What's the difference between an access control method, security model, and security policy?

Question

(I should apologize in advance because this question is going to be messy -- I'll try to refine it as the subject becomes more clear to me).

I'm studying for the CISSP exam and I'm getting confused on the differences between access control methods, security models, and security policies.

When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula. After reviewing though, here's my new understanding:

A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines. As an example, think of it like an architectural plans for a building -- the structure is there but details are not.

A Security Model is more specific and addresses how to incorporate those guidelines. As an example, think of it like construction plans with details of electrical, plumbing, etc.

An Access Control Method is a standard that the Security Model aligns with.

Am I way off here?

-M

Answer 1

You are pretty much on the money with your understanding, Mikey. My only thought is that I wouldn't necessarily class an access method as a standard, more a model which, if adhered to, gives you some rules you can implement around access.

One thing to be aware of is that although control is usually based around confidentiality, as in Bell-Lapadula, the access model may be based around integrity. I would advise a good read of the Orange Book, or for a summary, see the Biba model wikipedia entry - in this model, the key is around levels of integrity, so you prevent data being written from a lower integrity area to a higher integrity area, as that could impact the integrity in the higher area.

Answer 2

Access control methods address mainly the confidentiality requirement (which does not mean that confidentiality can only be provided via access control).

A security policy defines the security requirements for the resource you are trying to protect. This means it includes confidentiality, integrity and others. Mainly it is used as a "contract" when receiving a request. It can be written using a (standard) language that allows automated verification, e.g. WS-Policy.

Security Model defines the way your security solutions are designed, so you have as well the solution in the description. Typically you start having descriptions for sandboxing models, encryption capabilities, etc...