Introduction To Classic Security Models

Last Updated : 6 Jul, 2026

Classic security models are formal security frameworks that specify the rules governing access to system resources. They determine whether a user, process or application is permitted to perform operations such as reading, writing, executing or modifying a protected object.

  • Standardizing security policy implementation.
  • Eliminating ambiguity in access control decisions.
  • Restricting unauthorized information flow.
  • Supporting security certification and evaluation.

Bell-LaPadula Model

This Model focuses on maintaining confidentiality by preventing unauthorized access.

  • The model was invented by Scientists David Elliot Bell and Leonard. J. LaPadula.
  • Here, the classification of Subjects(Users) and Objects(Files) is organized in a non-discretionary fashion, with respect to different layers of secrecy.
bell_model
Bell-LaPadula Model

It has mainly three rules

  • Simple Confidentiality Rule: This rule states that the subject can only read the files on the same layer of secrecy and the lower layer of secrecy but not the upper layer of secrecy, due to which we call this rule NO READ-UP 
  • Star Confidentiality Rule: This rule states that the subject can only write the files on the same layer of secrecy and the upper layer of secrecy but not the lower layer of secrecy, due to which we call this rule the NO WRITE-DOWN rule 
  • Strong Confidentiality Rule: This rule is highly secured and the strongest which states that the subject can read and write the files on the same layer of secrecy only and not the Upper Layer of Secrecy or the Lower Layer of Secrecy, due to which we call this rule as NO READ WRITE UP DOWN 

Biba Model

This Model focuses on integrity rather than confidentiality, preventing unauthorized and improper modifications.

  • This model was invented by Scientist Kenneth .J. Biba.
  • The classification of Subjects(Users) and Objects(Files) is organized in a non-discretionary fashion, with respect to different layers of secrecy.
  • This works the exact reverse of the Bell-LaPadula Model.
biba_model
Biba Model

It has mainly three rules

  • Simple the: This rule states that the Subject can only read the files on the same layer of secrecy and the upper layer of secrecy but not the lower layer of secrecy, due to which we call this rule as NO READ DOWN. 
  • Star Integrity Rule: This rule states that the Subject can only write the files on the same layer of secrecy and the lower layer of secrecy but not the upper layer of secrecy, due to which we call this rule the NO WRITE-UP 
  • Strong Star Integrity Rule: This rule is highly secured and the strongest, which states that the subject can read and write the files on the same layer of secrecy only and not the Upper Layer of Secrecy or the Lower Layer of Secrecy, due to which we call this rule as NO READ WRITE UP DOWN 

Clarke Wilson Security Model

This Model is a highly secured model. It has the following entities:

  • Subject: It is any user who is requesting data items.
  • Constrained Data Items: They cannot be accessed directly by the subject. These need to be accessed via the Clarke Wilson Security Model. 
  • Unconstrained Data Items: It can be accessed directly by the subject.
clarke_wilson_model
Clarke Wilson Security Model

The Components of Clarke Wilson Security Model

  • Transformation Process: The subject's request to access the constrained data items is handled by the transformation process, which then converts it into permissions and then forwards it to the integration verification process.
  • Integration Verification Process: It will perform authentication and authorization. If that is successful, then the subject is given access to constrained data items.

Core Components of a Security Model

Every classic security model operates using several fundamental elements.

Subject

A subject is an active entity capable of requesting access to protected resources.

  • A subject performs operations but does not permanently store information.
  • Examples: Authenticated users, Running processes, System services, Applications.

Object

An object is a passive resource that stores or contains information.

  • Objects receive operations initiated by subjects.
  • Examples: Files, Directories, Database records, Memory segments, Network resources.

Access Rights

Access rights define the operations that a subject may perform on an object.

  • Typical permissions include: Read, Write, Execute, Delete, Append, Modify, Create.
  • These permissions are granted according to the security policy enforced by the model.

Security Policy

A security policy specifies the conditions under which access is permitted or denied.

  • The policy defines: Security classifications, Authorization rules, Information flow restrictions, Integrity requirements, Administrative controls.
  • Every classic security model implements its own policy using formally defined rules.

Limitations of Classic Security Models

  • Most models emphasize a single security objective such as confidentiality or integrity.
  • They do not directly address modern cyber threats including ransomware, phishing or advanced persistent threats.
  • Dynamic cloud infrastructures require more flexible policy enforcement than many classical models provide.
  • Insider behavior analytics and real-time threat detection are outside their scope.
  • Practical implementation may require additional security mechanisms beyond the formal model.
Comment

Explore