Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).

I'm studying for the CISSP exam and I'm getting confused on the differences between access control methods, security models, and security policies.

When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula. After reviewing though, here's my new understanding:

A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines. As an example, think of it like an architectural plans for a building -- the structure is there but details are not.

A Security Model is more specific and addresses how to incorporate those guidelines. As an example, think of it like construction plans with details of electrical, plumbing, etc.

An Access Control Method is a standard that the Security Model aligns with.

Am I way off here?


share|improve this question

2 Answers 2

You are pretty much on the money with your understanding, Mikey. My only thought is that I wouldn't necessarily class an access method as a standard, more a model which, if adhered to, gives you some rules you can implement around access.

One thing to be aware of is that although control is usually based around confidentiality, as in Bell-Lapadula, the access model may be based around integrity. I would advise a good read of the Orange Book, or for a summary, see the Biba model wikipedia entry - in this model, the key is around levels of integrity, so you prevent data being written from a lower integrity area to a higher integrity area, as that could impact the integrity in the higher area.

share|improve this answer
+1, though AC can also be used to control availability (to some extent). Also, "Security Policy" tends to be overridden in several completely disparate contexts: e.g. your firewall has a "security policy", your OS and domain have "security policies", heck Sharepoint might have a "security policy". Some of these are broad outlines, some of these are very technical and are really "security models", and some are the actual implementation of that policy. –  AviD May 12 '11 at 21:11
Thanks Rory (and AviD). As a follow-up question... what should I call models that are referenced by other official models? For example, Bell LaPadula falls under the "Information Flow" model right? Are Bell Lapadula and "information flow" both considered security models? –  Mike B May 12 '11 at 23:53
@AviD: check my answer to your comment\ –  Phoenician-Eagle May 13 '11 at 6:34

Access control methods address mainly the confidentiality requirement (which does not mean that confidentiality can only be provided via access control).

A security policy defines the security requirements for the resource you are trying to protect. This means it includes confidentiality, integrity and others. Mainly it is used as a "contract" when receiving a request. It can be written using a (standard) language that allows automated verification, e.g. WS-Policy.

Security Model defines the way your security solutions are designed, so you have as well the solution in the description. Typically you start having descriptions for sandboxing models, encryption capabilities, etc...

share|improve this answer
This is wrong, Access control is very specifically not just about confidentiality. Access control can also protect integrity, and even availability in some situations. Even in the class AC models, you have Biba... –  AviD May 12 '11 at 21:07
This is definitely not wrong, first I have clearly mentioned "Access control methods address mainly the confidentiality requirement" second, kindly check this BIBA model is an Integrity preserving model that uses ACCESS CONTROL RULES! and is not an access control model. In anyhow, I would be glad if you would recommend an access control model to preserve Integrity, I would simply tell you THIS IS NOT a best practice. –  Phoenician-Eagle May 13 '11 at 6:33
I fail to see the distinction you make re "Integrity preserving model that uses access control" vs "access control model". Biba is an Access Control Model, even though it is not focused on confidentiality. I really dont understand why you say it isnt... –  AviD May 14 '11 at 23:23
And on your other point, "access control model to preserve Integrity, I would simply tell you THIS IS NOT a best practice" - you would be very wrong. Access control is intended to, well, control access. Not necessarily access to confidential information, just access. That could be access to performing some fuctionality, or access to modifying some data (i.e. integrity). Access control is absolutely one of the key methods to protect that. –  AviD May 14 '11 at 23:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.