What is the purpose of the ISO/OSI reference model, and how is it used in cyber security architecture?

Question

Accepted Answer

It describes network communication in seven layers so that communication across very different technical systems can be described and developed further; in CSA it is used to classify what a security component does and to describe attacks.

* Name the layer and you know which component can see the traffic, and which attack class it is exposed to. *
The model (Open Systems Interconnection, an ISO standard since 1983) dates from the early days of networking and is still everyday vocabulary. Its seven layers run from the physical layer (cables, hubs) through data link (Ethernet, switches), network (IP, routers), transport (TCP, UDP) up to the application layer.
Two typical uses in CSA:

Classifying security components. Azure Firewall, for example, advertises stateful filtering of layer 3 and layer 4 protocols; a web application firewall works on layer 7. (Microsoft now describes the Standard tier as a layer 3 to layer 7 firewall, because it also filters by domain name and web category.)
Describing attacks. DDoS attacks are commonly grouped by the layer they target: network (3), transport (4), presentation (6) or application (7). Google reported a record layer-7 DDoS in 2022, with the Mēris botnet sending up to 46 million HTTPS requests per second.

Tip: When a product or an attack report names a layer, you immediately know which components can see it and which can stop it.
Watch out: layer tables are not always consistent. A common simplified table lists HTTP, DNS and FTP as layer-5 (session) examples and proxies and gateways at layer 4, with the browser and email client at layer 6. The standard mapping puts these protocols, and application-level gateways, on layer 7. Know both placements.
Go deeper:

OSI model — Wikipedia — each layer's job, the 1983/84 standardisation and the comparison with TCP/IP.
 ITU-T X.200 — OSI basic reference model — the reference model text itself, freely downloadable from the ITU.
 heise — Rekord-DDoS auf Layer 7: Google wehrt ab (2022) — the 46-million-requests-per-second Mēris attack on a Google Cloud customer, described by its layer.
 Microsoft Learn — Azure Firewall features by SKU — a cloud firewall's capabilities stated in layer terms, from stateful 5-tuple rules up to URL filtering.
 AWS — What is a DDoS attack? — DDoS classes by OSI layer: infrastructure attacks on 3 and 4, application attacks on 6 and 7.