Security Products by Layer

L1 Physical

Security at L1 follows one iron rule: anyone who can physically touch the equipment can bypass nearly every protection above it. Products here either keep people out (access control, shielding, out-of-band isolation), assume the cable is already tapped (link encryption), or deal with data still sitting on decommissioned drives (media sanitization).

L2 Data Link

Layer 2 security answers two questions: who can attach to this network, and once attached can they impersonate someone else. Campus networks solve it with NAC and built-in switch features, while public cloud simply removes most of the L2 attack surface (no broadcast flooding, no MAC spoofing, no promiscuous mode) — so almost every product here lives on the c…

L3 Network

Security at L3 has three threads: north-south control with firewalls and IPS at the perimeter, microsegmentation internally to cut lateral movement, and the most overlooked one — the addressing and routing attack surface (BGP hijacks, DDoS, source address spoofing). Most organizations do the first two and have nobody who owns the third.

L4 Transport

Layer 4 security is about which ports are exposed and whether connection resources can be exhausted. An attacker's first move is always a port scan, so the highest-value investment here is not buying protection but closing what should never have been open — the vast majority of breached databases, Redis instances and Kubernetes APIs were simply listening on…

L5 Session

Session-layer security is about binding identity to a session: authentication happens once, but a session may live for hours or days, which is why attackers long ago moved from cracking passwords to stealing session tokens and cookies.

L6 Presentation

Presentation-layer security is applied cryptography engineering: whether certificates expire, where keys live, whether algorithms are still safe, and whether data is genuinely encrypted at rest and in transit.

L7 Application

The application layer is where attacks actually land: nearly every serious data breach, ransomware entry and business fraud arrives through one of four channels — HTTP, APIs, DNS or email.

Cross-layer · Security Operations & Response

This layer determines whether the investment in the seven layers above can actually be seen and acted on. The real gap in practice is not missing products but missing people and process: a SIEM nobody watches, EDR with no response plan, logs retained but with unsynchronized clocks so nothing can be correlated.