(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).
I'm studying for the CISSP exam and I'm getting confused on the differences between access control methods, security models, and security policies.
When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula. After reviewing though, here's my new understanding:
A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines. As an example, think of it like an architectural plans for a building -- the structure is there but details are not.
A Security Model is more specific and addresses how to incorporate those guidelines. As an example, think of it like construction plans with details of electrical, plumbing, etc.
An Access Control Method is a standard that the Security Model aligns with.
Am I way off here?