We have learned that the security triad is represented by Confidentiality, Integrity, and Availability (CIA). One might ask, how can we create a system that ensures one or more security functions? The answer would be in using security models. In this task, we will introduce three foundational security models:
- Bell-LaPadula Model
- The Biba Integrity Model
- The Clark-Wilson Model
Bell-LaPadula Model
The Bell-LaPadula Model aims to achieve confidentiality by specifying three rules:
- Simple Security Property : This property is referred to as “no read up”; it states that a subject at a lower security level cannot read an object at a higher security level. This rule prevents access to sensitive information above the authorized level.
- Star Security Property : This property is referred to as “no write down”; it states that a subject at a higher security level cannot write to an object at a lower security level. This rule prevents the disclosure of sensitive information to a subject of lower security level.
- Discretionary-Security Property : This property uses an access matrix to allow read and write operations. An example access matrix is shown in the table below and used in conjunction with the first two properties.
| Subjects | Object A | Object B |
|---|---|---|
| Subject 1 | Write | No access |
| Subject 2 | Read/Write | Read |
The first two properties can be summarized as “write up, read down.” You can share confidential information with people of higher security clearance (write up), and you can receive confidential information from people with lower security clearance (read down).
There are certain limitations to the Bell-LaPadula model. For example, it was not designed to handle file-sharing.
Biba Model
The Biba Model aims to achieve integrity by specifying two main rules:
- Simple Integrity Property : This property is referred to as “no read down”; a higher integrity subject should not read from a lower integrity object.
- Star Integrity Property : This property is referred to as “no write up”; a lower integrity subject should not write to a higher integrity object.
These two properties can be summarized as “read up, write down.” This rule is in contrast with the Bell-LaPadula Model, and this should not be surprising as one is concerned with confidentiality while the other is with integrity.
Biba Model suffers from various limitations. One example is that it does not handle internal threats (insider threat).
Clark-Wilson Model
The Clark-Wilson Model also aims to achieve integrity by using the following concepts:
- Constrained Data Item (CDI) : This refers to the data type whose integrity we want to preserve.
- Unconstrained Data Item (UDI) : This refers to all data types beyond CDI, such as user and system input.
- Transformation Procedures (TPs) : These procedures are programmed operations, such as read and write, and should maintain the integrity of CDIs.
- Integrity Verification Procedures (IVPs) : These procedures check and ensure the validity of CDIs.
We covered only three security models. The reader can explore many additional security models. Examples include:
- Brewer and Nash model
- Goguen-Meseguer model
- Sutherland model
- Graham-Denning model
- Harrison-Ruzzo-Ullman model