CISSP GLOSSARY · SECURITY ARCHITECTURE
Biba model
The integrity counterpart to Bell-LaPadula: No Read Down and No Write Up stop trusted data from being contaminated by less trustworthy sources. Confidentiality is out of scope.
Biba is the integrity model, and the fastest way to hold it is as Bell-LaPadula inverted. Where Bell-LaPadula stops secrets flowing downward, Biba stops contamination flowing upward. Subjects and objects carry integrity levels, and two rules govern the flow: No Read Down (the Simple Integrity Property) stops a high-integrity subject consuming low-integrity data, and No Write Up (the Star Integrity Property) stops a low-integrity subject corrupting high-integrity data.
The intuition: a surgeon should not base a decision on gossip (no read down), and a random blog should not be able to edit the pharmacy formulary (no write up). Biba says nothing about confidentiality, and it addresses only the first of the three integrity goals; preventing unauthorised modification is its territory, while Clark-Wilson goes further into consistency and well-formed change. The full walkthrough is in the Biba guide.
Exam relevance: the exam’s favourite trap is swapping Biba’s rules with Bell-LaPadula’s. Anchor on the goal first: disclosure questions point to Bell-LaPadula, modification questions point to Biba, and the rule directions follow from the goal.