CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 3 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series completes the Domain 3 tour of classic security models, turning to the integrity side of the family and the frameworks that keep bad data from poisoning good data — and it clears up a single word that appears in several unrelated corners of the exam and trips up many candidates.

Frequently Asked Questions

Why does Biba forbid reading down?

The no write up rule feels obvious, since you clearly do not want low-integrity data corrupting a high-integrity object, but the read-down rule needs a moment. Think of integrity levels like the cleanliness of air: you would never pump air from a dusty workshop into a sterile clean room. In the same way, you never let unvalidated, lower-integrity data flow up into a document you trust, because the risk of contamination is simply too high.

What are Biba’s known weaknesses?

Biba addresses only integrity, ignoring confidentiality and availability entirely, and it focuses on external threats while assuming internal threats are handled elsewhere in the code. It does not manage access control, and it offers no way to assign or change the classification of a subject or object. Like several of its peers, it also does nothing to stop covert channels.

How does Clark-Wilson enforce integrity differently?

Instead of a formal state machine, Clark-Wilson protects integrity through the access control triplet of subject, program, and object, where subjects never touch objects directly and must go through a well-formed transaction. Protected data is a constrained data item, unvalidated data is unconstrained, a verification procedure confirms integrity, and only transformation procedures may modify protected data. That constrained interface, plus separation of duties, keeps data trustworthy, which is why the model is popular in commercial applications.

How does the Brewer and Nash model handle conflicts of interest?

The Brewer and Nash model changes a user’s permissions dynamically based on what they have already accessed, and it is designed to prevent conflicts of interest inside a shared dataset. The moment a consultant opens files for one client, the model automatically walls off access to any competing client’s data in the same conflict class, and broad access returns once the task is finished. You may hear this called the ethical wall model.

What does the word star actually mean across security topics?

There is no formal model literally called the star model in security, despite how it sounds. What does exist is the star property, the write rule inside both Bell-LaPadula and Biba. Separately, a well-known cloud alliance runs a program abbreviated STAR that assesses cloud provider security through auditing and transparency, and in business management there is an entirely unrelated organizational design framework that also uses the word star, so let the surrounding words tell you which one is meant.

Reference: This article is based on concepts discussed in CISSP 8.3 - Understand the Fundamental Concepts of Security Models (Part 3 of 3).