Domain 3 Β· Lesson 2 of 6

Security Models: BLP, Biba & Clark-Wilson

Mô hình Bảo mật: Bell-LaPadula, Biba & Clark-Wilson

Key Terms

Bell-LaPadula Biba Clark-Wilson No Read Up No Write Down No Read Down No Write Up CDI UDI Well-Formed Transaction Brewer-Nash Chinese Wall

Memory Aid β€” Learn This First

BLP = Confidentiality β€” info flows UP (can't read above, can't write below)
Biba = Integrity β€” trust flows DOWN (can't read below, can't write above)
Clark-Wilson = Commercial integrity (well-formed transactions + SoD)
Brewer-Nash = Conflict of interest (dynamic β€” access history determines future access)

Bell-LaPadula (BLP) β€” Confidentiality Model

CONFIDENTIALITY Prevents unauthorized disclosure

BLP was designed for military/government classification systems. Its core goal: prevent information from flowing to a subject with insufficient clearance.

RuleNameMeaningExample
No Read Up Simple Security Rule A subject CANNOT read an object at a HIGHER classification than their clearance A Secret-cleared analyst cannot read Top Secret documents
No Write Down Star Property (β˜…) A subject CANNOT write data to an object at a LOWER classification (prevents leaking classified data down) A Top Secret user cannot email classified info to a Secret-level mailbox
Strong Star Strong Star Property Can only read AND write at own classification level (most restrictive form) Top Secret user can only access Top Secret β€” not Secret or Confidential
Use case: Military/government classification (Top Secret / Secret / Confidential / Unclassified). Information only flows UP to higher-clearance subjects β€” never downward to lower clearance.

Biba β€” Integrity Model

INTEGRITY Prevents unauthorized modification

Biba is the OPPOSITE of BLP β€” it protects data integrity rather than confidentiality. High-integrity processes must not be contaminated by low-integrity data.

RuleNameMeaningExample
No Read Down Simple Integrity Rule A subject CANNOT read data from a LOWER-integrity object (low-integrity input could corrupt high-integrity decisions) Credit scoring model cannot read raw customer-submitted text directly
No Write Up Integrity Star Property A subject CANNOT write to a HIGHER-integrity object (low-integrity actor cannot modify high-integrity data) A customer-facing service cannot write directly to the credit decision database
Platform C application: Credit scoring decisions (high integrity) must not be contaminated by unvalidated customer input (low integrity). Customer input must be validated and transformed by an authorized service (Transformation Procedure) before it can influence the credit model. This is exactly Biba's No Read Down rule in practice.

Clark-Wilson β€” Commercial Integrity Model

COMMERCIAL INTEGRITY Enforces well-formed transactions + separation of duties

Clark-Wilson is designed for commercial environments (banking, accounting). It ensures data can only be modified in controlled ways, through authorized procedures, by authorized users.

Key Components

ComponentAcronymDefinitionPlatform C Example
Constrained Data Items CDI Sensitive data that must be protected and can only be modified via TPs Loan application state, credit decision records, disbursement amounts
Unconstrained Data Items UDI Input data not yet validated β€” untrustworthy until processed by an IVP Raw customer-submitted loan application form data
Transformation Procedures TP The ONLY authorized operations that can modify CDIs β€” well-defined, audited transactions Temporal workflow activities: applyForLoan(), approveLoan(), disburseFunds()
Integrity Verification Procedures IVP Procedures that confirm CDIs are valid and consistent Post-disbursement reconciliation: verify disbursed amount matches approved amount
Platform C / Clark-Wilson: All Partner A loan application state transitions must occur only through Temporal workflow activities (Transformation Procedures). No service is allowed to write directly to the loan database outside the workflow β€” this enforces both Clark-Wilson integrity and separation of duties.

Brewer-Nash (Chinese Wall) β€” Conflict of Interest

CONFLICT OF INTEREST Dynamic β€” access history determines future access

Brewer-Nash prevents conflicts of interest by dynamically restricting access based on what you have ALREADY accessed. Once you access one client's data, you cannot access a competitor's data β€” the "wall" is erected after first access.

ConceptExplanation
Conflict of Interest ClassA group of competing organizations (e.g., Bank A and Bank B)
Dynamic SeparationAccess restrictions change based on access history β€” not pre-defined roles
Use CasesInvestment banks, consulting firms, law firms β€” professionals who serve competing clients
Key Difference from SoDBrewer-Nash is dynamic (history-based); SoD is static (role-based)

Model Comparison Table

ModelProperty ProtectedKey RulesSectorPlatform C Relevance
Bell-LaPadula Confidentiality No Read Up, No Write Down Military / Government Low β€” TS data is commercial, not classified
Biba Integrity No Read Down, No Write Up Financial, critical systems High β€” credit scoring integrity, input validation
Clark-Wilson Integrity (commercial) Well-formed transactions, SoD, CDI/TP Banking, accounting High β€” loan workflow activities = Transformation Procedures
Brewer-Nash Conflict of interest Dynamic access based on history Consulting, investment banking Medium β€” multi-lender platform isolation (Partner A β‰  Partner D)
Exam Tips β€” Security Models
  1. BLP = Confidentiality (No Read UP, No Write DOWN) β€” information flows upward to higher classification only
  2. Biba = Integrity (No Read DOWN, No Write UP) β€” trust flows downward to lower integrity only
  3. TRICK: BLP's "No Read Up" means a Secret-cleared person CANNOT read Top Secret documents β€” even though they have a clearance, it's not high enough
  4. Clark-Wilson = Commercial integrity (well-formed transactions + SoD). NOT for government β€” that's BLP
  5. Brewer-Nash = conflict of interest. It is DYNAMIC β€” the wall is erected AFTER you access one client's data, not before
  6. BLP allows Low to read Low and High to read Low (no restriction reading same or lower level) β€” only reading UP is blocked
FinTech Company X Work Application β€” Platform C Through Security Model Lens

Biba in Platform C credit scoring: The credit scoring service (high integrity) must only accept validated inputs (Transformation Procedures in Clark-Wilson terms) from authorized services, never raw customer input directly. Customer data (UDI) must be validated by the application service (IVP) before it becomes a CDI that can influence the credit decision.

Clark-Wilson in Platform C loan workflows: All Partner A loan application state transitions must occur only through Temporal workflow activities (WFTs β€” Well-Formed Transactions). No direct database writes are allowed outside the workflow. The Temporal server enforces that state transitions follow the defined sequence: Apply β†’ Verify β†’ Approve β†’ Disburse. Any attempt to skip steps or write directly to the database is rejected β€” this is Clark-Wilson's TP enforcement in action.

Practice Questions

Q1. A Secret-cleared government analyst attempts to read a Top Secret document. According to Bell-LaPadula, which rule prevents this access?

A. Simple Security Rule (No Read Up) β€” BLP prevents reading objects at a classification above the subject's clearance level
BLP's Simple Security Rule states that a subject may not read an object at a higher classification than their clearance. Secret cannot read Top Secret. Information flows UP in BLP β€” from lower to higher classification β€” so reading up is the prohibited direction.

Q2. A low-integrity external data feed attempts to update a high-integrity credit decision record directly. Which Biba rule is violated?

A. Integrity Star Property (No Write Up) β€” low-integrity subjects cannot write to high-integrity objects
Biba's Integrity Star Property prevents low-integrity subjects from writing to higher-integrity objects. Allowing an unvalidated external feed to directly update credit decisions would contaminate the integrity of those decisions. The fix is an IVP (validation procedure) that converts the UDI to a trusted CDI before it influences high-integrity data.

Q3. A bank wants to ensure that all financial transactions follow defined procedures, cannot be modified arbitrarily, and require multiple roles to approve. Which security model BEST fits these requirements?

A. Clark-Wilson β€” designed for commercial integrity with well-formed transactions, CDI protection, and separation of duties
Clark-Wilson is explicitly designed for commercial (banking, accounting) environments. It enforces that sensitive data (CDIs) can only be modified through defined Transformation Procedures (TPs) by authorized subjects, with separation of duties across roles. BLP and Biba are better suited for classified or integrity-level-based access control, not commercial workflow enforcement.

Q4. In Clark-Wilson, a customer fills out a loan application form and submits it. At this point, the submitted form data is best described as which type of data item?

A. UDI (Unconstrained Data Item) β€” raw, unvalidated input that has not yet been processed by an IVP
UDIs are unconstrained data items β€” inputs from external sources that have not been validated. They are untrusted until processed by an Integrity Verification Procedure (IVP) that confirms validity and converts them to CDIs. Customer-submitted form data is always a UDI until the system validates and accepts it into the controlled workflow.

Q5. A consultant at a financial advisory firm accesses data for Client A (a bank). Later, a colleague asks the consultant to review a document for Client B (a competitor bank). The system denies access. Which model is enforcing this?

A. Brewer-Nash (Chinese Wall) β€” once Client A data is accessed, access to competing Client B data is dynamically blocked
Brewer-Nash is unique because access control is dynamic β€” it changes based on the subject's access history. After the consultant accessed Client A data, a "wall" was erected preventing access to competitors in Client A's conflict-of-interest class. This is not a pre-configured role restriction (that would be SoD) β€” it is a dynamic restriction triggered by actual access history.