I'm studying for the CISSP exam and I'm getting confused about the differences between access control methods, security models, and security policies.
When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula. After reviewing though, here's my new understanding:
A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines. As an example, think of it like an architectural plan for a building -- the structure is there but details are not.
A Security Model is more specific and addresses how to incorporate those guidelines. As an example, think of it like construction plans with details of electrical, plumbing, etc.
An Access Control Method is a standard that the Security Model aligns with.
Am I way off here?