ExamworthyExamworthy
Open the appStart free

CISSP - Security Architecture and Engineering - Section 3.2

Understand the fundamental concepts of security models such as Bell-LaPadula, Biba, and Clark-Wilson.

Describe the Bell-LaPadula model for confidentiality, the Biba model for integrity, and the Clark-Wilson model for transaction-based integrity, along with state machine and information flow models. Select the appropriate formal security model for a given system's primary protection objective.

Bell-LaPadulaBibaClark-Wilsonstate machine modelinformation flow model

Practice question for this objective

Free sampleSecurity Architecture and Engineeringhard

During an architecture review, a candidate must distinguish between the state machine model and the information flow model as theoretical foundations for systems such as Bell-LaPadula and Biba. Which statement most accurately captures the relationship between the two?

  • AThe state machine model is concerned only with confidentiality, while the information flow model is concerned only with integrity, which is why Bell-LaPadula uses the former and Biba uses the latter.
  • BThe state machine model is a refinement of the information flow model that adds discrete time steps, so any property provable in one is provable in the other without further analysis.
  • CThe state machine model and the information flow model are different names for the same underlying lattice-based mandatory access control mechanism used in trusted operating systems.
  • DThe state machine model proves that a system is secure if every reachable state is secure, whereas the information flow model proves security by constraining the permitted flows of data between security classes. Correct
Distinguish state machine reasoning, which preserves a secure invariant across transitions, from information flow reasoning, which constrains permitted flows between security classes. A state machine model represents a system as a set of states with transition functions and shows that if the initial state is secure and every transition preserves the security invariant, every reachable state is secure; Bell-LaPadula's basic security theorem is a famous example. An information flow model instead defines a partial order over security classes and proves that no information flows from a higher class to a lower one, often via non-interference. The two formalisms are complementary foundations, not synonyms, and most lattice-based confidentiality and integrity models combine elements of both.

Why A is wrong: Tempting because Bell-LaPadula is a confidentiality model and Biba is an integrity model, but both are state machine models and both can be expressed as information flow models; the property being protected does not select between the two foundations.

Why B is wrong: Refinement reasoning sounds plausible, but state machine and information flow models are distinct formalisms with different proof obligations; the basic security theorem in a state machine model does not automatically imply non-interference in a flow model.

Why C is wrong: Lattice-based MAC is one expression of an information flow model, but state machine and information flow models are not synonyms; conflating them ignores that state machine reasoning is about reachable states and transitions rather than about flows.

Why D is correct: Correct. A state machine model treats the system as a sequence of states and shows that each transition preserves a security invariant, while an information flow model focuses on which flows between security classes are permissible; Bell-LaPadula draws on both, using the basic security theorem and a flow lattice.

See more CISSP practice questions with worked answers.

More in this domain

Back to all Security Architecture and Engineering objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.