Confused with the difference between approaches to network level, transport level and application level security

Question

I'm reading from Cryptography and Network Security: Principles and Practice by William Stallings and I can't quite get the difference between transport and network level security by reading the text.

In particular, after mentioning the transport level approach it doesn't say anything about why it would be used rather than the network level approach. Why isn't the network level approach enough in the first place?

It gets more confusing when it mentions "TLS can be embedded in specific packages (e.g. web browsers) because this makes it more of "application-level" approach.

Answer 1

The pictures drawn are a bit misleading (that is to say, I think b and c are wrong).

The first is the network level security. If you implement network-level security between network A and network B, all traffic between those two networks wil use that security. If an IPSec tunnel is created, whether it is http, https, telnet or ssh, all the traffic will go through that IPSec tunnel. The outside world (outside the tunnel) wil not see the kind of traffic that goes over your tunnel, so no-one can see that you're still using telnet, for example. (in stead of whole networks, you can also use a single host)

TLS is a bit higher in the network stack. That means that more parts of the packets over the network are visible. For example: if you're using your browser to access a tls-secured site, the outside world will see that you are accessing port 443 (if all things are default). In practice nowadays, there is not a single TLS layer for all applications above it. Virtually all applications that use TLS have their own layer implemented in the application. So, imho, b should be

+------+------+-----+
| HTTP |  FTP | SMTP|
+------+------+-----+
|  TLS |  TLS | TLS |
+------+------+-----+
|       TCP         |
+-------------------+
|       IP          |
+-------------------+

Application level encryption is then again more specific per application. S/MIME for mail is a good example, Kerberos is not.

So, why is the network-level not sufficient at the first place? The reason is, that it establishes trust between networks. Whole networks. And you may just be interested in a single host. Also, seting-up an IPSec tunnel is much more difficult than setting-up a TLS session with your browser. So, scope and complexity make network-level security not sufficient for everything.

So would TLS be sufficient for everything? Well, no. For example, I use an openVPN (=networklevel security) from my mobile devices to my home network. In this way, I do not have to expose all my internal hosts for TLS access to the Internet. On the other hand, it does replace a lot of application-level encryption. For example, real application level encryption on the WWW is virtually absent, because all browsers and webservers use TLS instead.

Real application level encryption is a bit a niche market. S/MIME for mail is supported by many mail-readers, but trying to mail with S/MIME from an MFP or IOT device is not always supported. You would typically use S/MIME if you do not trust your mail provider.

So, complexity, scope and support are also points to consider when implementing.

Answer 2

difference between transport and network level security by reading the text.

There is very little difference and these discussions require context to have practical discussions.

Network level security is implemented by network devices. Think firewalls, access gateways, network segmentation. Remember that these devices may and today often do have abilities which can interact at levels above the Network Level.

The Transport Layer (Within TCP/IP) establishes host-to-host connectivity in the form of end-to-end message transfer services that are independent of the underlying network layer and independent application layer. Seldom is security implemented at this level.

Transport Layer Security (TLS/SSL) which runs in the application layer of the Internet protocol suite (TCP/IP) used to transport that data over the network.

Application Level security is implemented within an application which encrypts the data which is sent to the transport Layer Protocol which goes over the network through the various devices.

No one should assume that any one level of security is "better" than another and typically more than one is implemented.

The OSI Model has a Presentation layer which is typical for where Encryption and Decryption are typically performed.

Almost always in security failures are improper implementation than on protocol errors.

Answer 3

Let's start by saying that this is a mental model to help you better learn / think about these concepts, which means the usual aphorism applies: "All models are wrong, but some are useful" -- George Box.\

So if the difference between Network / Transport / Application levels are helpful to you, then great, but know that the boundaries are fuzzy and sometimes even wrong, so take it with a grain of salt.

---

Metaphor time!

I am trying to file my taxes by mail.

Network layer: The postal service.

I put my envelope into a mailbox, a guy picks it up, it goes to a sorting facility and is sorted based on the address on the envelope, it goes out for delivery, it makes it to the destination.

There are some security concerns that are unique to this transport layer; for example could a bad guy pull envelopes out of the mailbox? Could a malicious employee either at the sorting facility or on the delivery route do something bad to your envelope?

Transport layer: The envelope.

There's the sticky seal. There's the thickness of the paper of the envelope to prevent people reading the contents up against a light. There's the TO: and FROM: addresses on the envelope.

All of these things have potential security abuses associated with them. You could also think of security abuses that have to do with the interactions between the Network and Transport layers; for example messing with the stamp on the envelope or the shape of the envelope might cause it to get sorted differently, which could be abused.

Application layer: So your envelope gets successfully delivered to the government. They are going to open it and check that the forms inside are filled out properly. They will send you back mail based on whether they accepted your forms ore not.

There are security abuses unique to the application layer, like lying on the forms. You could also think of security abuses that have to do with the interactions between the Application and Transport layers, like writing someone else's From: address on the envelope to try to trick the government into processing the forms incorrectly or sending the response to the wrong place.

---

Summary: In all cases, a network communication involves two people trying to communicate over some network operated by a 3rd party. Security issues happen when someone can trick one of the parties involved to do something they shouldn't.

This is true in the physical world just as it is in the digital world.

Sometimes thinking of Network vs Transport vs Application will help you keep your thoughts straight, but beyond that there's not much use to models like that.