- [Narrator] Security models provide
a theoretical way of describing
the security controls implemented within a system.
We'll take a look at three core topics in this area:
the Bell-LaPadula security model, the Biba integrity model,
and the concept of multilevel security.
Both the Bell-LaPadula and Biba models
are designed to provide security
within the context of multilevel systems.
Multilevel security simply means
that a single computing system
might be used to store, process, and transmit information
of different classification levels
and the users of the system might have
different security clearances.
For example, a system might handle
confidential, secret, and top secret information
even though some users of the system
don't have a top secret security clearance.
The Bell-LaPadula Model is designed
to insure that users of multilevel systems
don't get access to information higher
than their security clearance level.
It enforces confidentiality.
And it has two rules.
First, the simple security rule
is the basic principle of confidentiality.
It says that no subject should be able
to read an object at a level higher
than the subject's security clearance.
For example, a user with a secret clearance
should not be able to read a top secret file.
That's pretty straight forward.
And this rule can be summarized as no read up.
The second rule, the star property,
isn't as intuitive at first glance.
It says that a subject at one security level
should not be able to write information
to an object with a lower security level.
As an example, our user with a secret clearance
would not be able to write a file
at a confidential level.
The reason for this is to prevent security leaks,
insuring that the user with access
to secret information can't write
that information into a file accessible
by users who do not have a secret clearance.
This rule can be summarized as no write down.
That probably sounds pretty difficult
to implement in the real world, and it is.
There are very few places outside
of the most sensitive military applications
where security engineers attempt
to fully implement the Bell-LaPadula model.
The Biba integrity model is similar
to the Bell-LaPadula model but covers integrity
instead of confidentiality.
It also has two rules.
The simple integrity property
says that a subject should not be able
to read an object at a security level
lower than the subject's security clearance.
The purpose of this rule is to prevent corrupting
the integrity of the information accessed
by a subject with a higher clearance level.
For example, if a secret product launch
is planned for tomorrow afternoon,
individuals not cleared for information
about that product launch might have access
to a decoy file that says there is
an office picnic planned for that afternoon.
The Biba model would not want the person cleared
for the product launch to accidentally read
about the fake picnic and get misinformation.
This rule can be summarized as no read down.
And finally, the star integrity property
says that a subject should not be able
to write information to an object
at a higher security level than his or her clearance.
For example, a user with a secret clearance
should not be able to write information
to a top secret file.
This is to prevent the same type
of information corruption as the simple integrity property.
And this rule can be summarized as no write up.
One more quick exam tip for you.
The Bell-LaPadula and Biba models
are often topics discussed on the CISSP exam.
That said, these models fall into the category
of information that you'll need to know
for the exam, but will rarely encounter
in the real world of cyber security.
I've been an information security professional
for 20 years and I've never actually
used these models in real life.