-segmentation if one phish must not become a plant-wide event. Record the residual risk the board accepts.
-
Write the standard, then fund the tool
Policy → standard → procedure. “Buy OpenFlow” is not a first move. “No implicit trust from RFC1918 location” is.
Side B — Engineer (design the path)
-
Match each threat to a layer
Rogue jack → 802.1X + NAC. ARP spoof → DAI + DHCP snooping. WAN sniff → IPsec ESP tunnel. Login abuse → L7. Management plane → SSH + OOB.
-
Retire the cleartext twins
Telnet → SSH. FTP → SFTP/FTPS. SNMPv1/v2c → SNMPv3. HTTP admin → TLS 1.2+ (prefer 1.3). Prove with a port scan and a config dump, not a slide.
-
Build the cut you were given
VLAN + SVI ACL for coarse zones. VRF when routing tables must not leak. Distributed or host FW for micro-seg. Never put in-band management on the same VRF the attacker just owned.
-
If SDN is the vehicle, lock the controller
The controller is now a crown jewel. Northbound APIs take intent from apps. Southbound APIs program switches. Compromise the controller and you program the plant. Authenticate both APIs, separate the management plane, monitor southbound change rate.
Side C — Prove (pilot, then expand)
-
Pick one blast-radius story
Compromised contractor laptop must not reach the payroll DB. Write that as a fail/pass test before go-live.
-
Instrument the path
Flow logs (who talked to whom), IPsec SA up, TLS version on the VIP, 802.1X auth success/fail, SDN controller audit of southbound writes.
-
Break it on purpose
From the pilot host, attempt the forbidden hop. Expect deny + log. If it succeeds, the VLAN was a costume.
src_identity=contractor.jdoe src_ip=10.20.14.55 dst_ip=10.20.80.12 dst_port=5432 action=deny enforcement=distributed-fw | microseg-policy payroll-db-only reason=no identity grant ipsec=esp-tunnel ikev2 sa=up tls_vip=1.3 mgmt=ssh + oob-only
6. Runtime path — packet and SDN planes
Two pictures. First the packet. Then the controller that may be steering it.
Northbound = apps ↔ controller. Southbound = controller ↔ devices. Reverse them on the exam and the whole answer is wrong.
Transport architecture (4.1)
Data plane forwards. Control plane decides routes and policy. Management plane is how humans and tools change the box — keep it OOB. Cut-through switches start forwarding before the whole frame arrives (low latency, less check). Store-and-forward buffers the frame (more check, more latency).
Metrics the outline names
Bandwidth, latency, jitter, throughput, signal-to-noise. VoIP and collaboration (4.3) die on jitter, not on “the firewall is up.” QoS is an availability control, not decoration.
VoIP, iSCSI, InfiniBand-over-Ethernet, and CXL ride IP or Ethernet and inherit that path’s threats. If storage (iSCSI) shares the user LAN, a laptop can reach a LUN. Separate the fabric. Multilayer means a control at one layer cannot see another — TLS will not save you from a poisoned ARP table under it.
7. Traps and proof
| Trap | What people say | What is actually true | Fix |
|---|---|---|---|
| Castle-and-moat | “Inside the firewall is trusted.” | Location is not trust (NIST SP 800-207). | Identity + east-west policy. |
| VLAN as a security boundary | “They’re on VLAN 40, we’re safe.” | Same VLAN is a free LAN. VLAN hopping is a thing. | ACL / FW between zones; micro-seg inside. |
| AH for a VPN | “IPsec is on.” | AH authenticates. It does not encrypt. | ESP, usually tunnel mode. |
| DNSSEC as privacy | “DNS is now confidential.” | DNSSEC signs. Queries stay readable. | Add DoT or DoH. |
| ZTNA without east-west | “SASE solved lateral movement.” | ZTNA is entry to one app. | Add micro-segmentation. |
| In-band management | “We’ll SSH over the production VRF.” | The attacker owns your keyboard. | OOB management plane. |
| Split tunnel | “Internet direct is faster.” | Bypasses inspection and DLP. | Full tunnel or explicit SWG exception list. |
| Unprotected SDN controller | “Software defined, so agile.” | One API key programs the plant. | Lock northbound/southbound; monitor writes. |
- Data-flow sheet signed by the asset owner (who may talk to whom).
- Cleartext twins gone: Telnet, FTP, SNMPv1/v2c, HTTP-on-mgmt.
- WAN path: IPsec ESP + tunnel + IKEv2, SA up in both directions.
- VIP / browser path: TLS 1.2+ only, 1.3 preferred; old protocols fail the handshake.
- Access: 802.1X NAC on the conference-room jack; unknown MAC gets no IP.
- Management: SSH + OOB; in-band admin disabled on production VRFs.
- East-west: pilot host denied to crown-jewel port; deny is logged with identity.
- If SDN: controller on a dedicated plane; southbound change log reviewed.
- Wireless (if in scope): WPA3-SAE, not WPA2-PSK transition mode in high-security zones.
- Third-party / telecom path (4.3): contract names encryption, no shared jump host onto the LAN.
Weak: “We use VLANs and a firewall, plus VPN for remote users.” Strong: “We mapped allowed conversations, encrypted the untrusted hop with ESP-tunnel or TLS 1.3, gated the jack with 802.1X, and wrote identity-aware east-west denies so a phished contractor cannot walk to payroll. SDN, if we use it, is a controller we treat as a crown jewel, not a feature checkbox.”
Knowledge check
Six judgment items. Same traps the CAT uses: layer blindness, AH vs ESP, ZTNA as a lateral-movement cure, northbound vs southbound, manager FIRST, DNSSEC as privacy. Check answers, then reset if you miss any.
Sources
- ISC2, CISSP Certification Exam Outline (effective 15 April 2024) — Domain 4: Communication and Network Security (13%). PDF: CISSP-Exam-Outline-April-2024-English.pdf.
- NIST SP 800-207, Zero Trust Architecture — no implicit trust from network location; protect the resource.
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs — AH vs ESP, transport vs tunnel.
- IETF RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3.
- IETF RFC 4301, Security Architecture for the Internet Protocol (IPsec).
- IETF RFC 4251, The Secure Shell (SSH) Protocol Architecture.
- IEEE 802.1Q — VLAN tagging; IEEE 802.1X — port-based NAC.
Related: Domain 3 · Architecture and Engineering · Domain 5 · IAM · All 8 domains map · Domain 4 timed assessment