ISA-IEC-62443 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Questions and Answers

API 1164 is an industry sector-specific standard that provides guidance on the cybersecurity of pipeline supervisory control and data acquisition (SCADA) systems. API stands for American Petroleum Institute, which is the largest U.S. trade association for the oil and natural gas industry. API 1164 was first published in 2004 and revised in 2009 and 2021. The latest version of the standard aligns with the ISA/IEC 62443 series of standards and incorporates the concepts of security levels, zones, and conduits. API 1164 covers the security lifecycle of pipeline SCADA systems, from risk assessment and policy development to implementation and maintenance. The standard also defines roles and responsibilities, security requirements, security controls, and security assessment methods for pipeline SCADA systems.

References:

• API 1164: Pipeline SCADA Security, Fourth Edition, September 2021
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 2.2.2, Industry Sector-Specific Standards
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Exam Specification, Section 2.2.2, Industry Sector-Specific Standards

 The risk analysis category of an IACS consists of two elements: business rationale and risk identification and classification1. Business rationale is the process of defining the scope, objectives, and criteria for the risk analysis, as well as the roles and responsibilities of the stakeholders involved. Risk identification and classification is the process of identifying the assets, threats, vulnerabilities, and consequences of a cyberattack on the IACS, and assigning a risk level to each scenario based on the likelihood and impact of the attack1. These elements are essential for establishing a baseline of the current risk posture of the IACS and determining the appropriate risk treatment measures to reduce the risk to an acceptable level. References: 1: ISA/IEC 62443-3-2:2020, Security for industrial automation and control systems - Part 3-2: Security risk assessment for system design, International Society of Automation, Research Triangle Park, NC, USA, 2020.

 Network security is important in IACS environments because PLCs, or programmable logic controllers, are devices that control physical processes and equipment in industrial settings. PLCs under cyber attack can have costly and dangerous impacts, such as disrupting production, damaging equipment, compromising safety, and harming the environment. Therefore, network security is essential to protect PLCs and other IACS components from unauthorized access, modification, or disruption. The other choices are not primary reasons why network security is important in IACS environments. PLCs are not inherently unreliable, but they can be affected by environmental factors, such as temperature, humidity, and electromagnetic interference. PLCs are programmed using ladder logic, which is a graphical programming language that resembles electrical schematics. PLCs use serial or Ethernet communications methods, depending on the type and age of the device, to communicate with other IACS components, such as human-machine interfaces (HMIs), supervisory control and data acquisition (SCADA) systems, and distributed control systems (DCSs). References:

• ISA/IEC 62443 Standards to Secure Your Industrial Control System training course1
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide2
• Using the ISA/IEC 62443 Standard to Secure Your Control Systems3

The File Transfer Protocol (FTP) is an application layer protocol that moves files between local and remote file systems. It runs on top of TCP, like HTTP. To transfer a file, 2 TCP connections are used by FTP in parallel: control connection and data connection. The control connection is used to send commands and responses between the client and the server, while the data connection is used to transfer the actual file. FTP is one of the standard communication protocols defined by the TCP/IP model and it does not fit neatly into the OSI model. However, since the OSI model is a reference model that describes the general functions of each layer, FTP can be considered as an application layer protocol in the OSI model, as it provides user services and interfaces to the network. The application layer is the highest layer in the OSI model and it is responsible for providing various network services to the users, such as email, web browsing, file transfer, remote login, etc. The application layer interacts with the presentation layer, which is responsible for data formatting, encryption, compression, etc. The presentation layer interacts with the session layer, which is responsible for establishing, maintaining, and terminating sessions between applications. The session layer interacts with the transport layer, which is responsible for reliable end-to-end data transfer and flow control. The transport layer interacts with the network layer, which is responsible for routing and addressing packets across different networks. The network layer interacts with the data link layer, which is responsible for framing, error detection, and medium access control. The data link layer interacts with the physical layer, which is responsible for transmitting and receiving bits over the physical medium. References:

• File Transfer Protocol (FTP) in Application Layer1
• FTP Protocol2
• What OSI layer is FTP?3

 The abbreviation CSMS stands for Cyber Security Management System in ISA 62443-2-1. This standard defines the elements necessary to establish a CSMS for industrial automation and control systems (IACS) and provides guidance on how to develop those elements123. A CSMS is a collection of policies, procedures, practices, and personnel that are responsible for ensuring the security of IACS throughout their lifecycle24. References: 1: ISA/IEC 62443 Series of Standards - ISA 2: ISA 62443-2-1 - Security for industrial automation and control systems, Part 2-1: Establishing an Industrial Automation and Control Systems Security Program | GlobalSpec 3: IEC 62443-2-1:2010 | IEC Webstore | cyber security, smart city 4: Structuring the ISA/IEC 62443 Standards - ISAGCA

PROFINET is the implementation of PROFIBUS over Ethernet for non-safety-related communications. It is a standard for industrial Ethernet that enables real-time data exchange between automation devices, controllers, and higher-level systems. PROFINET uses standard Ethernet hardware and software, but adds a thin software layer that allows deterministic and fast communication. PROFINET supports different communication profiles for different applications, such as motion control, process automation, and functional safety. PROFINET is compatible with PROFIBUS, and allows seamless integration of existing PROFIBUS devices and networks123

References: 1: What is PROFINET? - PI North America 2: PROFINET - Wikipedia 3: PROFINET Technology and Application - System Description

 The ISASecure conformance certification program is managed by the Security Compliance Institute (ISCI), a non-profit organization established in 2007 by a group of industry stakeholders, including end users, suppliers, and integrators. ISCI’s mission is to provide a common industry-accepted set of device and process requirements that drive device security, simplifying procurement for asset owners and device assurance for equipment vendors12. References: 1: ISASecure - IEC 62443 Conformance Certification - Official Site 2: Certifications - ISASecure

The NIST CSF is a voluntary framework that provides a set of standards, guidelines, and best practices to help organizations manage cybersecurity risks. The NIST CSF consists of five core functions: Identify, Protect, Detect, Respond, and Recover. Each function is further divided into categories and subcategories that describe specific outcomes and activities. The NIST CSF also provides informative references that link the subcategories to existing standards, guidelines, and practices that can help organizations achieve the desired outcomes. The informative references are not mandatory or exhaustive, but rather serve as examples of possible sources of guidance. The ISA 62443 standards are used as informative references in the NIST CSF v1.0 for several subcategories, especially in the Protect and Detect functions. The ISA 62443 standards are a series of standards that provide a framework for securing industrial automation and control systems (IACS). The ISA 62443 standards cover various aspects of IACS security, such as terminology, concepts, requirements, policies, procedures, and technical specifications. The ISA 62443 standards are aligned with the NIST CSF in terms of the core functions and the risk-based approach. Therefore, the ISA 62443 standards can provide useful guidance and best practices for organizations that use IACS and want to implement the NIST CSF. References:

• NIST Cybersecurity Framework - Official Site1
• Framework for Improving Critical Infrastructure Cybersecurity - Version 1.02
• ISA/IEC 62443 Standards - Official Site3
• ISA/IEC 62443 Compliance & Scoring | Centraleyes4

Security zones are logical groupings of assets that share common security requirements based on factors such as criticality, consequence, vulnerability, and threat. Security zones are used to apply the principle of defense in depth, which means creating multiple layers of protection to prevent or mitigate cyberattacks. By creating security zones, asset owners can isolate the most critical or sensitive assets from the less critical or sensitive ones, and apply different levels of security controls to each zone according to the risk assessment. Security zones are not necessarily aligned with physical network segments, as assets within the same network may have different security requirements. For example, a network segment may contain both a safety instrumented system (SIS) and a human-machine interface (HMI), but the SIS has a higher security requirement than the HMI. Therefore, the SIS and the HMI should be in different security zones, even if they are in the same network segment. Similarly, assets within the same logical communication network may not have the same security requirements, and therefore should not be in the same security zone. For example, a logical communication network may span across multiple physical locations, such as a plant and a corporate office, but the assets in the plant may have higher security requirements than the assets in the office. Therefore, the assets in the plant and the office should be in different security zones, even if they are in the same logical communication network. Finally, all components in a large or complex system should not be in the same security zone, as this would create a single point of failure and expose the entire system to potential cyberattacks. Instead, the components should be divided into smaller and simpler security zones, based on their security requirements, and the communication between the zones should be controlled by conduits. Conduits are logical or physical connections between security zones that allow data flow and access control. Conduits should be designed to minimize the attack surface and the potential impact of cyberattacks, by applying security controls such as firewalls, encryption, authentication, and authorization. References:

• How to Define Zones and Conduits1
• Securing industrial networks: What is ISA/IEC 62443?2
• ISA/IEC 62443 Series of Standards3

Security Levels (SLs) are a way of expressing the security performance of an industrial automation and control system (IACS) or its components. SLs are broken down into three types: target, capability, and achieved1.

• Target SL is the level of security performance that is required for a system or component to protect against a specific threat scenario. The target SL is determined by conducting a risk assessment that considers the likelihood and impact of potential security incidents1.
• Capability SL is the level of security performance that a system or component can provide based on its design and implementation. The capability SL is determined by evaluating the security functions and features of the system or component against a set of security requirements1.
• Achieved SL is the level of security performance that a system or component actually provides in its operational environment. The achieved SL is determined by verifying that the system or component is properly installed, configured, maintained, and monitored1.

References: ISA/IEC 62443 Standards to Secure Your Industrial Control System, page 3-4.

Patches are software updates that fix bugs, vulnerabilities, or improve performance or functionality. Patches are important for maintaining the security and reliability of an IACS environment, but they also pose some challenges and risks. Applying patches in an IACS environment is not as simple as in an IT environment, because patches may affect the availability, integrity, or safety of the IACS. Therefore, patches should not be applied blindly or automatically, but based on the organization’s risk assessment. The risk assessment should consider the following factors: 1

• The severity and likelihood of the vulnerability that the patch addresses
• The impact of the patch on the IACS functionality and performance
• The compatibility of the patch with the IACS components and configuration
• The availability of a backup or recovery plan in case the patch fails or causes problems
• The testing and validation of the patch before applying it to the production system
• The communication and coordination with the stakeholders involved in the patching process
• The documentation and auditing of the patching activities and results References: ISA TR62443-2-3 - Security for industrial automation and control systems, Part 2-3: Patch management in the IACS environment

Cybersecurity and physical security regulations are intended to provide guidance and requirements for protecting industrial control systems from various threats and risks. However, these regulations may face mixed resistance from different stakeholders for various reasons. One of the reasons is that there are a limited number of enforced cybersecurity and physical security regulations, especially at the international level. This means that some regions or countries may have more stringent or comprehensiveregulations than others, creating inconsistencies and challenges for cross-border cooperation and compliance. Moreover, some regulations may be outdated or not aligned with the current best practices and standards, such as ISA/IEC 62443, which may limit their effectiveness and applicability. Therefore, some organizations may prefer to follow voluntary standards or frameworks, such as ISA/IEC 62443, rather than mandatory regulations, as they may offer more flexibility and adaptability to the specific needs and contexts of each industrial control system. References:

• ISA/IEC 62443 Standards to Secure Your Industrial Control System, page 3
• Using the ISA/IEC 62443 Standard to Secure Your Control System, page 9

Authorization security policy is the primary factor that determines access privileges for user accounts. Authorization security policy is the function of specifying access rights or privileges to resources, which is related to general information security and computer security, and to accesscontrol in particular1. Authorization security policy defines who can access what resources, under what conditions, and for what purposes. Authorization security policy should be aligned with the business objectives and security requirements of the organization, and should be enforced by appropriate mechanisms and controls. Authorization security policy should also be reviewed and updated regularly to reflect changes in the environment, threats, and risks2. Authorization security policy is an essential part of the ISA/IEC 62443 standard, which provides a framework for securing industrial automation and control systems (IACS). The standard defines four security levels (SL) that represent the degree of protection against threats, and specifies the security capabilities that should be implemented for each SL. The standard also provides guidance on how to conduct a security risk assessment, how to define security zones and conduits, and how to apply security policies and procedures to the IACS environment34 . References:https://bing.com/search?q=authorization+security+policy

https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-7.0

 According to the ISA/IEC 62443 Cybersecurity Fundamentals Specialist resources, patches are software updates that fix bugs, vulnerabilities, or improve performance of a system. Patches are classified into three categories based on their urgency and impact: low, medium, and high. Low priority patches are those that have minimal or no impact on the system functionality or security, and can be applied at the next scheduled maintenance. Medium priority patches are those that have moderate impact on the system functionality or security, and should be applied within a reasonable time frame, such as three months. High priority patches are those that have significant or critical impact on the system functionality or security, and should be applied as soon as possible, preferably at the first unscheduled outage. Applying patches in a timely manner is a best practice for maintaining the security and reliability of an industrial automation and control system (IACS). References:

• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 4.3.2, Patch Management
• ISA/IEC 62443-2-1:2009, Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program, Clause 5.3.2.2, Patch management
• ISA/IEC 62443-3-3:2013, Security for industrial automation and control systems - Part 3-3: System security requirements and security levels, Clause 4.3.3.6.2, Patch management

Application whitelisting (AWL) is a technique that allows only authorized applications to run on a system, and blocks any unauthorized or malicious code from executing. AWL is one of the most effective methods for preventing malware infections and reducing the attack surface of a system. AWL can be implemented at different levels, such as the operating system, the network, or the application itself. AWL is especially useful forindustrial automation and control systems (IACS), which often run on legacy or proprietary platforms that are not compatible with traditional antivirus software or other security solutions. AWL can also help protect IACS from zero-day attacks, which exploit unknown vulnerabilities that have not been patched or detected by security vendors. AWL is recommended by the ISA/IEC 62443 standards as a key component of malicious code protection for IACS. According to the standards, AWL should be applied to all IACS components that support it, and should be configured and maintained according to the security policies and procedures of the organization. AWL should also be complemented by other security measures, such as network segmentation, zones and conduits, and patch management, to provide a defense-in-depth approach to IACS security. References:

• ISA/IEC 62443-3-3:2013, System security requirements and security levels, Section 5.2.3.41
• ISA/IEC 62443-2-1:2010, Establishing an industrial automation and control systems security program, Section 4.3.3.6.42
• ISA/IEC 62443-4-2:2019, Technical security requirements for IACS components, Section 4.2.3.43
• ISA/IEC 62443-3-2:2020, Security risk assessment for system design, Section 7.3.3.44
• ISA/IEC 62443-4-1:2018, Product development requirements, Section 5.2.3.45

 IPSec is a commonly used protocol for managing secure data transmission over a VPN. IPSec stands for Internet Protocol Security and it is a set of standards that define how to encrypt and authenticate data packets that travel between two or more devices over an IP network. IPSec can operate in two modes: transport mode and tunnel mode. In transport mode, IPSec only encrypts the payload of the IP packet, leaving the header intact. In tunnel mode, IPSec encrypts the entire IP packet and encapsulates it in a new IP header. Tunnel mode is more secure and more suitable for VPNs, as it can protect the original source and destination addresses of the IP packet from eavesdropping or spoofing. IPSec uses two main protocols to provide security services: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides data integrity and source authentication, but not confidentiality. ESP provides data integrity, source authentication, and confidentiality. IPSec also uses two protocols to establish and manage security associations (SAs), which are the parameters and keys used for encryption and authentication: Internet Key Exchange (IKE) and Internet Security Association and Key Management Protocol (ISAKMP). IKE is a protocol that negotiates and exchanges cryptographic keys between two devices. ISAKMP is a protocol that defines the format and structure of the messages used for key exchange and SA management.

References:

• ISA/IEC 62443-3-3:2018, Section 4.2.3.7.1, VPN1
• ISA/IEC 62443-4-2:2019, Section 4.2.3.7.1, VPN
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 5.3.2, VPN
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Exam Specification, Section 5.3.2, VPN

IT systems and IACS have different security priorities, requirements, and challenges. According to the ISA/IEC 62443 standards, the security priority for IT systems is confidentiality, which means protecting the data from unauthorized access or disclosure. The security priority for IACS is integrity, which means ensuring the accuracy and consistency of the data and the functionality of the system. A loss of integrity in an IACS can have severe consequences, such as physical damage, environmental harm, or human injury. Therefore, IACS cybersecurity must address safety issues, which are not typically considered in IT security. Safety is the ability of the system to prevent or mitigate hazardous events that can cause harm to people, property, or the environment. The ISA/IEC 62443 standards provide guidance and best practices for ensuring the safety and security of IACS, as well as the availability and reliability of the system. Availability is the ability of the system to perform its intended function when required, and reliability is the ability of the system to perform its intended function without failure. These properties are also important for IT systems, but they may have different trade-offs and implications for IACS. For example, an IACS may have stricter performance and availability requirements than an IT system, as a delay or disruption in the IACS operation can affect the industrial process and its outcomes. Additionally, an IACS may have longer equipment lifetimes and less frequent maintenance windows than an IT system, which can make patching and updating more difficult and risky. Furthermore, an IACS may use different technologies and architectures than an IT system, such as legacy devices, proprietary protocols, or specialized hardware. These factors can create compatibility and interoperability issues, as well as increase the attack surface and complexity of the IACS. Therefore, IT security solutions and practices may not be sufficient or suitable for IACS, and they may need to be adapted or supplemented by IACS-specific security measures. The ISA/IEC 62443 standards address these differences and provide a comprehensive framework for securing IACS throughout their lifecycle.

References: 1: Security of Industrial Automation and Control Systems - ISAGCA 2: ISA/IEC 62443 Series of Standards - ISA 3: ISA/IEC 62443 Series of Standards | ISAGCA 4: Securing IACS based on ISA/IEC 62443 – Part 1: The Big Picture

• The key differences between IT (Information Technology) systems and IACS (Industrial Automation and Control Systems) are centered on their primary security objectives and operational requirements:
• Option A: The IACS security priority is integrity. This is crucial because any unauthorized modification of data or commands can lead to severe operational disruptions and safety hazards.
• Option C: IACS cybersecurity must address safety issues. Safety is a primary concern in IACS environments where process disruptions or malfunctions can result in harm to human operators or damage to equipment. The primary security priority in traditional IT systems is often confidentiality, not availability as stated in Option B, and routers are commonly used in IACS networks, contrary to Option D.

The ISASecure Integrated Threat Analysis (ITA) Program is a certification scheme that certifies off-the-shelf automation and control systems to the ISA/IEC 62443 series of standards1. The ITA Program consists of three main components2:

• Software Development Security Assurance (SDSA): This component evaluates the security lifecycle and practices of the product supplier, such as security requirements, design, implementation, verification, and maintenance. The SDSA certification is based on the ISA/IEC 62443-4-1 standard.
• Functional Security Assessment (FSA): This component verifies the security functions and features implemented in the product, such as identification and authentication, access control, encryption, audit logging, and security management. The FSA certification is based on the ISA/IEC 62443-4-2 standard.
• Communications Robustness Testing (CRT): This component tests the resilience of the product against network attacks, such as denial-of-service, fuzzing, spoofing, and replay. The CRT certification is based on the ISA/IEC 62443-4-2 and ISA/IEC 62443-3-3 standards .

References:

• 1: ISASecure - IEC 62443 Conformance Certification - Official Site
• 2: ISASecure - IEC 62443 Conformance Certification - Official Site
• [3]: ISA/IEC 62443-4-1: Secure Product Development Lifecycle Requirements, ISA, 2018.
• [4]: ISA/IEC 62443-4-2: Technical Security Requirements for IACS Components, ISA, 2019.
• [5]: ISA/IEC 62443-4-2: Technical Security Requirements for IACS Components, ISA, 2019.
• [6]: ISA/IEC 62443-3-3: System Security Requirements and Security Levels, ISA, 2013.

According to the ISA/IEC 62443-3-2 standard, a security zone is a grouping of systems and components based on their functional, logical, and physical relationship that share common security requirements. The primary objective of defining a security zone is to apply a consistent level of protection to the assets within the zone, based on their criticality and risk assessment. A security zone may contain assets from different vendors, different levels in the Purdue model, or different physical locations, as long as they have the same security requirements. A security zone may also be subdivided into subzones, if there are different security requirements within the zone. A conduit is a logical or physical grouping of communication channels connecting two or more zones that share common security requirements.

References:

• ISA/IEC 62443-3-2:2020, Security for industrial automation and control systems - Part 3-2: Security risk assessment for system design, Clause 4.3.21
• ISA/IEC 62443-1-1:2009, Security for industrial automation and control systems - Part 1-1: Terminology, concepts and models, Clause 3.2.42

 According to the ISA/IEC 62443-2-4 standard, a training and security awareness program should include all personnel who have access to the industrial automation and control system (IACS) or who are involved in its operation, maintenance, or management. This includes vendors and suppliers, employees, temporary staff, contractors, and visitors. The purpose of the program is to ensure that all personnel are aware of the security risks and policies related to the IACS, and that they have the necessary skills and knowledge to perform their roles in a secure manner. The program should also cover the roles and responsibilities of different personnel, the reportingprocedures for security incidents, and the best practices for security hygiene. References:

• ISA/IEC 62443-2-4:2015 - Security for industrial automation and control systems - Part 2-4: Security program requirements for IACS service providers1
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Training Course2

An asymmetric key is a feature of asymmetric cryptography, also known as public-key cryptography, which is a method of encrypting and decrypting data using two different keys: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret by the owner. The public key and the private key aremathematically related, but it is computationally infeasible to derive one from the other. Asymmetric cryptography can be used for various purposes, such as digital signatures, key exchange, and encryption. For example, if Alice wants to send a message to Bob, she can use Bob’s public key to encrypt the message, and only Bob can decrypt it using his private key. Alternatively, if Bob wants to prove that he is the author of a message, he can use his private key to sign the message, and anyone can verify it using his public key. Asymmetric cryptography has some advantages over symmetric cryptography, which uses the same key for both encryption and decryption. For instance, asymmetric cryptography does not require a secure channel to distribute the keys, and it can provide non-repudiation and authentication. However, asymmetric cryptography also has some drawbacks, such as higher computational complexity, larger key sizes, and higher network overhead.

References:

• ISA/IEC 62443-3-3:2018, Section 4.2.3.6.1, Cryptography1
• ISA/IEC 62443-4-2:2019, Section 4.2.3.6.1, Cryptography
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Study Guide, Section 5.3.1, Cryptography
• ISA/IEC 62443 Cybersecurity Fundamentals Specialist Exam Specification, Section 5.3.1, Cryptography

RS232 is a physical layer standard for serial communication between two or more devices. It defines the electrical characteristics, timing, and pinout of connectors for serial data transmission. RS232 is widely used in industrial communication devices, such as PLCs, measuring instruments, and network servers. RS232 allows only one master and one slave to communicate on each line, and operates in a full duplex mode. RS232 haslower transmission speed, shorter maximum cable length, and larger voltage swing than later standards such as RS422 and RS485123

References: 1: Basics of RS232, RS422, and RS485 Serial Communication 2: RS-232 - Wikipedia 3: RS232 Serial Communication Protocol: Basics, Working & Specifications

The Open Systems Interconnection (OSI) model is a framework that describes the functions of a networking system. The OSI model categorizes the computing functions of the different network components, outlining the rules and requirement needed to support the interoperability of the software and hardware that make up the network1.

The OSI model consists of seven abstraction layers arranged in a top-down order: Physical, Data Link, Network, Transport, Session, Presentation, and Application. The Transport layer is the fourth layer in the OSI model, and it is responsible for ensuring reliable and efficient data transfer between the Network layer and the Session layer2. The Transport layer uses protocols such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) to provide end-to-end communication services, such as error detection and correction, flow control, congestion control, and segmentation2.

The image that you sent shows a 3D representation of the OSI model, with the layers stacked on top of each other. The missing layer is the Transport layer, which isrepresented by a pink box with a white arrow pointing to it. The arrow is labeled “TCP, UDP”.

1: What is the OSI Model? 7 Network Layers Explained | Fortinet 2: What is OSI Model | 7 Layers Explained - GeeksforGeeks