What are the main differences between the network-level and the application-level regarding information security?

Question

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you.

What are the main differences between the network-level and the application-level regarding information security ?

Answer 1

A simple way to think of it is in terms of devices you have in your kitchen; microwave, toaster, blender. The "network level" is the connection. Perhaps the electricity powering the devices in our example. The "application level" is specific to the thing, perhaps it involves what you put into the device or the buttons you press.

So in our example, a "network level attack" would be something like cutting the power or sending the wrong voltage. An "application level attack" would be something like putting tinfoil in the microwave.

If our device was a webserver, an application level attack would be something like SQL injection. A network-level attack would be something like a ARP-poisoning.

Often the distinction doesn't fall directly along those lines, and people are fond of the "Standard OSI Model" of network abstraction when describing behavior.

The OSI model describes the connection, so it's technically "network" either way. But it's often helpful to talk about certain aspects of the network, rather than just treating it as an opaque thing.

In that model, the application (HTTP, FTP, SMTP, IRC) is layer 7 (and sometimes 6, the OSI model doesn't directly map too real-world implementation). It's the language your programs speak once a connection is established. An attack on this layer might involve flooding buffers or authentication bypass.

Layers 2 or 3 through 5 or 6 describe getting the data successfully across the Internet. It involves IP, TCP, SSL, and all the fundamental bits that we normally describe as "the network". An attack here might involve replaying packets, redirecting traffic, or attacking stream encryption.

Layers 1 and sometimes 2 describe your physical connection; 1 is the actual voltages over your ethernet cable or radio modulation over wifi or bluetooth, while 2 is the way data is encoded to get it successfully from your machine to your router. An attack at this layer could involve cutting the wire, brute-forcing WEP keys, or MITM interception of raw traffic.

Answer 2

Generally, when you talk about application/network layers, you are speaking of layered protocols in the OSI model of a networked communication system. The network layer is layer 3 and deals with how to send packets over a network (both routing and forwarding). The main network layer protocol in use today is the internet protocol (IP) specifically IPv4 (though IPv6 is gaining more use). When your computer at your IP address wants to send packets to another IP address, it and all the intermediary routers use the internet protocol to figure out which intermediary links your packet should be sent to, so that it moves towards its destination.

The application-level is at the top of the layered protocol stack, and is the protocol that your applications conform to. That is your web browser understands and speaks HTTP, HTTP is a application layer protocol.

Granted in a security discussion where you differentiate network security issues from application security issues, you may simply split "application" issues (there's an exploitable bug in this application) versus "network" issues (an attacker on the network can eavesdrop, tamper, or cause denial of service using network services). In this broader sense, "network" would contain any security issues arising from layers 1-4¹. For example, attacks like public wifi eavesdropping (based in physical layer of listening to the radio waves), ARP spoofing (link layer) or SYN flood (transport layer) would all be network attacks.

Application level attacks would be things like SQL injection, stack/buffer overflow, where the application takes input in an exploitable way due to bad logic (or insufficient safety checks) by the application developer and has nothing to do with computer networks.

---

¹ The important layers for the internet are:

• Layer 1 - Physical layer -- how to encode 1s and 0s using physical processes in a specific medium (e.g., wifi, ethernet, etc.). May deal with issues of how to detect/prevent collisions.

• Layer 2 - Link layer -- How to provide a reliable connection between two computers directly connected to each other both using the same physical protocol. (E.g., wifi router and laptop; or two computers with an ethernet cable between them.) MAC addresses are used for addressing at the link layer.

• Layer 3 - Network Layer -- How to send a packet over the internet potentially through many different computers and possibly traversing many different types of link layers. (E.g., wifi at your home, to cable, to fiber optics at your ISP, to cable, to a data center with fiber optics). Addresses at the network layer are IP addresses.

• Layer 4 - Transport Layer -- How to group together many packets sent over the network into a segment and ensure the segment was transported in an appropriate fashion. E.g., with TCP ensure there was a SYN/ACK handshake at the start (validating the source/destination IP addresses) and then make sure all packets were sent in order, make sure you aren't sending at an inappropriate rate that congests the network, and have senders resend missing packets in an appropriate way. (UDP is the alternative transport layer to TCP, but provides virtually no guarantees but is more appropriate for say real time VoIP). Addressing at the transport layer is port number (a number between 0-65535).

• Layer 7 - Application Layer -- the data from the network that your application has to generate and parse.

Layer 5/6 (Session / Presentation) are generally integrated into the application layer for the TCP/IP model. (E.g., the application developer abstracts out the presentation layer, and the session cookie is included in the application layer).

Answer 3

There is a nice presentation on this which you can find here.

Network security talks more about vulnerabilities at the IP layer. For instance:

• IP spoofing
• Time to live headers
• Packet flooding
• IPSEC

Whereas application security talks about:

• Software vulnerabilities

as simple as a single message that is “longer then expected”, or as complex as a long dialogue where an unexpected list/order of otherwise correct messages are exchanged.