I think we can also say that SSL is "application level". I mean, the network isn't secure, so the application (ie. a web browser) must do something to encrypt data in transit.