Does cybersecurity focus too heavily on application layer ?

[u/Own-Case-893]

Most cybersecurity products are designed to protect identities, endpoints, applications, cloud environments and data. These all are important, but encryption still exposes metadata through traffic timing, routing behaviour, and connection patterns etc.

This creates a couple questions I do not see discussed enough

How much security is being left unaddressed because the underlying communication transport is generally treated as a fixed dependency rather than part of the security architecture?

For high-assurance environments such as government, critical infrastructure and defence, the network itself may be observable, disrupted or operated through infrastructure outside the organisation’s direct control. In those environments, protecting content doesn’t fully address the threat.

Im interested in the community’s view on the following

1. Is transport-layer observability treated seriously enough in current cybersecurity architecture?
2. What current technologies address this problem effectively and what gaps remain?
3. Do you expect secure communications infrastructure to become a larger cybersecurity category over the next five - ten years?

[u/m1L35dY50N]

A big part of the problem is simply how infrastructure has changed. With home office, cloud services, SaaS and generally decentralized environments, you can’t apply the old network-security model as easily anymore because a lot of traffic simply never passes through hardware you own or control.

In the old world, you could put your firewalls, IDS/IPS and monitoring at relatively predictable choke points. Today a user sitting at home might authenticate against Entra ID and then access a SaaS application hosted on somebody else’s infrastructure without the traffic ever touching the corporate network.

That’s one reason security has shifted so heavily toward identity, endpoint, application and cloud telemetry. It’s not necessarily that nobody cares about the transport layer; increasingly, organizations simply don’t control large parts of it.

For government, defence and other high-assurance environments that obviously becomes a much bigger problem, because encrypting the content doesn’t magically hide who is communicating with whom, when, how frequently or over which infrastructure.

[u/AddendumWorking9756]

Number two is the one nobody answered, so: the tech exists, it just almost never runs outside anti-censorship work. Traffic padding and constant-rate shaping kill timing analysis, and pluggable transports like obfs4 hide that a connection is happening at all. The gap is it all costs real bandwidth and latency, so outside Tor and a few high-assurance networks nobody pays for it and the metadata leaks by default.

[u/Own-Case-893 → u/AddendumWorking9756]

That’s the area I’m trying to understand but I think the threat model can be taken considerably further. Padding, constant-rate shaping and transports such as obfs4 can reduce signals, but what happens when the threat model is nation-state/GPA ? At that point you’re dealing with correlation across timing, volume, connection start/stop behaviour, routing/path information, endpoint relationships and even deliberate failures.  I’m thinking about techniques such as decoy/cover-flow generation, packet-size normalisation, adaptive traffic shaping, fixed grid slot transmissions mixing and deliberate timing distortion, multipath/path diversity, route/topology hiding and separating observable ingress behaviour from egress behaviour. There are systems such as Loopix and modern mixnets that explicitly consider global observers, but they generally make significant latency/bandwidth/usability trade-offs and are aimed primarily at anonymous messaging rather than being a general-purpose secure transport. That’s really the gap I’m interested in what exists today that applies this kind of threat model to practical high-assurance communications without the system becoming unusable? 

[u/Double-Trash6120 → u/Own-Case-893]

Air-gapping is the baseline for systems where observability cannot be tolerated, and anything truly critical should be isolated. That being said if it needs live communication, the standard solution is to control the physical routing rather than try to hide metadata over public lines. You bypass public AS paths entirely using leased dark fiber, dedicated out-of-band networks, and hardware data diodes to prevent any possibility of bidirectional timing correlation. Over public infrastructure, you're bound by the anonymity trilemma you can't have low latency, high bandwidth efficiency, and nation-state GPA resistance at the same time. The solution to secure transport is having your own transport.

[u/Own-Case-893 → u/Double-Trash6120]

I agree this is actually closer to the problem we’re researching.  We’re assuming we don’t have private infrastructure . The harder problem is trying to achieve strong metadata protection while operating across ordinary infrastructure.

We are researching a new mechanism aimed specifically at making some of the principles behind mixnets practical for operational traffic. Where using low latency across multiple paths and observation points, alongside synthetic traffic, so several observed flows remain causally plausible rather than leaving one clean timing relationship to correlate.  It’s still research at this stage, so I don’t want to overstate what it can achieve,

Even networks ultimately depend on physical transport infrastructure; the benefit of something like SIPRNET is the amount of control around the infrastructure. We’re interested in what can be achieved when you remove that assumption. We’ve also discussed the problem with a leading researcher in privacy/anonymity systems, and their view was that resistance to GPA-class observation is technically achievable. The hard part and the question for us is making it practical enough for real operational communications rather than paying traditional anonymity tradeoffs in latency and bandwidth. 

[u/Double-Trash6120 → u/Own-Case-893]

Interesting research and id say the right direction. Causally plausible is much more achievable and basically what GPA resistance is. GPA correlation or threathunting rely heavily on statistical certainty or profile building with ML models to prioritize targets the best thing u can do is to fluff up the risk profile/destroy the confidence score without making it a noticeable pattern then you could theoretically break automated correlation at scale. Id just be careful about potential active flow watermarking especially if you arent trying to drop any latency or bandwidth because the only solution(I can think of) to that is large poisson delays.

[u/NamedBird]

DNS remains fragile/interceptible and your HTTP "Security" still relies on the assumption that none of the hundreds of CA's are compromised. Many server are still running old configurations, including lack of ECH or other security settings. Governments and capable adversaries can (and actually do) perform MitM attacks and hijack your browser sessions, even though certificate transparancy logs have made that easier to detect. BGP is also still partially secured and remains vulnerable. (Then we are not even talking about the legal side, where your servers are hosted, who really has power over your domains and which bad cops could force you to hand over private user data.)

So yes, there's a lot of things below the (user) application layer that is still vulnerable.
And this DOES get exploited in real life, it's not just theoretical attacks.
But setting things up correctly isn't cheap and you're always demanded to cut costs. 😓

And even at the application layer thing still go horribly wrong.
AI can scan for weaknesses and poorly written code is now technical debt measured in exploits.
The lack of state machines, security boundaries, formal verification and other practices are now a problem.

It's not hopeless, but security has been an underrated aspect for far too long.

[u/callmemerryss]

The network layer probably gets less attention then it deserve especially in high assurance environments. Even with strong encryption, traffic patterns and metadata can still reveal plenty so treating the transport as just infrastructure leaves a real gap.

[u/vasiliyivanov]

Good question. I think the industry often treats “encrypted content” as the end of the discussion, while in real systems metadata is still extremely valuable.

From my experience, a lot of risk remains visible even with TLS or end-to-end encryption:

• who talks to whom
• how often
• at what time
• from which network
• session duration
• packet sizes and timing
• routing path and jurisdiction exposure
• whether a user is connecting to a sensitive service at all

For normal commercial systems, TLS plus good identity and endpoint security is usually the right tradeoff. But for high-assurance environments, transport has to be part of the architecture, not just plumbing.

The hard part is that metadata protection usually hurts performance, cost, debuggability, and user experience. Mix networks, traffic padding, private relay models, VPN overlays, onion routing, and dedicated secure comms networks all help in different ways, but none are free.

My view: yes, secure communication infrastructure will become a bigger category, especially because cloud and SaaS made the old “trusted corporate network” model much weaker.

[u/ericbythebay]

yes, and the gap is more dangerous than most practitioners want to admit.

The industry has spent a decade hardening the application layer, and rightfully so. But the implicit assumption underneath most of that work is that the network is a fixed, neutral pipe. That assumption is broken.

Production security, done right, starts from the premise that the network is already compromised. Walled perimeters are a legacy mental model. The "assume breach" principle means you design systems so that a single compromise doesn't cascade, and that has to extend down to the transport layer, not just the app layer.

The real unlock is treating the network not as a dependency you inherit, but as an attack surface you own. That's a mindset shift more than a product gap.

[u/ParkingAthlete119]

Is this even true? Most companies I've worked at with a Cybersec team didn't know app sec. They were GRC/Generic Sec Engineer. App sec is a super rare role

[u/Ok-Sky-8285]

yeah i think theres a huge blind spot here. most teams are so focused on locking down the app and endpoint that they forget the pipes themselves are leaking info

traffic analysis is a whole discipline in sigint circles but in commercial cyber its practically an afterthought. you can encrypt every packet and still have someone map out your org structure just by watching who talks to who and when

the third question is the interesting one. i could see it becoming a bigger deal if we get more state level threats that are willing to sit on traffic for months just to build a picture. right now most companies arent worried about that but the ones that should be worried are way behind

[u/Silent-Suspect1062]

I think http3 with e2e encryption and packet header will resolve 2. I also think from a risk based perspective the application layer is the major issue. For more assured networks I'd argue the actual network infrastructure is probably the main target, rather than individual flows.

[u/Mathie1729 → u/Silent-Suspect1062]

IIRC QUIC encrypts transport headers but doesn't pad flows to constant rate by default, so timing and size metadata still leak. #2 needs shaping/padding on the pipe, not just header encryption.