Biba vs Bell-LaPadula vs Clark-Wilson: CISSP Security Models Explained
Security models are pure exam-world - almost nobody references Bell-LaPadula in a normal day of security work, but the CISSP loves them because they are clean rules you either know or you don't. The whole topic collapses into two questions: is this model about confidentiality or integrity, and is this the read rule or the write rule? Get those two straight and the rest is memorization you can lock in an afternoon.
See how security models are actually asked
Take a full-length CISSP practice exam free - security models and all eight domains, with an Explanation and an Exam Tip on every item and a personalized Exam Coach when you finish. Create an account on the next screen and the code auto-applies.
CISSP-EXAM-FULL
Start the free exam
Already have an account? Log in to start
In This Guide
The two questions that unlock every model
Before any rule, anchor on these two facts. They resolve most exam questions on their own:
- Confidentiality or integrity? Bell-LaPadula = confidentiality (keep secrets from leaking). Biba and Clark-Wilson = integrity (keep data correct and untampered).
- Simple = read, Star (*) = write. In both Bell-LaPadula and Biba, the "Simple" property governs reading and the "Star / *" property governs writing. That never changes - only the direction (up/down) flips between the two models.
Bell-LaPadula: confidentiality (no read up, no write down)
Bell-LaPadula (BLP) was built for the military to stop secrets leaking to lower clearances. It is a lattice-based, mandatory access control (MAC) model - subjects and objects carry classification labels (Unclassified, Confidential, Secret, Top Secret) and access is decided by comparing them.
| Property | Rule | Why |
|---|---|---|
| Simple Security (read) | No read up (ss-property) | A Secret user can't read Top Secret - can't see above your clearance |
| Star / * Property (write) | No write down | A Top Secret user can't paste secrets into an Unclassified file - stops leaks downward |
| Strong Star | Read/write at your own level only | Tightest variant - no reaching up or down at all |
Biba: integrity (no read down, no write up)
Biba flips Bell-LaPadula to protect integrity instead of confidentiality. Here the labels are integrity levels (High / Medium / Low integrity), and the goal is to stop trustworthy data from being contaminated by untrustworthy data.
| Property | Rule | Why |
|---|---|---|
| Simple Integrity (read) | No read down | A high-integrity process won't read low-integrity data that could corrupt it - don't drink from a dirty source |
| * Integrity (write) | No write up | A low-integrity subject can't write into high-integrity data - don't let bad input pollute clean records |
The mirror: Bell-LaPadula vs Biba side by side
This single table is the highest-yield thing on the page. Biba is Bell-LaPadula upside down:
| Bell-LaPadula | Biba | |
|---|---|---|
| Protects | Confidentiality | Integrity |
| Simple (read) | No read up | No read down |
| Star * (write) | No write down | No write up |
| Allowed | Read down, write up | Read up, write down |
| One-liner | No read up, no write down | No read down, no write up |
Clark-Wilson: integrity for the real (commercial) world
Bell-LaPadula and Biba are military lattice models. Clark-Wilson is the integrity model built for banks and businesses, and it works completely differently - no up/down rules at all. Its core idea: users should never touch critical data directly. They act only through certified programs, and every action is logged and separated.
The vocabulary the exam expects:
| Term | What it is |
|---|---|
| CDI - Constrained Data Item | The protected data whose integrity matters (e.g., account balances) |
| UDI - Unconstrained Data Item | Unprotected data (e.g., raw user input) that must be validated before it becomes a CDI |
| TP - Transformation Procedure | The certified program - the only thing allowed to change a CDI (a "well-formed transaction") |
| IVP - Integrity Verification Procedure | Checks that CDIs are in a valid, consistent state |
If a question mentions users going through programs to reach data, an access control triple, well-formed transactions, or separation of duties for integrity, it is Clark-Wilson - not Biba.
Brewer-Nash and the other models you might see
Beyond the big three, a handful show up in one-line "which model" questions. You rarely need their internals - just the trigger phrase that identifies each.
| Model | Focus | Recognize it by |
|---|---|---|
| Brewer-Nash (Chinese Wall) | Conflict of interest | Access changes dynamically based on what you've already accessed; consulting/finance COI |
| Graham-Denning | Access rights operations | Rules for securely creating/deleting subjects and objects and granting rights |
| Harrison-Ruzzo-Ullman (HRU) | Access rights over time | Extends Graham-Denning; how rights themselves can change (the safety problem) |
| Lattice-based | General MAC | Upper/lower bounds via labels - the family BLP and Biba belong to |
| Non-interference (Goguen-Meseguer) | Confidentiality | High-level actions must not be observable to low-level users - blocks covert channels |
Mnemonics and the traps that catch people
- Simple = Seeing (read), Star = writing. Rebuild any rule from this.
- Bell-LaPadula = confidentiality. Mnemonic: "BLP: no read up, no write down" - keep secrets from rising to your eyes or leaking down.
- Biba = integrity, and it's the upside-down one. "No read down, no write up" - don't ingest dirty data, don't pollute clean data.
- Clark-Wilson = the triple + separation of duties. Programs, not people, touch the data.
- Trap 1: swapping Simple and Star. If a question says "Simple Security Property," it is a read rule, every time.
- Trap 2: assuming a model covers all of CIA. BLP = confidentiality only; Biba = integrity only; neither does availability.
- Trap 3: confusing Biba with Clark-Wilson. Both target integrity, but Biba uses up/down lattice rules while Clark-Wilson uses transactions, triples, and separation of duties.
Turn "I read it" into "I can answer it"
Recognition beats recall on model questions. Take a free CISSP practice exam and see your concept-level breakdown - including whether security models are actually solid or just feel solid.
CISSP-EXAM-FULL
Start the free exam
Want to drill these to reflex? Free interactive CISSP flashcards →
CISSP Security Models Practice Questions
Five questions in the exam's "which model / which property" style. Read the explanation on each - that is where the reflex gets built.
Ready for More?
Models locked in. Here's what to reinforce next:
Frequently Asked Questions
What is the difference between Bell-LaPadula and Biba?
Bell-LaPadula protects confidentiality with "no read up, no write down." Biba protects integrity with "no read down, no write up." Biba is effectively Bell-LaPadula turned upside down. In both, the "Simple" property is the read rule and the "Star (*)" property is the write rule.
Is Simple Security the read rule or the write rule?
The "Simple" property is always the read rule; the "Star (*)" property is always the write rule. Bell-LaPadula: Simple = no read up, Star = no write down. Biba: Simple Integrity = no read down, Star Integrity = no write up.
What is the Clark-Wilson model in simple terms?
A commercial integrity model where users never edit protected data directly - they go through certified programs (transformation procedures). Every action is an access control triple (subject, program, data item), and it enforces separation of duties and auditing rather than the up/down lattice rules of Bell-LaPadula and Biba.
Which CISSP model addresses conflict of interest?
Brewer-Nash, also called the Chinese Wall model. After a subject accesses one company's data, they are dynamically blocked from a competitor's data in the same conflict-of-interest class. It is the model built for consulting and financial COI scenarios.
Do Bell-LaPadula and Biba cover all of CIA?
No. Bell-LaPadula covers only confidentiality; Biba covers only integrity; neither addresses availability. That gap is a common exam question - real systems combine models (and other controls) to cover all three.