CISSP 11.10 - Implications of Multilayer Protocols

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series explores what happens when protocols stack inside one another, part of Domain 4. Encapsulation is a double-edged design pattern, and understanding how layering both empowers and undermines your controls keeps you from trusting a boundary that has quietly been bypassed.

Frequently Asked Questions

How does layered encapsulation help?

By letting protocols nest inside protocols. A single message can be wrapped again and again, with web content inside the reliable transport protocol, inside the internet protocol, inside the local frame. You can add still more layers, such as slipping encryption in the middle to create secure traffic or wrapping the whole thing in a tunnel to build a virtual private network. The result carries a wide range of higher-layer protocols and is flexible and resilient.

What is the dark side of all this layering?

The same flexibility undermines your controls, because almost anything can be hidden inside almost anything, which enables covert channels. If a network blocks one protocol but allows another, a tunneling tool can bury the forbidden protocol inside the permitted one and slip straight through the filter, even hiding a full session inside a protocol meant only for health checks. Covert channels open up, filters get bypassed, and logical segment boundaries can be overstepped.

What is a converged protocol?

It is the merging of a specialty or proprietary protocol with a standard one, usually from the mainstream internet suite. The payoff is that you reuse your existing standard network infrastructure to carry special services instead of deploying separate, dedicated hardware for each one. Convergence is about running the unusual over the ordinary, letting one common network do many specialized jobs.

What makes internet telephony both attractive and risky?

It is a converged protocol that packages voice and multimedia into network packets, popular because it is cheap and flexible and often replaces traditional phone service. But riding on the network means inheriting its dangers: caller identity can be forged for voice phishing, the phones and call managers can be attacked like any host, unencrypted calls can be intercepted, and attackers can hop across authenticated channels. Choose a solution that encrypts, since a secure real-time transport protocol exists to blunt these threats.

How does software-defined networking change the picture?

By separating the brains from the muscle. It splits the control layer, which decides where traffic should go, from the data layer, which simply forwards it. A central controller programs the whole network through interfaces, letting you mix and match cheaper hardware from any vendor and adjust settings from one console. A companion technique virtualizes network functions off dedicated appliances entirely, and the same thinking extends to virtual storage networks and managing links between distant sites.

Reference: This article is based on concepts discussed in CISSP 11.10 - Implications of Multilayer Protocols.