CISSP - Security Architecture and Engineering (13% of the exam) - Section 3.2

Understand the fundamental concepts of security models such as Bell-LaPadula, Biba, and Clark-Wilson.

Describe the Bell-LaPadula model for confidentiality, the Biba model for integrity, and the Clark-Wilson model for transaction-based integrity, along with state machine and information flow models. Select the appropriate formal security model for a given system's primary protection objective.

Bell-LaPadulaBibaClark-Wilsonstate machine modelinformation flow model

Practice question for this objective

Free sampleSecurity Architecture and Engineeringhard

During an architecture review, a candidate must distinguish between the state machine model and the information flow model as theoretical foundations for systems such as Bell-LaPadula and Biba. Which statement most accurately captures the relationship between the two?

AThe state machine model is concerned only with confidentiality, while the information flow model is concerned only with integrity, which is why Bell-LaPadula uses the former and Biba uses the latter.
BThe state machine model is a refinement of the information flow model that adds discrete time steps, so any property provable in one is provable in the other without further analysis.
CThe state machine model and the information flow model are different names for the same underlying lattice-based mandatory access control mechanism used in trusted operating systems.
DThe state machine model proves that a system is secure if every reachable state is secure, whereas the information flow model proves security by constraining the permitted flows of data between security classes. Correct

Distinguish state machine reasoning, which preserves a secure invariant across transitions, from information flow reasoning, which constrains permitted flows between security classes. A state machine model represents a system as a set of states with transition functions and shows that if the initial state is secure and every transition preserves the security invariant, every reachable state is secure; Bell-LaPadula's basic security theorem is a famous example. An information flow model instead defines a partial order over security classes and proves that no information flows from a higher class to a lower one, often via non-interference. The two formalisms are complementary foundations, not synonyms, and most lattice-based confidentiality and integrity models combine elements of both.

Why A is wrong: Tempting because Bell-LaPadula is a confidentiality model and Biba is an integrity model, but both are state machine models and both can be expressed as information flow models; the property being protected does not select between the two foundations.

Why B is wrong: Refinement reasoning sounds plausible, but state machine and information flow models are distinct formalisms with different proof obligations; the basic security theorem in a state machine model does not automatically imply non-interference in a flow model.

Why C is wrong: Lattice-based MAC is one expression of an information flow model, but state machine and information flow models are not synonyms; conflating them ignores that state machine reasoning is about reachable states and transitions rather than about flows.

Why D is correct: Correct. A state machine model treats the system as a sequence of states and shows that each transition preserves a security invariant, while an information flow model focuses on which flows between security classes are permissible; Bell-LaPadula draws on both, using the basic security theorem and a flow lattice.

See more CISSP practice questions, answers explained.

Exam traps in Security Architecture and Engineering

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Bell-LaPadula relies on the simple integrity property and the star integrity property, which would prevent the Secret analyst from contributing to a Top Secret log because writing up could corrupt higher-assurance data.
Why it is wrong: Tempting because the property names sound parallel, but those are Biba integrity properties, not Bell-LaPadula confidentiality properties; Bell-LaPadula is silent on integrity and would not block a write up on integrity grounds.
The reference monitor concept, which mediates every access between a subject and an object and writes the decision to an audit log that cannot be modified by application code.
Why it is wrong: The reference monitor is a general access-mediation concept from the Anderson report; it underpins many models but is not the Clark-Wilson construct that forces changes through audited program logic.
Document the residual risk in the risk register and continue running unpatched, on the basis that no public exploit has been observed against the cluster.
Why it is wrong: Absence of an observed exploit is not the same as absence of exploitability, and the threat model already shows credible cross-tenant inference. Accepting the risk without compensating controls outsources the decision to luck rather than to risk management.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.