The Brewer and Nash model, also known as the Chinese Wall model, is a security framework designed to prevent conflicts of interest in environments where access to competing organisations’ data could create ethical or legal problems. Unlike models that focus on confidentiality or integrity, this model dynamically restricts access based on a user’s access history, so that information from direct competitors never ends up in the same hands.
The model matters most in consulting, legal, and financial services, where professionals routinely work with multiple clients in the same industry. For CISSP candidates, understanding how Brewer and Nash prevents information leakage between competitors is essential, especially when exam scenarios involve professional services firms, investment banking, or any environment requiring ethical walls between competing interests.
What is the Brewer and Nash Model?
The Brewer and Nash model has one primary goal: ensuring that users who access information from one company cannot access sensitive data from its direct competitors. The model creates dynamic barriers, invisible walls that form based on access decisions, preventing the same person from holding confidential information about competing organisations.
Core Purpose: Conflict of Interest Prevention
Where Bell-LaPadula protects confidentiality and Biba protects integrity, Brewer and Nash addresses a security concern neither of them touches: preventing competitive intelligence from crossing ethical boundaries. In professional services, having access to one company’s strategic plans while also viewing a competitor’s financial data creates an inherent conflict that could lead to insider trading, unfair business practices, or breach of fiduciary duty.
Key concept: dynamic vs static access control. Traditional models assign fixed clearance levels. Brewer and Nash creates access restrictions dynamically, based on user behaviour. Your permissions change over time depending on which companies’ data you have previously accessed. This history-dependent approach is what makes the model unique among access control frameworks, and it is the property the exam tests most often.
The “Chinese Wall” name describes how the restrictions feel in practice: the moment you access one company’s data, an invisible wall goes up between you and their competitors, like a physical barrier separating parties who should not communicate or share information.
How Conflict of Interest Develops
Before the rules make sense, you need to grasp the problem they solve. A conflict of interest arises when one person holds confidential information from multiple competing entities, creating opportunities for that information to influence decisions inappropriately.
The Core Problem
Imagine a financial analyst at a consulting firm. They review confidential financial data from Company A, a major smartphone manufacturer. If they can then access similar data from Company B, a competing smartphone manufacturer, they could use insights from one to benefit the other, create unfair advantages, or leak competitive intelligence. Nothing needs to be stolen for damage to occur: the mere combination of both datasets in one head is the problem. That conflict could violate professional ethics, securities law, or contractual obligations.
CISSP Exam Note. Brewer and Nash is tested through scenarios involving consulting firms, law practices, investment banks, and audit firms: any environment where professionals serve multiple clients in the same industry. Watch for the keywords “competitor”, “conflict of interest”, and “ethical wall”.
Three-Level Information Organisation
The model organises information into three hierarchical levels that determine how restrictions are applied:
| Level | Description | Examples |
|---|---|---|
| Objects | Individual files or data items | Financial reports, strategy documents, contracts |
| Company datasets | All data belonging to one organisation | All of Company A’s files grouped together |
| Conflict of interest classes | Groups of competing companies in the same industry | All smartphone manufacturers, all major banks |
At the bottom, objects are individual files and data items such as financial reports and strategy documents. Objects belong to company datasets, which contain everything from one specific organisation. Company datasets are then grouped into conflict of interest classes, which collect all the direct competitors in an industry. Once you access data from one company in a class, you are blocked from every competitor in that same class.
A conflict of interest class only groups companies that actually compete. A “smartphone manufacturers” class might contain Apple, Samsung, and Google. A “major airlines” class might contain United, Delta, and American. Companies in different classes do not conflict: a consultant can work for a smartphone maker and an airline at the same time without any ethical issue, because no information they hold advantages one against the other.
The Chinese Wall Rule
Brewer and Nash enforces its protection through one dynamic rule that adapts to your access history. It is called the Chinese Wall Rule because once you access a company’s data, an invisible wall rises between you and their competitors.
The Access Control Rule
A user can access an object only if it belongs to a company dataset they have already accessed, or if it belongs to a completely different conflict of interest class they have not touched yet.
How the wall builds over time:
- First access is unrestricted. Your first access in any conflict class is completely free: you can choose any company.
- Competitors become blocked. After accessing one company’s data, all competitors in that class are permanently blocked for you.
- Other classes remain open. You can still access companies in conflict classes you have not entered yet.
- The wall grows dynamically. Each choice you make extends your personal wall, creating an access pattern unique to you.
The key insight is that restrictions are user-specific and history-dependent. Another consultant at the same firm might have accessed Company B instead of Company A, giving them a completely different wall. There are no static clearance levels here: your own history determines what you can see, and once you cross into a company’s dataset, that decision is irreversible for that conflict class.
The Write Restriction (Preventing Leakage)
Most CISSP candidates focus solely on the read restriction, but Brewer and Nash includes a critical write rule to prevent indirect leakage. It plays the same role the star properties play in Bell-LaPadula and Biba, adapted for conflicts of interest.
The write rule. A subject can write to an object only if they cannot read any object contained in a different company dataset.
Why it matters: without this rule, the wall could be bypassed by simple copying. A consultant could read confidential material from Company A and then, accidentally or maliciously, write those secrets into a report or file accessible to Company B. The write rule makes that impossible: if you can read another company’s data, you lose the ability to write where it could leak.
In summary:
- Read rule: you can read data only if it does not conflict with your past access history.
- Write rule: you cannot write to a dataset while you hold read access to any other company’s dataset (prevents cross-contamination).
Consider an investment bank advising on mergers and acquisitions. An analyst working on Company A’s acquisition strategy cannot then advise Company B, a direct competitor, on defensive measures. The Chinese Wall ensures confidential strategy cannot flow between competing interests through the same person, protecting both clients and the integrity of the market.
Practical Example: A Day in the Life
The rules are easiest to internalise through a concrete scenario: a consultant at a multi-industry advisory firm.
Morning: Automotive Industry Work
The consultant opens files from Company A, an automotive manufacturer. The system records that they have entered the automotive conflict class through Company A. From this moment they are permanently blocked from Company B and Company C, Company A’s direct competitors in that class. They can keep working with any of Company A’s files, but the competing automotive manufacturers are off-limits forever.
Afternoon: Telecommunications Project
Later, the consultant picks up a telecommunications project. They have not entered the telecom conflict class yet, so they are free to choose any provider. They open files from Company X, a major telecom operator. Instantly, Company Y and Company Z, Company X’s competitors, are blocked. The consultant’s wall now spans two industries.
The Result
After these decisions, the consultant can work with Company A (automotive) and Company X (telecommunications), while every competitor in both classes is permanently blocked. A colleague who chose Company B and Company Y instead would hold a completely different set of permissions, despite having the same job title and the same employer.
CISSP Exam Note. Brewer and Nash is fundamentally about history-dependent, dynamic access control. Unlike Bell-LaPadula or Biba, which assign static clearance or integrity levels, this model’s restrictions change with user behaviour. Exam questions often test two specific points: access decisions are irreversible, and different users can have entirely different access patterns.
Practical Limitations
The model prevents conflicts of interest effectively, but implementing it in a real firm creates significant operational challenges.
Progressive Access Restriction
As users touch more companies across more industries, they build more walls and progressively lose access to more of the client base. A long-term employee can end up blocked from large portions of the firm’s clients purely because of who they have worked with historically. Seniority, ironically, shrinks your access rather than growing it.
| Limitation | Impact | Mitigation |
|---|---|---|
| Cumulative restrictions | Users lose access over time | Strategic assignment planning |
| Staffing complexity | Multiple users needed for full client coverage | Maintain a pool of “clean” consultants |
| Irreversible decisions | No mechanism to reset walls | New user accounts (loses institutional knowledge) |
| Single focus | Only addresses conflict of interest | Combine with other security models |
Operational Complexity
Because individual consultants become progressively restricted, firms may need multiple people to cover all clients. Assignments must be planned carefully, weighing immediate needs against long-term strategic implications, because once made, they are permanent. There is no supported way to reset or modify a historical wall without creating a new user account, which means losing continuity and institutional knowledge.
Critical understanding. Brewer and Nash only addresses conflict of interest prevention. It provides no protection for confidentiality in the general sense (information could still be disclosed to unauthorized parties who hold no conflicting access), no integrity protection (data could still be modified), and no availability protection. It must be combined with other access controls and monitoring to cover those gaps.
No Security Level Hierarchy
Unlike Bell-LaPadula or Biba, Brewer and Nash establishes no hierarchy of sensitivity or trust. All companies within a conflict class are treated equally: there is no concept of one company’s data being more confidential or more trustworthy than another’s. Organisations that need graduated access within a company’s dataset must layer additional controls on top.
Conclusion
The Brewer and Nash model takes a unique approach to access control: it builds restrictions dynamically from user behaviour rather than from static clearance levels. Through conflict of interest classes and the Chinese Wall Rule, it guarantees that professionals working across multiple clients can never hold competing organisations’ sensitive information at the same time.
For the exam, three things matter most. First, the three-level hierarchy: objects, company datasets, conflict of interest classes. Second, the defining characteristics: access decisions are irreversible and user-specific, so two colleagues can hold entirely different permissions. Third, the model’s scope: it addresses conflicts of interest only, and provides no confidentiality, integrity, or availability protection on its own. For those goals you reach for Bell-LaPadula, Biba, or Clark-Wilson, and for managing the access rights themselves, Graham-Denning.
When an exam scenario involves consulting firms, law practices, investment banks, or any environment with competing clients in the same industry, the Brewer and Nash (Chinese Wall) model is your answer.
If you want to see how the exam actually frames these scenarios, our LSM CISSP practice tests include model-selection questions that force you to distinguish Brewer and Nash from its static siblings, with full explanations.
Quick Reference for the CISSP Exam
The Brewer and Nash model (Chinese Wall model) prevents conflicts of interest by dynamically restricting access based on user history. Users who access one company’s data cannot access data from its direct competitors.
Three-Level Information Hierarchy
- Objects: individual files or data items (financial reports, strategy documents)
- Company datasets: all data belonging to one organisation
- Conflict of interest classes: groups of competing companies in the same industry
The Chinese Wall Rule
- First access: unrestricted choice within any conflict class
- After access: all competitors in that class become permanently blocked
- Other classes: remain accessible until you make a choice in each
- Irreversible: access decisions cannot be undone
Key Characteristics
- Dynamic access control: restrictions change with user behaviour, not static clearance levels
- User-specific: each user builds a unique wall from their own access history
- History-dependent: past access decisions determine future permissions
- Write rule: you cannot write anywhere your reads could leak to another company’s dataset
Practical Limitations
- Progressive restriction: users lose access over time as they serve more clients
- No reset mechanism: history cannot be undone without new accounts
- Single focus: conflicts of interest only; no confidentiality, integrity, or availability protection
Common Exam Scenarios
- Consulting firms working with multiple clients in the same industry
- Law firms representing competing companies
- Investment banks advising on mergers and acquisitions
- Audit firms whose clients are competitors
Exam Focus: Model Comparison
To identify the correct model instantly:
- Threat is unauthorized disclosure (espionage, leaking secrets): Bell-LaPadula
- Threat is data corruption (sabotage, integrity violations): Biba
- Threat is conflict of interest (competing clients, ethical walls): Brewer and Nash
Managerial takeaway: Bell-LaPadula hides secrets, Biba protects truth, Brewer and Nash prevents ethical violations.