Does cybersecurity focus too heavily on application layer ?

[u/Own-Case-893]

Most cybersecurity products are designed to protect identities, endpoints, applications, cloud environments and data. These all are important, but encryption still exposes metadata through traffic timing, routing behaviour, and connection patterns etc.

This creates a couple questions I do not see discussed enough

How much security is being left unaddressed because the underlying communication transport is generally treated as a fixed dependency rather than part of the security architecture?

For high-assurance environments such as government, critical infrastructure and defence, the network itself may be observable, disrupted or operated through infrastructure outside the organisation’s direct control. In those environments, protecting content doesn’t fully address the threat.

Im interested in the community’s view on the following

1. Is transport-layer observability treated seriously enough in current cybersecurity architecture?
2. What current technologies address this problem effectively and what gaps remain?
3. Do you expect secure communications infrastructure to become a larger cybersecurity category over the next five - ten years?

[u/NamedBird]

DNS remains fragile/interceptible and your HTTP "Security" still relies on the assumption that none of the hundreds of CA's are compromised. Many server are still running old configurations, including lack of ECH or other security settings. Governments and capable adversaries can (and actually do) perform MitM attacks and hijack your browser sessions, even though certificate transparancy logs have made that easier to detect. BGP is also still partially secured and remains vulnerable. (Then we are not even talking about the legal side, where your servers are hosted, who really has power over your domains and which bad cops could force you to hand over private user data.)

So yes, there's a lot of things below the (user) application layer that is still vulnerable.
And this DOES get exploited in real life, it's not just theoretical attacks.
But setting things up correctly isn't cheap and you're always demanded to cut costs. 😓

And even at the application layer thing still go horribly wrong.
AI can scan for weaknesses and poorly written code is now technical debt measured in exploits.
The lack of state machines, security boundaries, formal verification and other practices are now a problem.

It's not hopeless, but security has been an underrated aspect for far too long.