Last updated:
CISSP decision trap
What is the Bell-LaPadula model, and how is it different from Biba, Clark-Wilson and Brewer-Nash?
Direct answer
The Bell-LaPadula model protects confidentiality with two mandatory rules: a subject may not read data classified above its clearance (no read up) and may not write data down to a lower level (no write down). Biba reverses both rules to protect integrity. Clark-Wilson protects commercial integrity with well-formed transactions and separation of duties, and Brewer-Nash prevents conflicts of interest based on what a user has already accessed.
Which security model fits the scenario
| Model | What it protects, and how | Clues in the scenario |
|---|---|---|
| Bell-LaPadula | Secrecy: no read up, no write down, and need-to-know in an access matrix | Clearances, labels, a secret reaching a lower level |
| Biba | Integrity by level: no read down, no write up, no calling on a higher-integrity subject | Trusted and untrusted data, low-quality input reaching high-integrity data |
| Clark-Wilson | Business data: certified transactions only, each run by assigned users and logged | Financial records, separation of duties, an audit trail |
| Brewer-Nash | Conflicts of interest: reading one company's data closes its competitors' data | Advisers or analysts serving competing clients |
Choosing a model in practice
A consulting firm's analyst has worked on one bank's merger files. A second bank, which competes with the first, now asks the firm for advice, and the analyst is the obvious person to help. The firm wants its systems to stop the analyst opening the second bank's files.
Brewer-Nash fits. The analyst's clearance has not changed; what has changed is what the analyst has already seen. Bell-LaPadula would only ask whether the analyst is cleared for the files, which is not the problem here.
Bell-LaPadula: confidentiality by clearance
Bell-LaPadula keeps classified information from reaching anyone not cleared for it, by controlling the direction information can flow.
David Bell and Leonard LaPadula built the model at MITRE for the US Air Force's Electronic Systems Division. Their March 1976 report, Secure Computer System: Unified Exposition and Multics Interpretation, brings their earlier reports together and applies the model to the Multics operating system. Subjects, such as users and processes, act on objects, such as files, and each has a security level. A subject also has a current level, at or below its clearance, at which it is working.
The report proves that if a system starts in a secure state and every change of state keeps all three properties, every state it reaches is secure. It calls this the basic security theorem. The proof covers the model, not every real system: information can still leak through paths the model does not describe.
- Simple security property (ss-property): a subject can read an object only if the subject's clearance is at or above the object's classification. Study guides shorten it to no read up.
- ★-property (star property): a subject can append to an object only at or above its current level, read and write one only at its current level, and read one only at or below it. So information cannot be copied down to a lower level: no write down. Trusted subjects are exempt.
- Discretionary security property (ds-property): an access must also be allowed in an access matrix, which carries need-to-know.
- Strong ★-property: many CISSP study guides add a rule that a subject that both reads and writes an object must be at the same level as it. It is not one of the properties named in the 1976 report, though the report's ★-property already limits read-write access to the subject's current level. Expect it in questions.
Biba: integrity by integrity level
Biba keeps low-integrity information from corrupting high-integrity information, so its rules point the other way from Bell-LaPadula's.
Kenneth Biba wrote the model at MITRE in a June 1975 report for the Air Force's Electronic Systems Division, Integrity Considerations for Secure Computer Systems (MTR-3153). It gives subjects and objects integrity levels, separate from their security levels, and controls three kinds of access: observing, modifying and invoking.
The report sets out several integrity policies. The one CISSP means by Biba is the strict integrity policy, which Biba describes as the dual of the Bell-LaPadula security policy. The report states its three rules as axioms; study guides give them names.
- Simple integrity property: a subject can observe an object only if the object's integrity level is at or above the subject's. Study guides shorten it to no read down.
- ★-integrity property: a subject can modify an object only if the object's integrity level is at or below the subject's. Study guides shorten it to no write up.
- Invocation property: a subject can invoke, or call on, only subjects at or below its own integrity level.
- The report's other mandatory policies keep the modify and invoke rules but handle reading down differently. Under the low-water-mark policy, observing lower-integrity data lowers the subject's own level instead of being refused, and the ring policy lets a subject observe objects at any level.
Clark-Wilson: well-formed transactions and separation of duties
Clark-Wilson protects business data by letting it change only through approved programs, run by approved people, with every change logged.
David Clark and David Wilson published the model at the 1987 IEEE Symposium on Security and Privacy, in A Comparison of Commercial and Military Computer Security Policies. They built it from commercial practice, where well-formed transactions and separation of duties are the long-standing controls against fraud and error, rather than from military labels and levels. NIST reprinted the paper in Special Publication 500-160 (January 1989), its report of a 1987 workshop on integrity policy.
The model's rules come in two kinds. Certification rules (C1 to C5) are checked by a person, such as the security officer who certifies that a transaction keeps data valid. Enforcement rules (E1 to E4) are carried out by the system, such as authenticating every user who runs a transaction. One certification rule requires every transaction to write to an append-only log.
- Constrained data items (CDIs): the data the model protects, such as account balances.
- Unconstrained data items (UDIs): input from outside, such as a typed entry, which a transaction must check before it can change a CDI.
- Transformation procedures (TPs): the certified programs, or well-formed transactions, that are the only way to change a CDI.
- Integrity verification procedures (IVPs): checks that confirm the CDIs are valid, such as a reconciliation.
- Access triples: the system keeps a list of which user may run which TP on which CDIs, and that list is certified to meet separation of duty.
Brewer-Nash: the Chinese Wall
Brewer-Nash decides access by what a user has already seen, so it can stop one person serving two competing clients.
David Brewer and Michael Nash presented The Chinese Wall Security Policy at the 1989 IEEE Symposium on Security and Privacy, modelled on the walls the financial world uses to keep advisers from serving competing clients. They group each company's data into a company dataset, and put the datasets of competing companies into the same conflict of interest class.
Unlike Bell-LaPadula, Biba's strict integrity policy and Clark-Wilson, nothing is closed in advance. Brewer and Nash call the policy a combination of free choice and mandatory control: each dataset a user chooses closes the competing datasets in that conflict of interest class to them.
- Simple security (access) rule: a user can access an object only if it is in a company dataset they have already accessed, or in a conflict of interest class they have not accessed at all.
- Write rule (★-property): a user can write to an object only if the access rule allows it and they cannot read unsanitized data from any other company's dataset, so information cannot pass between competitors through them.
- Sanitized information, disguised so that it no longer identifies the company, is open to everyone.
What the outline's Star Model means
ISC2 names a Star Model in objective 3.2 but does not define it; the most likely meaning is the ★ (star) rules of Bell-LaPadula and Biba.
The 2024 outline lists the objective's examples as Biba, Star Model, Bell-LaPadula. The outline effective 15 April 2027 shortens them to Biba, Star, Bell-LaPadula. Neither outline explains the term.
We found no formal security model called the Star Model in the four papers this page draws on. Bell and LaPadula's ★-property is their rule against copying information down, Brewer and Nash call their write rule the ★-property by analogy, and study guides call Biba's modify rule the ★-integrity property. ISC2 does not say what it means; we read it as these rules. Learn the star rule of each model: it governs writing.
The mistakes that make a wrong model look right
Most wrong answers reverse a rule's direction or pick a model for the wrong goal.
- Reversing the arrows: Bell-LaPadula is no read up and no write down; Biba is no read down and no write up. Decide first whether the scenario protects secrecy or integrity.
- Reading no write down as cannot write: under Bell-LaPadula a subject can still write at its own level and add to a higher one.
- Choosing Bell-LaPadula for a conflict of interest: when the problem is competing clients rather than clearance, the answer is Brewer-Nash.
- Choosing Biba for business transactions: when the scenario turns on who may run which transaction, separation of duties or an audit trail, the answer is Clark-Wilson.
- Treating a model as a product: these are formal models used to design and evaluate systems, not settings to switch on.
Check the rule on a changed scenario
Change one fact in a scenario and check whether the model should change with it.
- An analyst cleared for secret wants to paste a secret report into an unclassified wiki: Bell-LaPadula's ★-property blocks it, because it writes down.
- A system tool that runs at high integrity must not load its settings from a file any user can edit: Biba's simple integrity property, because that would be reading down.
- A payroll system accepts timesheets only through an approved program, and the clerk who enters them cannot approve them: Clark-Wilson, for its well-formed transactions and separation of duties.
- An auditor at a firm that audits two rival airlines may work on either one, but not both: Brewer-Nash.
Other models you may see
CISSP study guides list a few more formal models; know what each one is for.
- State machine model: a system is secure if it starts in a secure state and every transition keeps it secure. Bell-LaPadula is built this way.
- Information flow model: controls how information moves between levels; Bell-LaPadula and Biba are both examples.
- Noninterference model: actions at a higher level must have no effect that a lower level can observe, which addresses covert channels.
- Graham-Denning, Harrison-Ruzzo-Ullman and Take-Grant: models of how access rights are created, passed on and removed.
Sources and fact check
Source checked: 2026-10-29
- ISC2 CISSP Certification Exam Outline, effective 15 April 2024 (PDF)
- ISC2 CISSP Certification Exam Outline, effective 15 April 2027 (PDF)
- Bell and LaPadula, Secure Computer System: Unified Exposition and Multics Interpretation (MITRE, 1976), NIST archive copy (PDF)
- Biba, Integrity Considerations for Secure Computer Systems (MITRE MTR-3153, 1975), UC Davis Seclab archive copy (PDF)
- Clark and Wilson, A Comparison of Commercial and Military Computer Security Policies (1987), reprinted in NIST SP 500-160 (PDF)
- Brewer and Nash, The Chinese Wall Security Policy (IEEE Symposium on Security and Privacy, 1989), MIT course copy (PDF)
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What is the Bell-LaPadula model?
The Bell-LaPadula model protects confidentiality with two mandatory rules: a subject may not read data classified above its clearance (no read up) and may not write data down to a lower level (no write down). Biba reverses both rules to protect integrity. Clark-Wilson protects commercial integrity with well-formed transactions and separation of duties, and Brewer-Nash prevents conflicts of interest based on what a user has already accessed.
Is Biba the opposite of Bell-LaPadula?
In direction, yes. Biba described his strict integrity policy as the dual of the Bell-LaPadula security policy: Bell-LaPadula stops reading up and writing down to protect secrecy, and Biba stops reading down and writing up to protect integrity. They protect different things, so one system can need both.
Which security model prevents conflicts of interest?
Brewer-Nash, also called the Chinese Wall model. Once a user has read one company's data, the data of competing companies in the same conflict of interest class is closed to them.
What is the difference between Biba and Clark-Wilson?
Both protect integrity. Biba does it with integrity levels and rules about reading and writing between them. Clark-Wilson does it the way businesses do: data changes only through certified transactions, each user runs only the transactions assigned to them, and every transaction is logged.
What does no write down mean?
It is the short form of Bell-LaPadula's ★-property: a subject cannot write to an object below its current level, the level of the data it is working with, so secrets cannot be copied down. It does not stop the subject writing at its own level or adding to a higher one.
