CISSP GLOSSARY · SECURITY ARCHITECTURE
Bell-LaPadula model
The confidentiality-only security model behind CISSP Domain 3: No Read Up (Simple Security Property) and No Write Down (Star Property) keep classified data from leaking downward.
Bell-LaPadula is the first security model most CISSP candidates memorise, and the one the exam most likes to confuse with Biba. Keep the anchor simple: it protects confidentiality and nothing else. Subjects hold clearances, objects hold classifications, and the two properties control the flow between them.
No Read Up means your clearance is a ceiling: a Secret-cleared analyst cannot open a Top Secret file. No Write Down means your clearance is also a floor for writing: that same analyst cannot paste Secret content into an Unclassified document, because writing down moves information to where lower-cleared subjects can read it.
Exam relevance: scenario questions describe a control without naming the model and ask which property applies. If the scenario is about preventing disclosure, answer from Bell-LaPadula. If it is about preventing improper modification, the model in play is Biba or Clark-Wilson, not this one.