Access Control Models in Secure Software Development: CSSLP Exam Answer

Subjects Accessing Objects through Applications

Question

Which of the following security models dictates that subjects can only access objects through applications?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

The Clark-Wilson security model dictates that subjects can only access objects through applications.

Answer: A is incorrect.

The Biba model does not.

The security model that dictates that subjects can only access objects through applications is the Bell-LaPadula security model, also known as the Bell-LaPadula confidentiality model.

The Bell-LaPadula model is a security model that focuses on maintaining confidentiality in a system. It is based on the concept of a multilevel security system, where information is classified into different levels of sensitivity or confidentiality.

In the Bell-LaPadula model, subjects (users or processes) are classified into different security clearance levels, and objects (data or resources) are classified into different sensitivity levels. The model enforces two rules: the "no-read-up" rule and the "no-write-down" rule.

The "no-read-up" rule states that a subject with a lower security clearance level cannot read data from a higher security clearance level. This rule ensures that sensitive data is not disclosed to unauthorized users.

The "no-write-down" rule states that a subject with a higher security clearance level cannot write data to a lower security clearance level. This rule ensures that sensitive data is not modified by unauthorized users.

The Bell-LaPadula model also enforces the concept of a "trusted subject" and an "untrusted subject." A trusted subject is a subject that has been authorized to access certain objects, while an untrusted subject is a subject that has not been authorized to access certain objects.

The Biba model, on the other hand, is a security model that focuses on maintaining data integrity. It enforces two rules: the "no-read-down" rule and the "no-write-up" rule. The Clark-Wilson model is a security model that focuses on maintaining data integrity and consistency in a system. It enforces the concept of separation of duties and access controls. The Biba-Clark model is a combination of the Biba and Clark-Wilson models.