CISSP 11.4 - Common Application Layer Protocols

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series tours the everyday protocols that live at the top of the stack, continuing Domain 4. These protocols and their ports are the raw material of firewall rules and hardening checklists — and knowing which are safe, which are obsolete, and which secure replacement to reach for is judgment a security professional applies every week.

Frequently Asked Questions

How should you think about the application-layer protocol family?

As a set of specialized couriers, each with its own job and its own street address. These protocols handle specific tasks — moving files, carrying mail, serving web pages, or reporting device health — and each one listens on a numbered port, its address on the machine. The recurring theme: many of the originals send everything in cleartext, and for each one there is now an encrypted successor you should use instead.

Which remote-access and file-transfer protocols must you retire?

The plaintext ones. The old terminal-access protocol sends commands and even passwords in the clear, so replace it with the secure shell. The classic file-transfer protocol likewise exposes credentials and data, so move to its secured variants, and its trivial cousin needs no authentication at all and should simply be avoided. These legacy protocols treat your login like a postcard anyone in the sorting office can read.

How do the email protocols differ, and how do you secure them?

Three protocols do the heavy lifting, and each has an encrypted form. One carries mail from a client to a server and between servers, and you should run it wrapped in transport layer security. Two more pull messages down into a mail client — the older one simply downloads and removes, while the newer one can sync, fetch just headers, and manage messages on the server — and both should only run in their encrypted forms.

What separates plain web traffic from secure web traffic?

Exactly one thing: encryption. The basic web protocol moves page elements from server to browser in cleartext, readable by anyone in the path, while its secure form is the same protocol wrapped in transport layer security, which shields the whole exchange. Same job, but one version is a glass envelope and the other is opaque — on any modern site, the encrypted form is the only acceptable choice.

Which management and service protocols round out the set?

One protocol hands out addressing configuration to devices as they boot, saving you from touching each machine. Others spool print jobs, share files between different systems, or provide a graphical interface to command-line systems, and several of these are safest when tunneled inside a VPN. Finally, the network-management protocol collects health and status from routers, switches, and firewalls — insist on the modern, encrypted version, whose status alerts, called traps, notify your console the moment a threshold is crossed.

Reference: This article is based on concepts discussed in CISSP 11.4 - Common Application Layer Protocols.