SSCP Systems Security Certified PractitionerAccess ControlsMedium
An organization uses an access control system where a subject's access rights to an object are determined by comparing the subject's security clearance level with the object's security classification label. The system strictly prevents a subject from writing information to an object with a lower security classification than their own clearance. Which access control model and specific property are being described?
- AMandatory Access Control (MAC) and the *-Property (Star Property)
- BDiscretionary Access Control (DAC) and the Simple Security Property
- CRole-Based Access Control (RBAC) and the No Write Down rule
- DAttribute-Based Access Control (ABAC) and the No Read Up rule
Show answer & explanationAnswer & explanation
Correct answer: A. Mandatory Access Control (MAC) and the *-Property (Star Property)
Mandatory Access Control (MAC) uses security labels and clearances to enforce access. The *-Property (Star Property) in MAC specifically states that a subject cannot write to an object with a lower security classification (no write-down), which prevents information from flowing from a higher security level to a lower one.
Why the other options are wrong
- B. DAC is based on owner discretion, not security labels. The Simple Security Property (no read-up) is part of Bell-LaPadula but not the primary rule for writing down.
- C. RBAC is role-based, not label-based. 'No Write Down' is a concept within MAC's *-Property, not RBAC.
- D. ABAC uses attributes, not security labels and clearances in this strict hierarchical sense. 'No Read Up' is the Simple Security Property, which is about reading, not writing down.
Bell-LaPadula Model: *-Property (Star Property)
A security property within the Bell-LaPadula confidentiality model that prevents a subject from writing to an object that has a lower security classification (no write-down).
- Aims to prevent information from flowing downwards to lower security levels.
- Part of Mandatory Access Control (MAC).
- Crucial for maintaining confidentiality in multi-level security systems.
Memory trick: Bell-LaPadula: Don't write down secrets, don't read up gossip.