Security models: Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash and others

Sub-domain 3.2 asks you to understand the fundamental concepts of security models. A security model is a precise, often mathematical, statement of a security policy: it says which subjects may access which objects, in which ways, and what must always remain true. Models matter because they let designers prove, or at least argue rigorously, that a system enforces its policy. They also give a shared vocabulary. When an exam question says a system must stop secret information leaking down to unclassified users, it is describing Bell-LaPadula; when it says unreliable data must not corrupt trusted data, it is describing Biba. This lesson covers the models the CISSP expects you to recognize and the ideas they share.

Subjects, objects and states

Almost every model uses the same building blocks. A subject is an active entity, usually a user or a process acting for a user. An object is a passive entity that holds information, such as a file, a record or a device. Access modes describe what a subject does to an object: read, write, append, execute, delete. A security label or classification attaches to each subject and object, and a clearance describes the highest level a subject may access. Many models are state machine models: the system is described as a set of states, each defined by the current subjects, objects and access rights, and transitions between states. If the system starts in a secure state and every transition preserves security, the system can never reach an insecure state. This idea of a secure state, kept secure by every allowed transition, underlies Bell-LaPadula and several others.

Lattice-based models arrange security levels in a lattice, a structure in which every pair of labels has a least upper bound and a greatest lower bound. A label might combine a hierarchical level, such as Confidential, Secret or Top Secret, with a set of non-hierarchical categories or compartments, such as a project code. A subject dominates an object if its level is at least as high and its category set includes all the object's categories. Information flow models generalize this by tracking how information may move between levels; the aim is to prevent any flow from a higher or more restricted level to a lower one. Noninterference models go further still, requiring that actions at a high level have no observable effect on what low-level users see, which is how covert channels are addressed in theory.

Bell-LaPadula: confidentiality

The Bell-LaPadula model was developed by David Bell and Leonard LaPadula for the United States Air Force in the early 1970s to formalize military confidentiality policy. It has three main properties. The simple security property says no read up: a subject may not read an object at a higher classification than its clearance. The star property, written *-property, says no write down: a subject may not write to an object at a lower classification, because that could leak information downward, for instance by a Trojan horse copying secrets into an unclassified file. The discretionary security property adds an access matrix, so that even within the allowed levels, specific access must be granted. A strong star property restricts a subject to reading and writing only at its own level.

Bell-LaPadula protects confidentiality only. It says nothing about integrity: a low-level subject may write up into a higher-level object, which could corrupt it. It also has a well-known weakness around the tranquillity principle, which says labels should not change while in use. If labels can change freely, a system can declassify information in ways the model does not control, so real systems add trusted subjects that are allowed to break the rules in controlled ways, such as an officer who formally downgrades a document.

Biba: integrity

The Biba model, published by Kenneth Biba in 1977, is the integrity counterpart of Bell-LaPadula, and its rules are the mirror image. The simple integrity property says no read down: a subject must not read data of lower integrity, because untrusted input could corrupt its decisions. The star integrity property says no write up: a subject must not write to objects of higher integrity, because it could contaminate them. The invocation property says a subject cannot invoke, or request service from, a subject at a higher integrity level. A common way to remember the pair is that Bell-LaPadula is about secrets and Biba is about trust: in Bell-LaPadula you cannot read up or write down, and in Biba you cannot read down or write up.

Clark-Wilson: integrity in business

Biba is elegant but hard to apply to commercial systems, where integrity is less about levels and more about ensuring that only authorized, well-formed transactions change data. The Clark-Wilson model, published by David Clark and David Wilson in 1987, captures this. It divides data into constrained data items, which must be protected, such as account balances, and unconstrained data items, such as raw input. Users never manipulate constrained data directly. Instead they use transformation procedures, programs that move the data from one valid state to another, and integrity verification procedures check that the constrained items are valid. The heart of the model is the access triple: a user may run only certain transformation procedures on certain data items. This enforces well-formed transactions and separation of duties, because no single user is certified to run all the procedures needed for a fraudulent sequence, and all transformations are logged.

Clark-Wilson is why business applications do not let staff edit database tables directly. A bank teller transfers money through an application that checks the balance, records both sides of the transaction and logs who did it; the teller cannot simply type a new balance into the database.

Brewer-Nash and other models

The Brewer-Nash model, also called the Chinese Wall model, was published by David Brewer and Michael Nash in 1989 to prevent conflicts of interest. Objects are grouped into company datasets, and datasets of competing companies form conflict-of-interest classes. A consultant who has accessed data about one bank may not then access data about a competing bank, although they may still access an airline. Access rights change dynamically based on what the subject has already accessed, which makes Brewer-Nash different from the static models above. It is used in consulting, auditing and investment banking.

Several other models appear in the outline or in study materials. The Take-Grant model uses a directed graph to show how rights can be passed between subjects with take, grant, create and remove operations, and helps analyze whether a right could leak to an unauthorized subject. The Graham-Denning model defines eight protection rules for securely creating and deleting subjects and objects and for granting, transferring and deleting rights. The Harrison-Ruzzo-Ullman model extends Graham-Denning and shows that, in general, deciding whether a right can leak in an access matrix system is undecidable, which explains why real systems restrict the operations allowed. The Lipner model combines Bell-LaPadula and Biba to protect both confidentiality and integrity in commercial settings. And the Goguen-Meseguer model is an early noninterference model.

From models to products

Models are rarely implemented exactly as written, but their ideas run through real systems. Mandatory access control in SELinux and other trusted operating systems enforces labels that users cannot override, an idea rooted in Bell-LaPadula. Windows mandatory integrity control assigns integrity levels to processes and objects, so a browser running at low integrity cannot write to most user files, which is a Biba-style no write up. Database applications enforce Clark-Wilson's well-formed transactions through stored procedures and role permissions. And consulting firms configure document management systems with ethical walls that apply Brewer-Nash. When you see these products in a scenario, connect them to the model behind them.

Thinking like a manager

Exam questions on models rarely ask you to do formal proofs. They describe a requirement and ask which model fits, or describe a rule and ask what it protects. Start by asking whether the concern is confidentiality, integrity or conflict of interest. Then remember the direction of the arrows: secrets must not flow down, trusted data must not be contaminated from below. For commercial integrity with transactions and approvals, think Clark-Wilson. And if rights change based on what has already been accessed, think Brewer-Nash.

Choosing a model in practice

Real systems rarely implement a single model in pure form. A defense system may enforce Bell-LaPadula for classified documents while using Biba-style rules to stop low-integrity downloads from altering trusted software, and a bank may apply Clark-Wilson to its ledger and Brewer-Nash to its advisory staff. On the exam, match the model to the stated goal: confidentiality points to Bell-LaPadula, integrity levels to Biba, well-formed transactions and separation of duties to Clark-Wilson, and conflicts of interest to Brewer-Nash.