Master Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, and Other Security Models

Security models provide the theoretical foundation for designing secure information systems. Rather than relying on individual technologies, these formal models define how subjects (users, processes) interact with objects (files, databases, systems) while preserving confidentiality, integrity, and availability.

For the CISSP exam, understanding what each security model protects, its primary objective, and when it is appropriate is more important than memorizing every rule. Many scenario-based questions test your ability to select the model that best addresses a specific security requirement.

What Is a Security Model?

A security model is a formal framework that defines rules governing how information can be accessed, modified, or shared within a computer system.

Security models help organizations:

• Protect sensitive information

• Enforce access control policies

• Prevent unauthorized disclosure

• Preserve data integrity

• Support regulatory compliance

• Build secure system architectures

Security models form the basis for many operating system security mechanisms, database security controls, and access control implementations.

Why Security Models Matter

Without clearly defined security rules:

• Users may access unauthorized information.

• Sensitive data may be altered.

• Information may leak across security boundaries.

• Systems become inconsistent and difficult to audit.

Security models ensure that security decisions follow predictable, enforceable rules rather than ad hoc implementation choices.

Core Components of a Security Model

Every security model defines relationships between:

Subject

An active entity requesting access.

Examples:

• User

• Application

• Process

• Service

Object

The resource being protected.

Examples:

• File

• Database

• Document

• Network resource

• Memory segment

Access Rights

Actions a subject may perform.

Examples:

• Read

• Write

• Execute

• Delete

• Modify

Major Security Models for the CISSP Exam

Bell-LaPadula Model (Confidentiality)

Primary Goal

Protect confidentiality.

Key Principle

Bell-LaPadula is commonly associated with military and government environments where classified information must remain confidential.

Two Fundamental Rules

Simple Security Rule

No Read Up

A user cannot read information at a higher classification level.

Example:

Secret clearance → cannot read Top Secret document.

Star (*) Property

No Write Down

Users cannot write information to a lower classification level.

Example:

Top Secret analyst cannot save classified information into an Unclassified folder.

This prevents accidental information leakage.

Real-World Example

A defense contractor stores:

• Unclassified

• Confidential

• Secret

• Top Secret

Employees may only access information at or below their clearance level and cannot transfer classified information to lower classifications.

CISSP Exam Tip

Think:

Bell-LaPadula = Confidentiality

Remember:

Biba Model (Integrity)

Primary Goal

Protect data integrity.

Unlike Bell-LaPadula, Biba focuses on preventing unauthorized modification rather than disclosure.

Rules

No Read Down

High-integrity users should not read lower-integrity data.

No Write Up

Lower-integrity users cannot modify higher-integrity information.

Real-World Example

A payroll administrator should not import salary information from an untrusted spreadsheet downloaded from the Internet.

The model prevents low-integrity information from contaminating trusted systems.

CISSP Exam Tip

Think:

Biba = Integrity

Remember:

Clark-Wilson Model (Commercial Integrity)

Primary Goal

Maintain data integrity through controlled business processes.

Instead of security labels, Clark-Wilson focuses on:

• Well-defined transactions

• Separation of duties

• Auditing

• Change control

Key Concepts

• Constrained Data Items (CDIs)

• Transformation Procedures (TPs)

• Integrity Verification Procedures (IVPs)

Users cannot directly modify sensitive information.

They must use approved applications or business processes.

Real-World Example

A bank employee cannot edit an account balance directly inside the database.

Instead, all transactions occur through approved banking software that validates every change and records an audit trail.

CISSP Exam Tip

Clark-Wilson is the primary model for commercial environments.

Think:

• Banking

• Accounting

• Financial systems

• ERP systems

Brewer-Nash (Chinese Wall)

Primary Goal

Prevent conflicts of interest.

Once a user accesses confidential information belonging to one organization, they cannot access competing organizations within the same conflict class.

Real-World Example

A consultant works with:

Company A

After accessing Company A's confidential strategy documents, they cannot access confidential documents belonging to Company B, a direct competitor.

CISSP Exam Tip

Think:

Consulting firms

Law firms

Investment banking

Accounting firms

Graham-Denning Model

Focuses on securely creating and deleting:

• Subjects

• Objects

• Access rights

Used primarily for administrative management of permissions.

Harrison-Ruzzo-Ullman (HRU)

Extends Graham-Denning by formally defining how access rights change over time.

Primarily important from a theoretical perspective.

Take-Grant Model

Describes how permissions can be delegated or transferred between subjects.

Useful for understanding privilege propagation.

Information Flow Model

Focuses on preventing unauthorized information flow between security domains.

Frequently used in multilevel security systems.

Access Matrix Model

Represents permissions as a matrix.

Most access control systems are based on this concept.

Comparing the Major Security Models

Real-World Scenario 1

A military analyst accidentally copies classified information into a public folder.

Which model prevents this?

Answer

Bell-LaPadula

Reason:

No Write Down.

Real-World Scenario 2

A hospital wants to ensure laboratory results cannot be modified outside approved workflows.

Best model?

Answer

Clark-Wilson

Reason:

Controlled transactions preserve integrity.

Real-World Scenario 3

An investment advisor cannot access confidential portfolios belonging to competing clients.

Best model?

Answer

Brewer-Nash

Reason:

Conflict-of-interest protection.

Real-World Scenario 4

An accounting system only allows payroll updates through approved payroll software.

Best model?

Answer

Clark-Wilson

Reason:

Users modify data only through authorized transformation procedures.

Common CISSP Exam Traps

❌ Bell-LaPadula protects integrity.

✔ Bell-LaPadula protects confidentiality.

❌ Biba prevents disclosure.

✔ Biba prevents unauthorized modification.

❌ Clark-Wilson uses security classifications.

✔ Clark-Wilson relies on approved business processes and separation of duties.

❌ Brewer-Nash protects classified government information.

✔ Brewer-Nash prevents conflicts of interest.

Memory Aids

Bell-LaPadula

BLP = Blueprints Locked & Protected

Think:

Government secrecy.

Biba

Biba = Better Integrity Before Anything

Think:

Prevent data corruption.

Clark-Wilson

Think:

Banking transactions.

Brewer-Nash

Think:

Chinese Wall.

No competing clients.

GoCyberNinja Exam Tip

When answering CISSP questions about security models, first identify what the organization is trying to protect:

• Confidentiality? → Bell-LaPadula

• Integrity? → Biba

• Commercial transactions? → Clark-Wilson

• Conflict of interest? → Brewer-Nash

The CISSP exam often presents several technically correct choices. The best answer is the model whose primary objective aligns with the business requirement described in the scenario.

Key Takeaways

• Security models provide formal rules for controlling access to information.

• Bell-LaPadula protects confidentiality through No Read Up and No Write Down.

• Biba preserves integrity using No Read Down and No Write Up.

• Clark-Wilson enforces integrity through approved business transactions, auditing, and separation of duties.

• Brewer-Nash prevents conflicts of interest by restricting access to competing organizations' confidential data.

• Graham-Denning, HRU, Take-Grant, Information Flow, and Access Matrix models support administrative control, permission management, and secure information flow.

• Understanding the primary purpose of each model is more important than memorizing every rule.

• Successful CISSP candidates select the security model that best supports the organization's confidentiality, integrity, or business objectives—not simply the most familiar model.

Continue Your CISSP Journey with GoCyberNinja

Mastering Security Models is essential for CISSP Domain 3: Security Architecture and Engineering. Continue expanding your expertise with GoCyberNinja's realistic practice questions, scenario-based exercises, adaptive learning, AI Security content, detailed explanations, and full-length mock exams designed to prepare you for both the CISSP exam and real-world cybersecurity leadership.

Suggested Related Topics

• CIA Triad

• Security Architecture

• Defense in Depth

• Zero Trust Architecture

• Security Controls

• Least Privilege

• Secure System Design Principles

• Trusted Platform Module (TPM)

• Trusted Computing Base (TCB)

• Reference Monitor

• Cryptography

• Risk-Based Thinking