Domain 3 · Objective reference 3.2 · Chapter 20 of 62
Confidentiality, integrity and conflict-of-interest models
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Confidentiality hides; integrity constrains change; conflict rules constrain access history.
Explore the anchors
Model confidentiality through labeled access.
Concept matching activity
Match this task or description to its concept:
Model integrity through trust-level constraints.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
A security model expresses properties and rules so a design can be reasoned about. Bell–LaPadula is associated with confidentiality in a labelled environment: its simple-security rule constrains reading higher-classified information, and its star property constrains writing information downward under the model assumptions. Biba emphasizes integrity, commonly described through restrictions on reading lower-integrity information and writing to higher-integrity objects. These are model rules, not universal instructions for every practical system.
Design, evidence and tradeoffs
Clark–Wilson focuses on integrity through well-formed transactions, constrained data and separation of duties. Authorized transformation procedures and validation help prevent arbitrary modification. The Brewer–Nash model addresses conflict-of-interest access that can depend on a subject’s previous access within competing datasets. State-machine reasoning considers whether permitted transitions preserve the security properties of a state. An implementation needs correctly defined subjects, objects, labels, transitions and enforcement; a model name alone supplies none of those.
| Model or approach | Primary focus | Design implication |
|---|---|---|
| Bell–LaPadula | Label-based confidentiality | Control reading upward and writing downward under its rules |
| Biba | Label-based integrity | Protect higher-integrity objects from lower-integrity influence |
| Clark–Wilson | Transaction integrity | Well-formed transactions and separation of duties |
| Brewer–Nash | Conflict of interest | Access decisions can depend on prior dataset access |
| State-machine reasoning | Preservation across transitions | Verify that authorized changes preserve the specified property |
Worked example
A financial workflow uses approved transactions and independent approval to protect ledger integrity rather than giving users arbitrary write access.
Check your understanding
Why should a confidentiality model not be treated as a complete integrity solution?
Show explanation
It formalizes a particular property and assumptions; integrity and real-world enforcement require their own requirements and validation.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.