Lesson Nine

Security Models, Trusted Systems, and Secure Design

SierraTec Secure CISSP Certification Preparation Course

Lesson Overview

Lesson Eight examined the architectural mechanisms used to enforce security, including:

• abstraction;

• data hiding;

• encapsulation;

• isolation;

• security boundaries;

• protection rings;

• memory protection;

• reference monitors;

• security kernels;

• Trusted Computing Bases;

• Trusted Platform Modules;

• secure boot;

• secure defaults;

• defense in depth;

• Zero Trust.

Lesson Nine moves one level deeper.

Before architects select technical controls, they need a way to express what security behavior the system is supposed to enforce.

That is the purpose of a security model.

A security model provides a structured or formal representation of security requirements. Depending on the model, it may specify:

• who may read information;

• who may modify information;

• how information may flow between security levels;

• how integrity should be preserved;

• how conflicts of interest should be prevented;

• which system states are considered secure;

• which transitions may be permitted;

• how subjects interact with objects.

The current CISSP Examination Outline places these concepts primarily in Domain 3, Objective 3.2 — Understand the fundamental concepts of security models, listing Biba, Star Model, and Bell-LaPadula as examples. Domain 3 currently represents 13% of the CISSP examination.

This lesson will also examine widely taught supporting models and concepts that help candidates understand the broader security-model landscape, including:

• state-machine models;

• information-flow models;

• lattice models;

• Clark-Wilson;

• Brewer-Nash;

• noninterference;

• access matrices;

• trusted-system assurance;

• Common Criteria.

The central question for Lesson Nine is:

How can security rules be represented in a model so that system architecture consistently enforces confidentiality, integrity, authorization, and trusted behavior?

CISSP Exam Objective Alignment

The current outline explicitly identifies Biba, Star Model, and Bell-LaPadula as examples under Objective 3.2.

Learning Objectives

After completing this lesson, you should be able to:

1. Define a security model.

2. Explain the relationship among policy, model, architecture, mechanisms, and controls.

3. Explain why security models are useful.

4. Define subject and object.

5. Define security state.

6. Explain state-machine security.

7. Explain information-flow security.

8. Explain lattice-based access decisions.

9. Define dominance between security labels.

10. Explain mandatory access-control concepts at a foundational level.

11. Explain Bell-LaPadula.

12. Apply Bell-LaPadula's Simple Security Property.

13. Apply Bell-LaPadula's Star Property.

14. Explain the Strong Star Property concept.

15. Explain Bell-LaPadula's confidentiality focus.

16. Explain limitations of Bell-LaPadula.

17. Explain Biba.

18. Apply Biba's Simple Integrity Axiom.

19. Apply Biba's Star Integrity Axiom.

20. Explain Biba's Invocation Property.

21. Distinguish Bell-LaPadula from Biba.

22. Explain why their directional rules appear opposite.

23. Explain Clark-Wilson.

24. Define Constrained Data Items.

25. Define Unconstrained Data Items.

26. Define Transformation Procedures.

27. Define Integrity Verification Procedures.

28. Explain well-formed transactions.

29. Explain separation of duties within Clark-Wilson.

30. Explain Brewer-Nash.

31. Explain conflict-of-interest classes.

32. Explain dynamic access decisions.

33. Explain noninterference.

34. Explain an access matrix.

35. Distinguish a security policy from a security model.

36. Explain trusted systems.

37. Explain assurance.

38. Explain Common Criteria terminology at a CISSP level.

39. Define Target of Evaluation.

40. Define Protection Profile.

41. Define Security Target.

42. Explain Evaluation Assurance Levels at a high level.

43. Compare major security models.

44. Select an appropriate model based on a scenario.

45. Recognize common CISSP examination traps involving confidentiality and integrity models.

Part I — From Security Policy to Security Model

1. Security Policy Comes First

An organization may establish a policy such as:

Highly classified information must not be disclosed to users who do not possess the required authorization.

That policy communicates the organizational requirement.

But a computer system needs more precise rules.

For example:

• Which subjects have which clearances?

• Which objects have which classifications?

• Can a Secret user read Top Secret information?

• Can a Top Secret user write information into an Unclassified file?

A security model converts broad requirements into structured rules.

2. Policy → Model → Architecture → Mechanism

ORGANIZATIONAL POLICY

        │

        ▼

SECURITY MODEL

        │

        ▼

SECURITY ARCHITECTURE

        │

        ▼

PROTECTION MECHANISM

        │

        ▼

IMPLEMENTATION

        │

        ▼

ASSURANCE / TESTING

Example:

Policy

Protect classified information against unauthorized disclosure.

Model

Bell-LaPadula.

Architecture

Mandatory access-control system with security labels.

Mechanism

Reference monitor evaluates subject and object classifications.

Implementation

Operating-system access controls enforce decisions.

3. Security Policy Versus Security Model

4. Why Security Models Matter

Without a model, security decisions can become inconsistent.

One application developer may implement one interpretation.

Another developer may implement another.

A model provides:

• consistency;

• structure;

• analyzability;

• repeatability;

• design guidance.

Part II — Subjects and Objects

5. Subject

A subject is an active entity requesting access.

Examples:

• user;

• process;

• application;

• service.

A subject performs actions.

6. Object

An object is a passive resource being accessed.

Examples:

• file;

• database record;

• memory object;

• device;

• document.

7. Subject-Object Model

       SUBJECT

User / Process / Service

          │

          │ Requests

          ▼

   SECURITY MECHANISM

          │

    ┌─────┴─────┐

   ALLOW       DENY

     │

     ▼

    OBJECT

File / Data / Resource

8. Access Operations

A subject may request:

• read;

• write;

• execute;

• delete;

• create;

• modify.

Security models determine whether those operations should be allowed.

Part III — Security States

9. What Is a Security State?

A security state represents the relevant security condition of a system at a particular point in time.

A state might include:

• current permissions;

• subject clearances;

• object classifications;

• active processes;

• security attributes.

10. Secure State

A secure state is one in which the system satisfies the security policy.

An insecure state violates it.

11. State-Machine Concept

A state-machine security model examines whether transitions between states preserve security.

SECURE STATE A

      │

      │ Authorized transition

      ▼

SECURE STATE B

      │

      │ Authorized transition

      ▼

SECURE STATE C

A secure system should not permit:

SECURE STATE

     │

     ▼

INSECURE STATE

through an allowed transition.

12. State Transition Example

Suppose:

• Alice has Secret clearance.

• File X is Secret.

Alice can read File X.

If an administrator attempts to reclassify File X as Top Secret without changing Alice's authorization, the system must reconsider whether Alice's access remains permitted.

The system's security state changed.

13. State-Machine Principle

A secure state-machine model generally requires:

1. an initial secure state;

2. authorized transitions;

3. preservation of security after transitions.

Part IV — Information-Flow Models

14. What Is Information Flow?

Information flow describes how information moves between:

• subjects;

• objects;

• processes;

• security levels.

15. Information-Flow Question

Suppose information moves:

TOP SECRET DATA

       │

       ▼

UNCLASSIFIED FILE

Even if the user performing the action has Top Secret clearance, this could create a confidentiality problem.

Why?

Because users without Top Secret authorization may later access the lower-classified file.

16. Information Flow Versus Access

Access control asks:

May this subject access this object?

Information-flow security additionally asks:

Where could the information go afterward?

17. Flow Model

SOURCE

  │

  ▼

SUBJECT

  │

  ▼

DESTINATION



Question:



Does moving information from

SOURCE → DESTINATION

violate security policy?

Part V — Security Labels

18. Security Levels

A multilevel-security environment may use classifications such as:

TOP SECRET

    ▲

  SECRET

    ▲

CONFIDENTIAL

    ▲

UNCLASSIFIED

Higher levels represent greater confidentiality requirements.

19. Clearance

A clearance is associated with a subject.

Example:

Analyst = Secret clearance.

20. Classification

A classification is associated with an object.

Example:

Intelligence Report = Top Secret.

21. Clearance Versus Classification

Part VI — Categories and Compartments

22. Level Alone May Not Be Enough

Suppose a user has:

Top Secret

clearance.

Does that automatically authorize access to every Top Secret document?

Not necessarily.

Additional categories or compartments may apply.

23. Example

Subject:

Top Secret / Nuclear

Object:

Top Secret / Intelligence

The clearance level is sufficient.

The category may not be.

24. Label Components

Conceptually:

SECURITY LABEL

     │

     ├── CLASSIFICATION LEVEL

     │

     └── CATEGORIES / COMPARTMENTS

Part VII — Lattice-Based Security

25. What Is a Lattice Model?

A lattice model organizes security labels into a partially ordered structure.

Access can be determined by comparing:

• levels;

• categories.

26. Dominance

One label dominates another when it is sufficiently authorized according to the model's rules.

Example:

Subject:

Top Secret {Nuclear, Intelligence}

Object:

Secret {Nuclear}

The subject's label may dominate the object's label because:

• Top Secret is higher than Secret;

• the subject possesses the required Nuclear category.

27. Lattice Example

             TS {A,B}

              /    \

          TS {A}   TS {B}

            │        │

          S {A}    S {B}

             \      /

                S

This is a conceptual visualization rather than one universal classification scheme.

28. Lattice Security Benefit

Lattice-based approaches help support:

• multilevel security;

• compartmented information;

• mandatory security labels.

Part VIII — Bell-LaPadula Model

29. Bell-LaPadula Overview

The Bell-LaPadula model is primarily concerned with:

Confidentiality

It was developed for environments where preventing unauthorized disclosure of classified information is critical.

For CISSP purposes, remember:

Bell-LaPadula protects secrecy.

30. Bell-LaPadula Direction

Bell-LaPadula attempts to prevent information from improperly flowing:

HIGH CLASSIFICATION

       │

       ▼

LOW CLASSIFICATION

because users at the lower level could then gain access to information they should not possess.

31. Simple Security Property

The Simple Security Property is commonly remembered as:

No Read Up

A subject may not read information classified above the subject's authorization level.

32. No Read Up Example

User:

Secret clearance.

File:

Top Secret.

Can the user read the file?

No.

TOP SECRET FILE

      ▲

      │  READ DENIED

      │

SECRET USER

33. Why No Read Up?

Allowing the Secret user to read Top Secret information would violate confidentiality.

34. Star Property

The Bell-LaPadula *-property is commonly remembered as:

No Write Down

A highly cleared subject should not write sensitive information into a lower-classified object.

35. No Write Down Example

User:

Top Secret.

File:

Unclassified.

Can the subject copy Top Secret information into the Unclassified file?

No.

TOP SECRET USER

      │

      │ WRITE

      ▼

UNCLASSIFIED FILE



          DENIED

36. Why No Write Down?

Because users without high-level authorization might later read the lower-classified object.

This would indirectly disclose sensitive information.

37. Bell-LaPadula Memory Rule

Bell-LaPadula = Confidentiality

Remember:

NO READ UP

NO WRITE DOWN

38. Bell-LaPadula Flow

Allowed confidentiality-oriented flow generally trends:

LOW

 │

 ▼

HIGH

rather than:

HIGH

 │

 ▼

LOW

39. Example Matrix

Exam questions normally simplify the model to test:

• no read up;

• no write down.

40. Strong Star Property

A stronger variant may restrict subjects to reading and writing only at the same security level.

Conceptually:

TOP SECRET USER

      │

      ▼

TOP SECRET OBJECT



Same level only

The key exam distinction is that a Strong Star approach is more restrictive than the normal star-property interpretation.

41. Bell-LaPadula and Integrity

Bell-LaPadula does not primarily solve integrity problems.

For example:

A low-integrity user could potentially write information upward under confidentiality rules.

That might preserve secrecy but harm integrity.

This is why different security objectives require different models.

42. Bell-LaPadula Exam Scenario

A Secret-cleared employee attempts to read a Top Secret intelligence report.

Which Bell-LaPadula rule prevents the action?

A. No write down
B. No read up
C. No write up
D. No read down

Correct Answer

B. No read up

43. Bell-LaPadula Scenario 2

A Top Secret analyst attempts to copy classified intelligence into an Unclassified file.

Which principle applies?

Correct Answer

No Write Down

Part IX — Biba Integrity Model

44. Biba Overview

The Biba model focuses primarily on:

Integrity

Rather than preventing sensitive information from leaking downward, Biba attempts to prevent less trustworthy information from improperly contaminating more trustworthy information.

Memory aid:

Bell protects confidentiality. Biba protects integrity.

45. Integrity Levels

Conceptually:

HIGH INTEGRITY

      ▲

MEDIUM INTEGRITY

      ▲

LOW INTEGRITY

Examples might include:

• validated financial database;

• approved business records;

• untrusted user input.

46. Biba's Core Concern

Imagine:

Untrusted Internet Data

being written directly into:

Critical Financial Records.

That could corrupt trusted information.

Biba attempts to control this type of flow.

47. Simple Integrity Axiom

Biba's Simple Integrity Axiom is commonly remembered as:

No Read Down

A high-integrity subject should not read lower-integrity information if doing so could contaminate the subject.

48. No Read Down Example

High-integrity process:

Financial calculation service.

Low-integrity data source:

Unvalidated public input.

The high-integrity process should not blindly consume untrusted lower-integrity input.

HIGH-INTEGRITY PROCESS

        │

        │ READ

        ▼

LOW-INTEGRITY DATA



       DENIED

49. Star Integrity Axiom

Biba's *-integrity axiom is commonly remembered as:

No Write Up

A lower-integrity subject should not modify higher-integrity information.

50. No Write Up Example

Low-integrity user:

Guest account.

High-integrity object:

Financial ledger.

Can the guest modify the ledger?

No.

51. Biba Memory Rule

BIBA = INTEGRITY



NO READ DOWN

NO WRITE UP

52. Bell-LaPadula Versus Biba

The rules appear reversed because the objectives are different.

53. Why Biba Prevents Reading Down

Imagine a trusted decision process reads untrusted data.

The process's results may become contaminated by information that lacks sufficient integrity.

54. Why Biba Prevents Writing Up

A low-integrity subject should not be able to alter a higher-integrity object.

This preserves trustworthiness.

55. Invocation Property

Biba also includes an Invocation Property.

At a simplified CISSP level:

A lower-integrity subject should not invoke or control a higher-integrity subject in a way that compromises integrity.

Memory concept:

No Invoke Up

56. Biba Example

A low-trust application should not be able to command a high-integrity administrative process to perform privileged integrity-sensitive operations without appropriate controls.

57. Biba Exam Scenario

A low-integrity temporary account attempts to modify an authoritative financial database.

Which Biba rule should prevent this?

A. No read up
B. No write down
C. No write up
D. No read down

Correct Answer

C. No write up

Part X — Bell-LaPadula and Biba Side by Side

58. The Mirror Relationship

BELL-LaPADULA

CONFIDENTIALITY



HIGH

 ▲

 │ No Read Up

 │

LOW



HIGH

 │

 │ No Write Down

 ▼

LOW

versus:

BIBA

INTEGRITY



HIGH

 │

 │ No Read Down

 ▼

LOW



LOW

 │

 │ No Write Up

 ▼

HIGH

59. Easy Memory Technique

Bell-LaPadula

Protects secret information from leaking downward.

No Read Up
No Write Down

Biba

Protects trusted information from contamination upward.

No Read Down
No Write Up

60. Exam Trap

Do not memorize only the letters.

First ask:

Is the question about confidentiality or integrity?

Then select the model.

Part XI — Clark-Wilson Integrity Model

61. Why Another Integrity Model?

Biba is conceptually useful but can be restrictive.

Commercial environments often focus on ensuring that important transactions occur through approved procedures.

Example:

A bank does not merely care that only high-integrity users modify account balances.

It cares that:

• transactions follow approved processes;

• users cannot arbitrarily manipulate balances;

• duties are separated;

• integrity can be verified.

This is where Clark-Wilson becomes useful.

62. Clark-Wilson Focus

Clark-Wilson focuses on:

• integrity;

• well-formed transactions;

• separation of duties;

• controlled transformation of data.

63. Commercial Integrity Example

Instead of allowing an employee to directly edit:

Bank Account Balance

the employee performs:

Approved Transfer Transaction

through an authorized application.

The system controls how data changes.

64. Clark-Wilson Structure

USER

  │

  ▼

AUTHORIZED

TRANSFORMATION PROCEDURE

  │

  ▼

CONSTRAINED DATA ITEM

The user should not manipulate protected data arbitrarily.

65. Constrained Data Item — CDI

A Constrained Data Item is data whose integrity is protected by the model.

Examples:

• account balances;

• payroll records;

• approved financial records.

66. Unconstrained Data Item — UDI

An Unconstrained Data Item is information that has not yet been validated into the trusted integrity environment.

Example:

• new user input;

• external transaction request.

67. Transformation Procedure — TP

A Transformation Procedure is an authorized operation that changes a CDI from one valid state to another.

Example:

Approved funds-transfer process.

68. Integrity Verification Procedure — IVP

An Integrity Verification Procedure verifies that protected data remains in a valid integrity state.

Example:

Reconciliation process checking whether account totals remain consistent.

69. Clark-Wilson Diagram

UNCONSTRAINED DATA

      UDI

       │

       ▼

VALIDATION

       │

       ▼

TRANSFORMATION PROCEDURE

       TP

       │

       ▼

CONSTRAINED DATA ITEM

       CDI

       │

       ▼

INTEGRITY VERIFICATION

       IVP

70. Well-Formed Transactions

A well-formed transaction ensures that data changes occur only through approved operations.

Example:

A user should not manually change:

Account balance from $10,000 to $100,000.

Instead, the balance should change through:

• deposits;

• withdrawals;

• approved transfers.

71. Separation of Duties

Clark-Wilson also strongly emphasizes separation of duties.

Example:

EMPLOYEE A

Creates payment

      │

      ▼

EMPLOYEE B

Approves payment

      │

      ▼

SYSTEM

Executes transaction

      │

      ▼

EMPLOYEE C

Reconciles

72. Clark-Wilson Memory Rule

Clark-Wilson = Commercial Integrity

Think:

• well-formed transactions;

• separation of duties;

• controlled transformation.

73. Clark-Wilson Scenario

A financial institution wants to ensure employees cannot directly edit account balances and that all changes occur through approved transaction programs.

Which model BEST matches the requirement?

A. Bell-LaPadula
B. Clark-Wilson
C. Brewer-Nash
D. Simple confidentiality model

Correct Answer

B. Clark-Wilson

Part XII — Biba Versus Clark-Wilson

74. Integrity Comparison

Part XIII — Brewer-Nash Model

75. Brewer-Nash / Chinese Wall

The Brewer-Nash model, often called the Chinese Wall model, addresses:

Conflict of Interest

It is especially relevant when a person may work with competing organizations.

76. Example

A consulting company serves:

• Bank A;

• Bank B.

Bank A and Bank B are competitors.

An analyst who accesses confidential Bank A information should not later access confidential Bank B information if doing so creates a conflict of interest.

77. Dynamic Access

Brewer-Nash is notable because access decisions can change based on:

What the user has already accessed.

78. Brewer-Nash Diagram

START



Analyst

   │

   ├── Bank A

   └── Bank B



Analyst accesses Bank A

         │

         ▼

Bank A information permitted

Bank B competitor information restricted

79. Conflict-of-Interest Class

Organizations can be grouped into conflict-of-interest classes.

Example:

BANKING CONFLICT CLASS

 ├── Bank A

 ├── Bank B

 └── Bank C

Access to one organization's confidential information can affect later access to its competitors.

80. Why It Is Dynamic

Bell-LaPadula often depends on relatively fixed classifications.

Brewer-Nash considers access history.

Therefore, authorization can change over time.

81. Brewer-Nash Memory Rule

Brewer-Nash = Conflict of Interest

Think:

Access one competitor → restricted from another.

82. Scenario

A consulting analyst accesses confidential strategy belonging to Oil Company A.

Later, the analyst requests confidential strategy from competing Oil Company B.

Which model BEST addresses this issue?

Correct Answer

Brewer-Nash

Part XIV — Noninterference Model

83. Noninterference

Noninterference is an information-flow concept intended to ensure that actions at one security level do not improperly influence what can be observed at another level.

84. Concept

Suppose:

HIGH SECURITY PROCESS

         │

         X

         │

LOW SECURITY PROCESS

The low-security process should not be able to infer sensitive high-level information merely by observing changes caused by high-level activity.

85. Example

A low-level user should not be able to determine:

whether a classified operation is occurring

simply by observing subtle system behavior that should not be visible at the lower level.

86. Noninterference Memory Rule

High-level activity should not improperly influence lower-level observations.

Part XV — Access Matrix Model

87. What Is an Access Matrix?

An access matrix represents the permissions that subjects have over objects.

Example:

88. Rows and Columns

Rows typically represent:

Subjects

Columns represent:

Objects

Cells represent:

Rights

89. Access Matrix Implementations

Conceptually, access-matrix ideas may be implemented using:

• Access Control Lists;

• capability-based approaches.

Detailed authorization mechanisms will be covered in Domain 5.

Part XVI — Mandatory and Discretionary Concepts

90. Mandatory Access Control

Mandatory Access Control generally uses centrally enforced security labels and rules.

Users cannot simply change policy because they own a file.

Bell-LaPadula-style environments commonly illustrate mandatory controls.

91. Discretionary Access Control

Discretionary Access Control allows an authorized owner or controller to make certain access decisions.

Detailed MAC and DAC implementation appears later in IAM.

For this lesson, understand:

Formal classification models commonly align with mandatory policy enforcement.

Part XVII — Model Comparison

92. Major Security Models

Part XVIII — Selecting the Right Model

93. Model Selection Questions

Ask:

Is the primary concern classified-information disclosure?

Think:

Bell-LaPadula

Is the primary concern contamination of trusted information?

Think:

Biba

Is the primary concern commercial transaction integrity?

Think:

Clark-Wilson

Is the primary concern conflict of interest?

Think:

Brewer-Nash

94. Quick Decision Diagram

WHAT IS THE PRIMARY OBJECTIVE?

          │

  ┌───────┼────────┬──────────────┐

  ▼       ▼        ▼              ▼

SECRECY INTEGRITY COMMERCIAL   CONFLICT

        FLOW      INTEGRITY    OF INTEREST

  │       │        │              │

  ▼       ▼        ▼              ▼

 BLP     BIBA   CLARK-WILSON  BREWER-NASH

Part XIX — Trusted Systems

95. What Is a Trusted System?

A trusted system is one relied upon to enforce defined security requirements correctly.

The word trusted does not mean:

Perfect.

It means:

The system or component is relied upon for security.

96. Trusted Versus Trustworthy

These concepts should be distinguished.

Trusted

We depend on it.

Trustworthy

We have justified confidence that it will behave correctly.

A component can be highly trusted yet insufficiently trustworthy—which creates significant risk.

97. Trusted-System Foundation

SECURITY POLICY

      │

      ▼

SECURITY MODEL

      │

      ▼

TRUSTED COMPUTING BASE

      │

      ▼

REFERENCE MONITOR

      │

      ▼

SECURITY KERNEL

      │

      ▼

PROTECTION MECHANISMS

98. Review: Trusted Computing Base

The TCB includes components relied upon to enforce the security policy.

Because these components are security critical:

• they should be protected;

• unnecessary complexity should be minimized;

• their behavior should be evaluated.

99. Review: Reference Monitor

The reference monitor concept requires security-sensitive access to be mediated according to policy.

Three classic desirable properties are:

• complete mediation;

• tamper resistance;

• analyzability.

100. Review: Security Kernel

The security kernel is the trusted implementation responsible for core security enforcement.

Part XX — Assurance

101. What Is Assurance?

Assurance is confidence that a system or control:

• has been designed appropriately;

• is implemented correctly;

• operates as intended.

Security functionality asks:

What controls exist?

Assurance asks:

How confident are we that they actually work correctly?

102. Functionality Versus Assurance

103. High Assurance

Higher-assurance environments generally require:

• more rigorous design;

• greater documentation;

• more testing;

• stronger evaluation.

104. Assurance Is Not Absolute Security

A highly evaluated product may still:

• be configured incorrectly;

• be deployed in the wrong environment;

• contain vulnerabilities outside evaluated assumptions.

Assurance must be interpreted in context.

Part XXI — Common Criteria

105. Common Criteria

The Common Criteria for Information Technology Security Evaluation provides an internationally recognized framework for evaluating security properties of IT products and systems.

For CISSP preparation, understand the terminology and purpose rather than attempting to memorize every technical specification.

106. Target of Evaluation — TOE

The Target of Evaluation is the product or system being evaluated.

Examples:

• firewall;

• operating system;

• smart card;

• database-security product.

Memory aid:

TOE = What is being evaluated?

107. Protection Profile — PP

A Protection Profile defines a set of security requirements for a category or type of product.

Conceptually:

What should products of this type provide?

108. Security Target — ST

A Security Target describes the specific security properties and claims for a particular Target of Evaluation.

Conceptually:

What does this specific product claim to provide?

109. Common Criteria Relationship

PROTECTION PROFILE

Generic requirements

        │

        ▼

SECURITY TARGET

Specific product claims

        │

        ▼

TARGET OF EVALUATION

Product being evaluated

        │

        ▼

SECURITY EVALUATION

Part XXII — Evaluation Assurance Levels

110. EAL

Common Criteria historically uses Evaluation Assurance Levels, commonly expressed from:

EAL1 through EAL7

Higher levels represent increasing evaluation rigor.

They should not be interpreted simply as:

EAL7 is automatically the best product for every organization.

111. Conceptual EAL Progression

LOWER EVALUATION RIGOR

         │

        EAL1

         │

        EAL2

         │

        EAL3

         │

        EAL4

         │

        EAL5

         │

        EAL6

         │

        EAL7

         │

HIGHER EVALUATION RIGOR

112. Higher Assurance Has Cost

Higher evaluation rigor usually requires greater:

• documentation;

• testing;

• design evidence;

• evaluation effort.

Therefore, organizations should select assurance appropriate to risk.

Part XXIII — Historical Trusted-System Evaluation

113. TCSEC / Orange Book

Older CISSP materials frequently discuss the U.S. Trusted Computer System Evaluation Criteria, commonly called the Orange Book.

It is historically important for understanding trusted computing and assurance concepts.

Its classification hierarchy included:

• D;

• C;

• B;

• A.

114. Historical Levels

At a very high level:

Modern candidates should understand this primarily as historical trusted-computing context, not assume it represents the current CISSP outline's primary evaluation requirement.

115. CISSP Focus

Prioritize:

• model concepts;

• security objectives;

• trusted-system reasoning;

• assurance principles.

Do not spend disproportionate study time memorizing obsolete certification details at the expense of current objectives.

Part XXIV — Certification and Authorization Concepts

116. Evaluation Versus Authorization

A product can be evaluated.

An organization still must decide whether that product or system is acceptable for its environment.

117. Certification Concept

Historically, certification refers to technical evaluation or assessment of security characteristics.

118. Authorization Concept

Authorization is the management decision to accept responsibility for operating a system under defined conditions and residual risk.

Modern terminology may vary among frameworks.

The CISSP principle is:

Technical assessment informs the business authorization decision.

Part XXV — Formal Model Limitations

119. Models Are Simplifications

A security model focuses on selected properties.

Bell-LaPadula emphasizes confidentiality.

Biba emphasizes integrity.

Neither by itself completely solves:

• availability;

• authentication;

• malware;

• physical security;

• operational resilience.

120. Model ≠ Complete Security Program

SECURITY MODEL

       │

       ▼

Provides rules for

selected security properties



BUT ALSO NEEDED:



Architecture

Identity

Cryptography

Operations

Monitoring

Physical Security

Incident Response

Part XXVI — Bell-LaPadula Detailed Scenarios

121. Scenario 1

Subject:

Confidential clearance

Object:

Secret document

Action:

Read

Result?

Bell-LaPadula

DENY

Because:

No Read Up

122. Scenario 2

Subject:

Top Secret analyst

Object:

Secret document

Action:

Read

Result under basic confidentiality rule?

Generally Allowed

The subject is reading down.

123. Scenario 3

Subject:

Top Secret analyst

Object:

Secret file

Action:

Write Top Secret information

Result?

Denied

No Write Down

Part XXVII — Biba Detailed Scenarios

124. Scenario 1

Subject:

High-integrity accounting process

Object:

Unverified Internet input

Action:

Read

Result under strict Biba?

Denied

No Read Down

125. Scenario 2

Subject:

Low-integrity guest process

Object:

High-integrity financial database

Action:

Write

Result?

Denied

No Write Up

126. Scenario 3

Subject:

High-integrity process

Object:

Lower-integrity log

Action:

Write

Result under the basic Biba integrity direction?

Potentially permitted because writing downward does not contaminate a higher-integrity object.

Part XXVIII — Model Confusion Table

127. Common Directional Errors

Part XXIX — Real-World Interpretation

128. Bell-LaPadula Example

Military intelligence environment:

• users have clearances;

• documents have classifications;

• disclosure prevention is critical.

Bell-LaPadula concepts align naturally.

129. Biba Example

Critical data-processing environment:

• trusted data should not be contaminated by untrusted input;

• authoritative records need integrity protection.

Biba concepts become relevant.

130. Clark-Wilson Example

Banking:

• employees should not directly edit account balances;

• approved transactions change data;

• duties should be separated.

Clark-Wilson fits well.

131. Brewer-Nash Example

Consulting firm:

• analyst serves Client A;

• analyst must not access confidential information belonging to competing Client B.

Brewer-Nash addresses this dynamic conflict.

Part XXX — Secure Design Integration

132. Models Must Become Mechanisms

A security model has value only if architecture implements it.

Example:

BELL-LaPADULA

      │

      ▼

SECURITY LABELS

      │

      ▼

REFERENCE MONITOR

      │

      ▼

MANDATORY ACCESS CONTROL

      │

      ▼

SUBJECT / OBJECT DECISION

133. Integrity Architecture

CLARK-WILSON

      │

      ▼

APPROVED TRANSACTIONS

      │

      ▼

SEPARATION OF DUTIES

      │

      ▼

CONTROLLED APPLICATION LOGIC

      │

      ▼

VALIDATED BUSINESS DATA

134. Security Model and Defense in Depth

Security models do not replace:

• defense in depth;

• least privilege;

• monitoring;

• cryptography.

Instead, they help define the rules those mechanisms should enforce.

Part XXXI — SierraTec Secure MODEL Decision Method

135. MODEL Framework

Use the SierraTec Secure MODEL method when answering security-model questions.

M — Mission Objective

What security objective matters?

• confidentiality?

• integrity?

• conflict prevention?

O — Objects and Subjects

Who is requesting access to what?

D — Direction of Information

Is information flowing:

• up;

• down;

• across?

E — Enforcement Rule

Which model or property applies?

L — Look for the Exam Trap

Is the question mixing confidentiality and integrity?

136. MODEL Diagram

M

MISSION / OBJECTIVE

       │

       ▼

O

OBJECTS & SUBJECTS

       │

       ▼

D

DIRECTION OF FLOW

       │

       ▼

E

ENFORCEMENT RULE

       │

       ▼

L

LOOK FOR TRAPS

Part XXXII — Worked Model Selection Scenarios

137. Scenario — Classified Information

A government system must prevent Secret users from accessing Top Secret data and prevent Top Secret information from being copied into Secret files.

Which model BEST fits?

A. Biba
B. Bell-LaPadula
C. Clark-Wilson
D. Brewer-Nash

Correct Answer

B. Bell-LaPadula

138. Scenario — Trusted Data

A safety system must ensure low-integrity inputs cannot modify high-integrity control data.

Which model BEST fits?

A. Biba
B. Bell-LaPadula
C. Brewer-Nash
D. Availability model

Correct Answer

A. Biba

139. Scenario — Banking

A bank requires all account modifications to occur through approved transaction procedures, with different personnel initiating and approving transfers.

Which model BEST fits?

A. Bell-LaPadula
B. Biba only
C. Clark-Wilson
D. Brewer-Nash

Correct Answer

C. Clark-Wilson

140. Scenario — Consulting Conflict

A consultant who accesses confidential information from one bank must be prevented from accessing information from competing banks.

Which model BEST fits?

Correct Answer

Brewer-Nash

141. Scenario — Secure Transition

A system is designed so every permitted state transition must result in another secure state.

Which model concept is MOST directly represented?

Correct Answer

State-Machine Model

Part XXXIII — Common CISSP Exam Traps

142. Trap — Bell-LaPadula Protects Integrity

No.

Its primary focus is:

Confidentiality

143. Trap — Biba Protects Confidentiality

No.

Its primary focus is:

Integrity

144. Trap — Mixing the Read Rules

Remember:

Bell:

NO READ UP



Biba:

NO READ DOWN

145. Trap — Mixing the Write Rules

Remember:

Bell:

NO WRITE DOWN



Biba:

NO WRITE UP

146. Trap — Clark-Wilson Is Another Confidentiality Model

Clark-Wilson is strongly associated with:

Integrity

especially commercial integrity.

147. Trap — Brewer-Nash Uses Fixed Clearances Only

Brewer-Nash is dynamic.

Access decisions are influenced by previous access and conflict-of-interest relationships.

148. Trap — Model Equals Implementation

A model specifies security behavior.

Architecture and mechanisms implement it.

149. Trap — Trusted Means Secure

Trusted means:

Relied upon.

It does not automatically mean that trust is justified.

150. Trap — Higher EAL Means Best Product

Higher assurance may indicate more rigorous evaluation.

It does not mean the product:

• fits every requirement;

• is configured correctly;

• eliminates all risk.

Part XXXIV — Knowledge Check

151. Knowledge Check

Question 1

What is the primary purpose of a security model?

A. Purchase hardware.
B. Represent security rules and requirements in a structured form.
C. Replace organizational policy.
D. Eliminate all vulnerabilities.

Correct Answer

B

Question 2

Which is an active entity requesting access?

A. Subject
B. Object
C. Classification
D. Asset label

Correct Answer

A

Question 3

Which is generally a passive resource being accessed?

A. Object
B. Subject
C. User
D. Process

Correct Answer

A

Question 4

Which model primarily protects confidentiality?

A. Bell-LaPadula
B. Biba
C. Clark-Wilson
D. Availability model

Correct Answer

A

Question 5

Bell-LaPadula's Simple Security Property is commonly remembered as:

A. No Write Up
B. No Read Up
C. No Read Down
D. No Write Down

Correct Answer

B

Question 6

Bell-LaPadula's Star Property is commonly remembered as:

A. No Write Down
B. No Write Up
C. No Read Down
D. No Read Up

Correct Answer

A

Question 7

Which model primarily protects integrity?

A. Biba
B. Bell-LaPadula
C. Brewer-Nash
D. Confidentiality model

Correct Answer

A

Question 8

Biba's Simple Integrity Axiom is:

A. No Read Down
B. No Read Up
C. No Write Down
D. Read everything

Correct Answer

A

Question 9

Biba's Star Integrity Axiom is:

A. No Write Up
B. No Write Down
C. No Read Up
D. No Read Down

Correct Answer

A

Question 10

Which model emphasizes well-formed transactions?

A. Clark-Wilson
B. Bell-LaPadula
C. Brewer-Nash
D. State machine only

Correct Answer

A

Question 11

Which model strongly emphasizes separation of duties?

A. Clark-Wilson
B. Bell-LaPadula only
C. Noninterference
D. Lattice only

Correct Answer

A

Question 12

What is a CDI?

A. Constrained Data Item
B. Classified Data Interface
C. Controlled Database Index
D. Confidential Data Identity

Correct Answer

A

Question 13

What does a Transformation Procedure do?

A. Performs authorized modifications to protected data
B. Eliminates authentication
C. Replaces encryption
D. Performs risk acceptance

Correct Answer

A

Question 14

Which model addresses conflicts of interest?

A. Brewer-Nash
B. Bell-LaPadula
C. Biba
D. State-machine only

Correct Answer

A

Question 15

Which model's access decisions may change according to previous information access?

A. Brewer-Nash
B. Bell-LaPadula
C. Biba
D. Protection rings

Correct Answer

A

Question 16

Which concept requires permitted transitions to preserve a secure state?

A. State-machine security
B. DRM
C. DLP
D. Risk transfer

Correct Answer

A

Question 17

What does dominance evaluate in a lattice model?

A. Relationships among security labels
B. Network speed
C. Disk capacity
D. Password age

Correct Answer

A

Question 18

What is a Target of Evaluation?

A. Product or system being evaluated
B. Security policy
C. Attack vector
D. Data owner

Correct Answer

A

Question 19

What does assurance provide?

A. Confidence that security mechanisms are designed and operating appropriately
B. Guaranteed absence of vulnerabilities
C. Infinite availability
D. Automatic risk acceptance

Correct Answer

A

Question 20

Which statement is MOST accurate?

A. A trusted component is automatically perfectly secure.

B. Trusted means the system depends on that component for security.

C. Trusted systems require no testing.

D. Trust eliminates risk.

Correct Answer

B

Part XXXV — Original CISSP-Style Practice Questions

152. Practice Question 1

A Secret-cleared analyst attempts to read a Top Secret file.

Which property MOST directly prevents the action?

A. Biba Star Integrity Property
B. Bell-LaPadula Simple Security Property
C. Brewer-Nash rule
D. Clark-Wilson TP

Correct Answer

B

153. Practice Question 2

A Top Secret user attempts to copy classified information into an Unclassified document.

Which Bell-LaPadula rule should prevent this?

A. No Read Up
B. No Write Down
C. No Read Down
D. No Write Up

Correct Answer

B

154. Practice Question 3

A low-trust application attempts to modify a high-integrity financial database.

Which principle should prevent this?

A. Biba — No Write Up
B. Bell-LaPadula — No Write Down
C. Biba — No Read Down
D. Brewer-Nash

Correct Answer

A

155. Practice Question 4

A high-integrity process is prevented from reading unvalidated low-integrity information.

Which rule applies?

A. Biba — No Read Down
B. Bell-LaPadula — No Read Up
C. Clark-Wilson only
D. Brewer-Nash

Correct Answer

A

156. Practice Question 5

A bank allows account balances to change only through approved deposit, withdrawal, and transfer programs.

Which model is MOST appropriate?

A. Clark-Wilson
B. Bell-LaPadula
C. Brewer-Nash
D. Noninterference

Correct Answer

A

157. Practice Question 6

An auditor verifies periodically that financial records remain in a valid state.

Which Clark-Wilson component is MOST closely represented?

A. Integrity Verification Procedure
B. Unconstrained Data Item
C. Bell-LaPadula Star Property
D. Protection Profile

Correct Answer

A

158. Practice Question 7

A consulting company prevents analysts from accessing confidential information belonging to competing clients after the analyst has accessed one client's confidential information.

Which model is being implemented?

A. Brewer-Nash
B. Biba
C. Bell-LaPadula
D. State Machine

Correct Answer

A

159. Practice Question 8

A system begins in a secure state and permits only transitions that result in another secure state.

Which security-model concept is MOST appropriate?

A. State machine
B. Data remanence
C. Risk transfer
D. CASB

Correct Answer

A

160. Practice Question 9

A product has undergone a highly rigorous security evaluation. Management assumes this means the product can be deployed safely in any environment without further risk analysis.

What is the BEST conclusion?

A. Correct, evaluation eliminates deployment risk.

B. Incorrect, assurance does not replace environment-specific risk and configuration analysis.

C. Correct, assurance eliminates configuration risk.

D. Incorrect only because the product needs a trademark.

Correct Answer

B

161. Practice Question 10

A system is relied upon to enforce security policy, but there is little evidence that its security-critical implementation has been thoroughly evaluated.

What is the PRIMARY concern?

A. The system may be trusted without being sufficiently trustworthy.

B. The system has too many users.

C. Confidentiality models are unnecessary.

D. Availability is guaranteed.

Correct Answer

A

Part XXXVI — Key Terms

162. Key Terms

Security Model

Structured or formal representation of security requirements and rules.

Subject

Active entity requesting access.

Object

Passive resource accessed by a subject.

Security State

Condition of system security attributes at a particular time.

State-Machine Model

Model in which permitted state transitions must preserve security.

Information-Flow Model

Model governing how information may move among subjects, objects, or security levels.

Lattice

Partially ordered structure used to represent security-label relationships.

Dominance

Relationship determining whether one security label sufficiently encompasses another.

Bell-LaPadula

Confidentiality model emphasizing No Read Up and No Write Down.

Simple Security Property

Bell-LaPadula property preventing subjects from reading above their authorization.

Star Property

Bell-LaPadula confidentiality property preventing inappropriate downward writes.

Biba

Integrity model emphasizing No Read Down and No Write Up.

Simple Integrity Axiom

Biba rule preventing higher-integrity subjects from reading lower-integrity objects under the strict model.

Star Integrity Axiom

Biba rule preventing lower-integrity subjects from writing to higher-integrity objects.

Invocation Property

Biba property restricting lower-integrity subjects from improperly invoking higher-integrity subjects.

Clark-Wilson

Integrity model emphasizing well-formed transactions and separation of duties.

CDI

Constrained Data Item.

UDI

Unconstrained Data Item.

TP

Transformation Procedure.

IVP

Integrity Verification Procedure.

Brewer-Nash

Dynamic conflict-of-interest security model.

Chinese Wall

Common alternative name for Brewer-Nash.

Noninterference

Information-flow concept preventing high-level activity from improperly influencing lower-level observations.

Access Matrix

Representation of subject permissions over objects.

Trusted System

System relied upon to enforce defined security requirements.

Assurance

Confidence that security mechanisms are designed, implemented, and operating as intended.

Target of Evaluation

Product or system being evaluated under Common Criteria.

Protection Profile

Generic security requirements for a product class.

Security Target

Security claims and requirements for a specific Target of Evaluation.

Evaluation Assurance Level

Level representing evaluation rigor within Common Criteria.

Part XXXVII — CISSP Exam Focus

163. Security Model Mindset

Remember:

SECURITY OBJECTIVE

       │

       ▼

SUBJECT + OBJECT

       │

       ▼

SECURITY LABELS

       │

       ▼

DIRECTION OF ACCESS / FLOW

       │

       ▼

MODEL RULE

       │

       ▼

ALLOW OR DENY

For the examination:

• Bell-LaPadula = confidentiality.

• Bell-LaPadula = No Read Up, No Write Down.

• Biba = integrity.

• Biba = No Read Down, No Write Up.

• Biba also includes an Invocation Property.

• Clark-Wilson = commercial integrity.

• Clark-Wilson emphasizes well-formed transactions and separation of duties.

• CDI = protected data.

• TP = approved transformation.

• IVP = verifies integrity.

• Brewer-Nash = conflict of interest.

• Brewer-Nash decisions can depend on previous access.

• State-machine models focus on secure states and secure transitions.

• Lattice models use security-label relationships and dominance.

• Noninterference focuses on preventing inappropriate information influence across security levels.

• A trusted component is one upon which security depends.

• Trusted does not automatically mean trustworthy.

• Assurance provides confidence but does not guarantee perfect security.

• Security models define rules; architecture and protection mechanisms enforce them.

164. Model Memory Table

165. Lesson Summary

Lesson Nine examined how security requirements can be represented through structured security models.

The current CISSP Examination Outline explicitly expects candidates to understand the fundamental concepts of security models and lists Biba, Star Model, and Bell-LaPadula as examples under Objective 3.2.

You learned the relationship:

SECURITY POLICY

      │

      ▼

SECURITY MODEL

      │

      ▼

SECURITY ARCHITECTURE

      │

      ▼

PROTECTION MECHANISMS

      │

      ▼

SECURITY ENFORCEMENT

You studied the primary confidentiality model:

Bell-LaPadula

with the central rules:

NO READ UP

NO WRITE DOWN

You then studied the integrity-oriented Biba model:

NO READ DOWN

NO WRITE UP

You learned that the apparent reversal occurs because the models protect different security properties.

Bell-LaPadula attempts to prevent sensitive information from leaking to lower classifications.

Biba attempts to prevent high-integrity information from being contaminated by lower-integrity subjects or data.

You studied Clark-Wilson, which protects commercial integrity through:

• Constrained Data Items;

• Unconstrained Data Items;

• Transformation Procedures;

• Integrity Verification Procedures;

• well-formed transactions;

• separation of duties.

You studied Brewer-Nash, which dynamically protects against conflicts of interest based partly on a user's prior access.

You also examined:

• state-machine models;

• information-flow models;

• lattice models;

• dominance;

• noninterference;

• access matrices.

Finally, you connected those models to trusted systems and assurance.

A trusted system must translate:

POLICY

   ↓

MODEL

   ↓

TCB

   ↓

REFERENCE MONITOR

   ↓

SECURITY KERNEL

   ↓

PROTECTION MECHANISMS

into predictable security behavior.

The central Lesson Nine principle is:

Security models provide the rules. Trusted architecture provides the mechanisms. Assurance provides evidence that the mechanisms correctly enforce the rules.

Exam Readiness Check

Before proceeding to Lesson Ten, make sure you can explain without reviewing the lesson:

• What a security model is.

• How security policy differs from a security model.

• What a subject is.

• What an object is.

• What a secure state is.

• What a state-machine model does.

• What an information-flow model does.

• What a lattice model represents.

• What dominance means.

• Why compartments can matter in addition to classification level.

• The primary purpose of Bell-LaPadula.

• Bell-LaPadula's Simple Security Property.

• Bell-LaPadula's Star Property.

• What No Read Up means.

• What No Write Down means.

• Why Bell-LaPadula primarily protects confidentiality.

• The primary purpose of Biba.

• What No Read Down means.

• What No Write Up means.

• What Biba's Invocation Property represents.

• Why Bell-LaPadula and Biba have opposite directional rules.

• What Clark-Wilson protects.

• What a CDI is.

• What a UDI is.

• What a TP is.

• What an IVP is.

• What a well-formed transaction is.

• Why separation of duties matters to Clark-Wilson.

• What Brewer-Nash protects.

• Why Brewer-Nash is dynamic.

• What a conflict-of-interest class is.

• What noninterference means.

• What an access matrix is.

• What trusted system means.

• Why trusted and trustworthy are not the same.

• What assurance means.

• What a Target of Evaluation is.

• What a Protection Profile is.

• What a Security Target is.

• What an Evaluation Assurance Level represents.

• Why higher evaluation rigor does not automatically make a product appropriate for every environment.

• How to select a security model from a CISSP scenario.

Coming Next

Lesson Ten: Cryptography and Cryptographic Solutions

Lesson Ten will move from security models into one of the most important technical foundations of Domain 3:

Cryptography

The lesson will cover:

• purpose of cryptography;

• plaintext;

• ciphertext;

• encryption;

• decryption;

• cryptographic algorithms;

• cryptographic keys;

• Kerckhoffs's principle;

• symmetric cryptography;

• asymmetric cryptography;

• hybrid cryptography;

• stream ciphers;

• block ciphers;

• block-cipher modes;

• AES;

• DES and 3DES historical context;

• RSA;

• Diffie-Hellman;

• elliptic-curve cryptography;

• hashing;

• SHA families;

• message authentication codes;

• HMAC;

• digital signatures;

• confidentiality;

• integrity;

• authentication;

• nonrepudiation;

• key generation;

• key distribution;

• key storage;

• key rotation;

• key revocation;

• key destruction;

• cryptoperiods;

• key escrow;

• cryptographic lifecycle;

• Public Key Infrastructure introduction;

• certificates;

• certificate authorities;

• quantum-computing implications;

• post-quantum considerations;

• cryptographic solution selection;

• comparison diagrams;

• original CISSP-style scenarios and calculations.

This follows directly from current CISSP Objective 3.6, which covers cryptographic lifecycle and algorithm selection; symmetric, asymmetric, elliptic-curve, and quantum-related methods; and Public Key Infrastructure.

The central Lesson Ten question will be:

Which cryptographic mechanism should be selected to achieve the required confidentiality, integrity, authenticity, or nonrepudiation objective—and how should its keys be managed throughout the cryptographic lifecycle?

Publication and Independence Notice

This lesson is independently developed educational material for the SierraTec Secure CISSP Certification Preparation Course.

CISSP is administered by ISC2. SierraTec Secure's course is independent certification-preparation material and should not be represented as official ISC2 training unless separately authorized.

The current objective alignment was checked against the ISC2 CISSP Certification Exam Outline effective April 15, 2024. Domain 3 currently represents 13% of the examination, and Objective 3.2 identifies fundamental security models including Biba, Star Model, and Bell-LaPadula.

Clark-Wilson, Brewer-Nash, state-machine, lattice, noninterference, Common Criteria, and related trusted-system concepts are included as supporting instructional material to provide the broader architecture and assurance context candidates traditionally need to reason effectively about security models. They should not be interpreted as separate current objective bullets unless specifically identified in the official examination outline.

The SierraTec Secure MODEL framework, diagrams, comparison tables, scenarios, knowledge checks, and practice questions are original educational content. They are not actual, recalled, leaked, or official CISSP examination questions.