CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 2 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series moves from the Domain 3 foundations into the named security models the exam loves to test — the classic frameworks behind the file permissions, group inheritance, and document classifications you configure every week, and the read-up and write-down rules that trip up so many candidates.

Frequently Asked Questions

How does the take-grant model pass rights around?

The take-grant model uses a directed graph to describe how permissions travel between subjects and objects, governed by four rules. The take rule lets a subject take rights from another entity, the grant rule lets a subject hand its rights to another, the create rule lets it generate brand-new rights, and the remove rule lets it delete rights it holds. Together these let you trace exactly when rights can change and where leakage might occur.

What is an access control matrix?

An access control matrix is a grid mapping subjects against objects, laying out precisely which operations each subject is permitted on each object. Think of a spreadsheet of who can enter which rooms: columns describe each room’s allowed people, and rows describe each person’s allowed rooms.

How do ACLs and capability lists differ?

Reading down a column of the access control matrix gives you an access control list, which is tied to an object and names every subject’s allowed actions on it. Reading across a row gives you a capability list, which is tied to a subject and names every object it can touch. Managing by object through ACLs is far easier, because revoking access to one resource through capability lists means editing every single user who had it.

How does Bell-LaPadula protect confidentiality?

Bell-LaPadula was built for military-style multilevel security with one job: keeping secrets from leaking downward. It rests on a state machine, uses mandatory access controls, and arranges classifications in a lattice. The simple security property says no read up, the star property says no write down, and a third property uses an access matrix to enforce need-to-know, with one exception that a trusted subject may violate no write down to legitimately declassify information.

How does Biba flip that same idea to protect integrity?

Biba is essentially the mirror image of Bell-LaPadula, swapping confidentiality for integrity while still resting on a state machine, information flow, and multiple levels. The simple integrity property says no read down, so you do not pull in data of lower integrity, and the star integrity property says no write up, so you cannot corrupt data held at a higher integrity level. An invocation property also blocks a lower process from requesting higher access.

Reference: This article is based on concepts discussed in CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 2 of 3).