Biba Model: No Read Down, No Write Up (CISSP)

The Biba model is a security framework designed to protect data integrity by controlling how information flows within a system. Unlike confidentiality-focused models, Biba has one job: keeping data accurate and trustworthy. It prevents untrusted sources from corrupting critical information, and it stops lower-integrity data from contaminating high-integrity systems.

Biba was developed as a direct response to the limitations of the Bell-LaPadula model, which protects secrets but says nothing about accuracy. The two complement each other: Bell-LaPadula protects trusted data from unauthorized disclosure, Biba protects it from unauthorized modification. Understanding that distinction is essential for CISSP candidates, particularly in Domain 3 (Security Architecture and Engineering), where access control models are among the most frequently tested topics.

What is the Biba Model?

The Biba model controls information flow so that trusted data can never be polluted by untrusted sources. It focuses on one goal: maintaining the accuracy and trustworthiness of data. Every rule in the model exists to stop bad information flowing into good systems.

Core Purpose: Integrity Protection

Most security conversations start with confidentiality: keeping secrets safe from prying eyes. But integrity is just as critical in enterprise environments, and often more so. Consider a financial institution where transaction records must remain accurate, or a hospital where a patient’s medication dosage cannot be altered by unauthorized personnel. In those scenarios, data corruption could be devastating even if no secret was ever disclosed. Nobody stole anything; something worse happened: the data stopped being true.

Key concept: integrity vs confidentiality. Integrity ensures data remains accurate, complete, and unmodified by unauthorized sources. Confidentiality ensures data remains secret from unauthorized viewers. The Biba model exclusively addresses integrity: it has no mechanisms for protecting confidentiality or availability.

The model operates on a simple premise: information should only flow in directions that preserve trust. High-integrity data should never be touched by lower-integrity sources, and users should never base their work on information they cannot trust. That controlled flow is the foundation of the model’s two core rules.

Integrity Levels

Before the rules make sense, you need to see how Biba organises data and users. The model assigns an integrity level to both. These levels form a hierarchy from most to least trusted:

Your integrity level determines what data you can modify and which sources you can rely on. Think of it as a trust rating: high integrity means the data has been verified and is reliable; low integrity or untrusted means it has not been validated and could contain errors, or worse, deliberate manipulation.

CISSP Exam Note. Integrity levels reflect trustworthiness and verification status, not sensitivity. A document can be highly confidential (sensitive) and simultaneously low integrity (unverified). Sensitivity and trustworthiness are independent properties, and mixing them up is one of the most common exam mistakes in this topic.

The Two Core Properties

Biba enforces integrity through two rules that control information flow. One prevents contamination of your work; the other prevents corruption of data more trusted than you.

Simple Integrity Property (No Read Down)

The Simple Integrity Property says you cannot read from lower integrity levels. It is often called the “read up” rule, because you can only read from sources at your level or higher, never below.

The logic: untrusted or lower-quality data must never influence critical decisions. The system blocks access to anything that could pollute your work with unreliable information. A useful analogy is a chef who refuses to cook with ingredients from an unknown supplier: it is not that the ingredients are definitely bad, it is that nobody has verified they are good, and the dish carries the risk of its worst ingredient.

Consider a financial auditor with medium integrity clearance preparing quarterly reports for regulators and investors. If they could pull data from untrusted external sources or low-integrity temporary files, a single manipulated figure could corrupt the entire analysis. Under Biba, the system blocks everything below their integrity level. They can read high-integrity financial databases and medium-integrity internal reports, but low-integrity scratch files and unverified vendor spreadsheets are invisible to them. One corrupted data point could invalidate an entire audit and trigger regulatory violations; No Read Down makes that structurally impossible.

Star Integrity Property (No Write Up)

The Star Integrity Property (*-Integrity Property) says you cannot write to higher integrity levels. It is often called the “write down” rule, because you can only write at your level or lower, never upward.

The logic: less trusted users must never modify critical, trusted data. Imagine a contractor with low-integrity access helping with data entry. If they could write directly into high-integrity production databases, a mistake or a malicious change could corrupt systems that thousands of users depend on. Under Biba, they can only write to low-integrity staging areas. Their work must then be reviewed and promoted upward by someone with the authority to vouch for it: a database administrator with high-integrity access validates the data and moves it up. Once information reaches a trusted level, lower-integrity users cannot touch it.

CISSP Exam Note. Remember Biba’s rules as the exact opposites of Bell-LaPadula. Biba is No Read Down, No Write Up. Bell-LaPadula is No Read Up, No Write Down. Same structure, opposite directions: Biba protects integrity, Bell-LaPadula protects confidentiality. Exam questions routinely swap the rules between models to catch candidates who memorised words instead of goals.

Putting It Together: A Banking Example

A bank’s core financial system uses Biba to protect transaction records. A junior analyst with medium integrity is reviewing account activity.

Reading (Simple Integrity Property). The analyst can read from high-integrity sources like the verified transaction log and from medium-integrity sources like daily summaries. They cannot read from low-integrity sources like unverified external data feeds, because that could introduce errors into their analysis.

Writing (Star Integrity Property). When the analyst writes their report, they can save it at medium integrity or lower. They cannot modify the high-integrity master database directly. Their findings must pass through a senior analyst with high-integrity access, who verifies the information before it updates critical systems.

The summary worth memorising:

• Reading: information flows down to you from more trusted sources (you read from your level or higher)
• Writing: your output flows down, never up (you write to your level or lower)
• Result: high-integrity data is protected from both contamination (bad reads) and corruption (bad writes)

Biba vs Bell-LaPadula

Biba becomes much clearer when you set it beside Bell-LaPadula, its mirror image. The two are frequently tested together because they are structurally identical and directionally opposite. Our glossary entry on the Bell-LaPadula model has the one-paragraph version if you need a refresher.

The Fundamental Difference

Biba treats higher levels as more trusted and protects them from corruption. Bell-LaPadula treats higher levels as more sensitive and protects them from exposure. Opposite goals produce opposite rules: Biba protects data accuracy, Bell-LaPadula protects data secrecy.

Hospital example (Biba). In a hospital records system running Biba, a nurse with medium integrity can read from high-integrity patient records and verified lab results, but cannot read from low-integrity preliminary data that has not been confirmed. When documenting care, they write to medium-integrity nursing notes but cannot modify high-integrity diagnosis records. The system defends against medical error and preserves accuracy.

Military example (Bell-LaPadula). In a military intelligence database running Bell-LaPadula, an analyst with Secret clearance cannot read Top Secret reports, and cannot save their own documents into Confidential folders. The system defends against espionage and disclosure.

CISSP Exam Note. When a scenario mentions data accuracy, verification, or corruption, think Biba. When it mentions secrets, classification, or disclosure, think Bell-LaPadula. The security property being protected determines the model. And if the scenario is commercial fraud prevented by procedures and separation of duties rather than levels, the answer shifts to Clark-Wilson.

Practical Limitations

Biba is theoretically strong for integrity but has real-world friction that CISSP candidates should understand.

Single-Focus Design

The model addresses integrity and ignores everything else. An authorized user could leak sensitive data to a competitor or expose private information, and Biba would not object, because those are not integrity violations. Organisations typically pair it with Bell-LaPadula for confidentiality and add separate availability controls.

Data Flow Restrictions

Downward-only writing creates a practical challenge: high-integrity users cannot easily share their work with lower-integrity systems, even when collaboration is legitimate. Data accumulates at higher integrity levels, and organisations need manual review processes to move information down when it is genuinely needed.

Critical understanding. The Biba model provides no protection for confidentiality or availability, only integrity. Comprehensive security requires multiple complementary controls. Never assume a single security model addresses all requirements.

Conclusion

The Biba model provides a formal framework for protecting data accuracy through controlled information flow. The Simple Integrity Property (No Read Down) stops untrusted sources from contaminating your work; the Star Integrity Property (No Write Up) stops less trusted users from corrupting critical data. Together they guarantee that trust only flows downward, and that nothing flows up into systems more trusted than its source.

Understanding how Biba differs from Bell-LaPadula is non-negotiable for the exam: Bell-LaPadula protects secrets with the opposite rules, and the two models complement each other in layered architectures. Alongside them sit Clark-Wilson, which achieves integrity through certified procedures instead of levels, Brewer and Nash, which prevents conflicts of interest dynamically, and Graham-Denning, which governs how access rights themselves are managed.

When an exam scenario involves data accuracy, verification, or preventing corruption, the Biba model is your answer.

Want to pressure-test that knowledge before exam day? Our LSM CISSP practice tests drill exactly these model-selection scenarios, with detailed explanations of why each distractor fails.

Quick Reference for the CISSP Exam

The Biba model protects data integrity by controlling information flow. It prevents untrusted sources from corrupting critical data and keeps high-integrity systems uncontaminated by lower-integrity information.

The Two Core Properties

• Simple Integrity Property (No Read Down): users cannot read from lower integrity levels. Prevents contamination from untrusted sources.
• Star Integrity Property (No Write Up): users cannot write to higher integrity levels. Prevents corruption of trusted data.

Integrity Levels

• High integrity: verified, audited, critical data (financial records, production databases)
• Medium integrity: validated internal data (internal reports, reviewed documents)
• Low integrity: unvalidated data (temporary files, drafts)
• Untrusted: external or unverified data (vendor input, user submissions)

Biba vs Bell-LaPadula

• Biba: protects integrity. No Read Down, No Write Up. Higher means more trusted.
• Bell-LaPadula: protects confidentiality. No Read Up, No Write Down. Higher means more sensitive.

Common Exam Mistakes

• Confusing Biba rules with Bell-LaPadula rules (they are exact opposites)
• Assuming Biba provides confidentiality protection (it does not)
• Forgetting that integrity levels reflect trustworthiness, not sensitivity
• Overlooking that “higher” in Biba means more trusted, not more secret

Exam Focus: Sabotage vs Espionage

Both Biba and Bell-LaPadula are static, rule-based lattice models, but they defend against fundamentally different adversary goals. The fastest way to pick the right model is to identify what the adversary is trying to accomplish:

1. Identify the threat type. Sabotage (corrupting, tampering, planting false data) is an integrity attack: Biba. Espionage (stealing secrets, viewing classified information) is a confidentiality attack: Bell-LaPadula.

2. Rule directions. Biba: No Read Down (blocks contamination), No Write Up (blocks corruption). Bell-LaPadula: No Read Up (blocks unauthorized viewing), No Write Down (blocks leakage). Memory aid: Biba protects the truth, Bell-LaPadula protects the secret.

3. The manager takeaway. Apply the models by asset: financial transaction logs and audit trails call for Biba thinking (prevent tampering); military intelligence reports call for Bell-LaPadula thinking (prevent disclosure).

Bottom line: Bell-LaPadula hides the data; Biba protects the truth. If the scenario describes an adversary trying to corrupt or tamper with trusted systems, Biba is your answer.