I'm studying for the CISSP exam and I'm getting confused about the differences between access control methods, security models, and security policies.

When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula. After reviewing though, here's my new understanding:

A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines. As an example, think of it like an architectural plan for a building -- the structure is there but details are not.

A Security Model is more specific and addresses how to incorporate those guidelines. As an example, think of it like construction plans with details of electrical, plumbing, etc.

An Access Control Method is a standard that the Security Model aligns with.

Am I way off here?

3 Answers 3


You are pretty much on the money with your understanding. My only thought is that I wouldn't necessarily class an access method as a standard, more a model which, if adhered to, gives you some rules you can implement around access.

One thing to be aware of is that although control is usually based around confidentiality, as in Bell-Lapadula, the access model may be based around integrity. I would advise a good read of the Orange Book, or for a summary, see the Biba model wikipedia entry - in this model, the key is around levels of integrity, so you prevent data being written from a lower integrity area to a higher integrity area, as that could impact the integrity in the higher area.

  • +1, though AC can also be used to control availability (to some extent). Also, "Security Policy" tends to be overridden in several completely disparate contexts: e.g. your firewall has a "security policy", your OS and domain have "security policies", heck Sharepoint might have a "security policy". Some of these are broad outlines, some of these are very technical and are really "security models", and some are the actual implementation of that policy.
    – AviD
    Commented May 12, 2011 at 21:11
  • Thanks Rory (and AviD). As a follow-up question... what should I call models that are referenced by other official models? For example, Bell LaPadula falls under the "Information Flow" model right? Are Bell Lapadula and "information flow" both considered security models?
    – Mike B
    Commented May 12, 2011 at 23:53

Access control methods address mainly the confidentiality requirement (which does not mean that confidentiality can only be provided via access control).

A security policy defines the security requirements for the resource you are trying to protect. This means it includes confidentiality, integrity and others. Mainly it is used as a "contract" when receiving a request. It can be written using a (standard) language that allows automated verification, e.g. WS-Policy.

Security Model defines the way your security solutions are designed, so you have as well the solution in the description. Typically you start having descriptions for sandboxing models, encryption capabilities, etc...

  • This is wrong, Access control is very specifically not just about confidentiality. Access control can also protect integrity, and even availability in some situations. Even in the class AC models, you have Biba...
    – AviD
    Commented May 12, 2011 at 21:07
  • This is definitely not wrong, first I have clearly mentioned "Access control methods address mainly the confidentiality requirement" second, kindly check this en.wikipedia.org/wiki/Biba_Model BIBA model is an Integrity preserving model that uses ACCESS CONTROL RULES! and is not an access control model. In anyhow, I would be glad if you would recommend an access control model to preserve Integrity, I would simply tell you THIS IS NOT a best practice. Commented May 13, 2011 at 6:33
  • I fail to see the distinction you make re "Integrity preserving model that uses access control" vs "access control model". Biba is an Access Control Model, even though it is not focused on confidentiality. I really dont understand why you say it isnt...
    – AviD
    Commented May 14, 2011 at 23:23
  • 1
    And on your other point, "access control model to preserve Integrity, I would simply tell you THIS IS NOT a best practice" - you would be very wrong. Access control is intended to, well, control access. Not necessarily access to confidential information, just access. That could be access to performing some fuctionality, or access to modifying some data (i.e. integrity). Access control is absolutely one of the key methods to protect that.
    – AviD
    Commented May 14, 2011 at 23:26

Access control: Access control is basically a security technique which dictates who or what (a subject) can get access to any resource (object) in a computing system and environment. This is a central security concept in computer security which lays the foundation of many security concepts and methodologies.

There are two main types i.e.

Physical access control: This controls the access to buildings, database servers and other physical IT assets.

Logical access control: This controls the access to computer network connections, files and data.

Security policy: Security policy means how the information is accessed and what level of security is needed so that requirements are met and data is save to use. It is basically a written document which outlines how a company is going to protect its physical and IT assets. This document keeps updating as the requirements change for better adaptation.

Security model: Security model is basically a statement which highlights the necessary requirements to support and implement a particular security policy. For example if a security policy states that all users must be authorized before accessing network then the security model ensures to create an access control matrix so that the requirements are met.

  • You don't answer if the OP's understanding is correct, you just restate your views on the terms.
    – schroeder
    Commented Nov 3, 2019 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .