Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.

Text books tend to recommend that a combination of these methods be used to meet these security objectives of a DBS - but they often only touch the surface.

Marcin states that, the 'strong *-property', disallowing reading or writing from any other level but your own, is an idea introduced to battle the problem inherent to Biba-LaPadula: no state.

He also goes on to say that the Biba-LaPadulla is really only taught to security students as the first and simplest security model, it's really a toy, an educational construct.

So then, to what extent does the security methodology here apply to DBAs, how might they put it to practise, and just what is the consensus on handling Mandatory Access Control in a DBS?

  • related question here - also migrated from dba.se
    – user2752
    Commented May 10, 2012 at 12:10

1 Answer 1


I tend not to pay much attention to textbooks that recommend Bell-Lapadula or Biba multi-level security. Those schemes are impractical for most real-world settings. They make some beautiful theory, but they have not worked out well for general-purpose computing in practice.

Bell-Lapadula and Biba models have several major problems. Here are two of them:

  • They get in the way of useful work. The combination of Bell-Lapadula and Biba is the worst; it prohibits writing up or down, and prohibits reading up or down. Thus, it basically corresponds to creating multiple databases, segregating your data, and prohibiting any application from accessing more than one database. That's horribly unrealistic and rules out its use in most real systems.

  • They don't provide the security they claim. In practice, such systems always have covert channels that can be used to subvert the security "guarantees" that are supposed to be provided by a multi-level security system.

See the chapter on Multilevel Security in Ross Anderson's Security Engineering book for a lot more discussion on these practical problems, and some hard-earned experience. Ross has put this chapter from the first edition of the book online, so you can check it out. If you find it useful, buy the latest copy of his book; the second edition adds a lot of useful information, and the book is simply brilliant, perhaps the most insightful book on computer security I've ever read.

Bottom line: Bell-Lapadula and Biba aren't very practical, so you can safely ignore them for most settings.

  • 3
    Windows Vista/7's security model is based on Biba, but instead of "read up, write down" it's more "read down, write down" (and is discussed in the second edition of that chapter). Ignore seems a bit harsh.
    – pdubs
    Commented May 10, 2012 at 18:57
  • 3
    I don't think it's too harsh. I'd even go as far as saying you can ignore Mandatory Access Control altogether for most practical implementations. Unless you work in some secret-service highly-classified organization. Even in those I doubt those models are put to any practical use as is (although I have no experience working in such organizations).
    – Yoav Aner
    Commented May 10, 2012 at 20:23
  • 1
    @YoavAner You realize that Android by default uses a very extensive Mandatory Access Control system, right? Most people using Android do not have security clearance. Fedora, Ubuntu, CentOS, Gentoo, RHEL, and Debian all come with pre-made MAC policies. I'm not a DBA, but from memory I believe even MySQL can be configured to provide MAC-like protections. I understand that it's important to realize that BLP and such are not a panacea and can be especially annoying when combined, but the fact is, MACs based on these are very popular and very effective.
    – forest
    Commented Feb 28, 2018 at 3:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .