QUESTION: 241 Topic: 1, Access Control

What is the name of the first mathematical model of a multi-level security policy used to define the concept of a secure state, the modes of access, and rules for granting access?

Clark and Wilson Model
Harrison-Ruzzo-Ullman Model
Rivest and Shamir Model
Bell-LaPadula Model

Answer(s): D

Reference:

TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.

Reveal Solution Next Question

QUESTION: 242 Topic: 1, Access Control

Which of the following models does NOT include data integrity or conflict of interest?

Biba
Clark-Wilson
Bell-LaPadula
Brewer-Nash

Answer(s): C

Explanation:

Bell LaPadula model (Bell 1975): The granularity of objects and subjects is not predefined, but the model prescribes simple access rights. Based on simple access restrictions the Bell LaPadula model enforces a discretionary access control policy enhanced with mandatory rules. Applications with rigid confidentiality requirements and without strong integrity requirements may properly be modeled.
These simple rights combined with the mandatory rules of the policy considerably restrict the spectrum of applications which can be appropriately modeled.

Reference:

TIPTON, Hal, (ISC)2, Introduction to the CISSP Exam presentation.
Also check:
Proceedings of the IFIP TC11 12th International Conference on Information Security, Samos (Greece), May 1996, On Security Models.

Reveal Solution Next Question