Security Architecture and Engineering · Topic 2 of 8
Security Models
Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning and other CISSP security models, with the rules each enforces and the property it protects.
- 4 min
- Includes a diagram
- Bell-LaPadula: confidentiality; no read up, no write down.
- Biba: integrity; no read down, no write up.
- Clark-Wilson: integrity through well-formed transactions and separation of duties.
What it is
Security models are formal descriptions of how a system enforces a security policy. You will not build them, but the exam expects you to know what each model protects and which rule a scenario follows or breaks.
How it works
Confidentiality and integrity models
| Model | Protects | Key rules |
|---|---|---|
| Bell-LaPadula | Confidentiality | Simple security property: no read up. Star property: no write down. Strong star property: read and write only at the same level |
| Biba | Integrity | Simple integrity axiom: no read down. Star integrity axiom: no write up. Invocation property: a subject cannot invoke a subject of higher integrity |
| Clark-Wilson | Integrity in commercial settings | Users access data only through well-formed transactions (transformation procedures); separation of duties; constrained data items checked by integrity verification procedures |
| Brewer-Nash (Chinese Wall) | Conflicts of interest | Once you access one company's data, you cannot access a competitor's data in the same conflict class |
Bell-LaPadula and Biba are mirror images. Bell-LaPadula: no read up, no write down (keeps secrets in). Biba: no read down, no write up (keeps dirt out).
Other models
| Model | Idea |
|---|---|
| Graham-Denning | Eight protection rules for securely creating and deleting subjects and objects and granting or transferring rights |
| Harrison-Ruzzo-Ullman (HRU) | Extends Graham-Denning; studies whether rights can leak through a sequence of commands |
| Take-Grant | Uses a graph of take, grant, create and remove rights to show how rights can be transferred |
| State machine | The system moves only between secure states |
| Information flow | Controls how information flows between security levels; underlies Bell-LaPadula and Biba |
| Noninterference | Actions at a higher level must not affect what lower levels see, preventing covert inference |
| Lattice-based | Subjects and objects placed on a lattice of levels with upper and lower bounds |
The CISSP outline also names a "Star Model" alongside Biba and Bell-LaPadula; in both of those models the star property is the rule about writing.
Supporting concepts
- Trusted computing base (TCB): all the hardware, firmware and software that enforce security.
- Reference monitor: the abstract concept that mediates every access between subjects and objects. It must be always invoked, tamper-proof and small enough to verify.
- Security kernel: the implementation of the reference monitor within the TCB.
- Security perimeter: the boundary between the TCB and the rest of the system.
Applying models to scenarios
| Scenario | Model and rule |
|---|---|
| A Secret user cannot read a Top Secret file | Bell-LaPadula simple security property |
| A Top Secret user cannot save notes to a Confidential share | Bell-LaPadula star property |
| A trusted process must not read unvetted internet data | Biba simple integrity axiom |
| A consultant on Bank A's account cannot see Bank B's data | Brewer-Nash |
| Clerks change ledger entries only through an approved program | Clark-Wilson |
How the exam asks about this
- "Which model prevents writing secret data to a lower level?" Bell-LaPadula star property.
- "Which model enforces separation of duties through well-formed transactions?" Clark-Wilson.
- "Which property of a reference monitor allows it to be fully tested?" It is small enough to verify.
What to remember for the exam
- Bell-LaPadula: confidentiality; no read up, no write down.
- Biba: integrity; no read down, no write up.
- Clark-Wilson: integrity through well-formed transactions and separation of duties.
- Brewer-Nash: dynamic conflict-of-interest walls.
- Reference monitor: always invoked, tamper-proof, verifiable.
Do not mix up the directions. The star rule is always the write rule; "simple" is always the read rule.
Common mistakes
Swapping Bell-LaPadula and Biba rules.
Thinking Bell-LaPadula protects integrity. It addresses confidentiality only.
Confusing the reference monitor (concept) with the security kernel (implementation).
Check yourself
Which Biba rule prevents a subject from reading lower-integrity data?
The simple integrity axiom (no read down).
Which model addresses conflicts of interest between competing clients?
Brewer-Nash (Chinese Wall).
What three properties must a reference monitor have?
Always invoked, tamper-proof and small enough to be verified.
Topic 2 of 8 in Security Architecture and Engineering
Test yourself on Security Architecture and Engineering
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.