Home › Security Architecture & Engineering

Bell-LaPadula Model Explained — Security Models (Part 2)

Security Architecture & EngineeringCISSP

Bell-LaPadula is the foundational confidentiality model in the CISSP body of knowledge — built for military and government multilevel security, it's the model behind every "no read up, no write down" rule you'll see on the exam. In Part 2 of our Security Models series, we break down its formal rules, the trusted-subject exception, and where the model's confidentiality-only design falls short.

What you will learn

• What Bell-LaPadula is and why the U.S. DoD built it
• The Simple Security Property (no read up) and the Star Property (no write down)
• The Discretionary Security Property — the access-matrix layer on top of the mandatory rules
• The trusted subject exception for legitimate declassification
• A classic military-classification example of the model in action
• Bell-LaPadula's tradeoff: confidentiality only, no integrity, no covert-channel protection

Part of the series: Security Models Explained — Overview (Part 1)

1. Security Models Explained — Overview (Part 1)
2. Bell-LaPadula Model Explained — Security Models (Part 2)
3. Biba Model Explained — Security Models (Part 3)
4. Clark-Wilson Model Explained — Security Models (Part 4)
5. Brewer-Nash Model Explained — Security Models (Part 5)
6. Graham-Denning Model Explained — Security Models (Part 6)
7. Harrison-Ruzzo-Ullman (HRU) Model Explained — Security Models (Part 7)
8. Take-Grant Model Explained — Security Models (Part 8)
9. Noninterference Model Explained — Security Models (Part 9)

More in Security Architecture & Engineering

• Cryptography Explained — Overview (Part 1)
• Secure Access Service Edge (SASE) Explained