No Read Down (Simple Integrity Property)
The Biba rule that a subject cannot read data of lower integrity than its own, stopping trusted processes from being corrupted by unreliable input.
No Read Down is the first rule of the Biba model, formally the Simple Integrity Property. A subject may read an object only when the object’s integrity level is equal to or greater than the subject’s own. A process trusted to handle verified financial records may read verified records and anything more trustworthy, but it may not read an unvalidated file dropped into a shared directory.
The reasoning is contamination rather than secrecy. Biba’s concern is that information flows into a process and shapes what that process produces, so a trusted component that consumes untrusted input has already been compromised in the sense that matters, whether or not anything was written. Blocking the read stops the contamination at the point of entry.
Where the rule sits among its siblings
| Rule | Model | Formal name | Protects | Direction blocked |
|---|---|---|---|---|
| No Read Down | Biba | Simple Integrity Property | Integrity | Reading from lower integrity |
| No Write Up | Biba | Star Integrity Property | Integrity | Writing to higher integrity |
| No Read Up | Bell-LaPadula | Simple Security Property | Confidentiality | Reading from higher classification |
| No Write Down | Bell-LaPadula | Star Property | Confidentiality | Writing to lower classification |
The pattern that makes all four memorable: Simple always governs reading and Star always governs writing, in both models. What changes is the goal. Biba pushes information downward to keep quality high, Bell-LaPadula pushes it upward to keep secrets in.
A worked case
A payment reconciliation service runs at high integrity because its output posts directly to the ledger. An operator uploads a spreadsheet of adjustments to a staging directory that anyone in the finance team can write to, so that directory is low integrity.
Under No Read Down the service cannot open that spreadsheet at all. The fix is not to relax the rule but to raise the data: a validation step at low integrity checks the file, and a trusted upgrade process promotes the result to high integrity, at which point the service may read it. The rule forces the validation to exist and to be explicit, which is the whole point.
The source
Biba’s rules come from K. J. Biba, Integrity Considerations for Secure Computer Systems, MITRE Technical Report MTR-3153 (1977), written as the integrity counterpart to the Bell-LaPadula confidentiality work of the previous year. Both were built for mandatory access control systems where labels, not owners, decide access.
Exam relevance: a scenario is likely to describe a trusted process about to consume data of unknown provenance, and the expected answer is that the read is refused rather than that the data is scanned. Candidates are expected to keep two things straight: that Simple means read in both models, and that Biba’s downward restriction on reading is the mirror of Bell-LaPadula’s upward one. The quickest way to choose between them is to ask what the question is worried about, disclosure or corruption.
Frequently asked questions
- What is the Simple Integrity Property?
- The Simple Integrity Property is the Biba model rule usually stated as No Read Down: a subject may read an object only if the object's integrity level is equal to or higher than the subject's own. It exists so that a high-integrity process cannot be corrupted by consuming low-integrity data. The word Simple marks it as the rule governing reading, exactly as it does in Bell-LaPadula.
- Why would reading low-integrity data be dangerous?
- Because a process is only as trustworthy as what it acts on. A high-integrity process that reads an unvalidated file and then makes decisions from it has effectively imported that file's unreliability into its own output, without any explicit write ever taking place. Biba treats contamination as travelling upward through reads, which is why the rule blocks the read rather than the later use.
- How does No Read Down differ from No Read Up?
- They are mirror images serving opposite goals. No Read Up belongs to Bell-LaPadula and protects confidentiality by stopping a subject reading above its clearance. No Read Down belongs to Biba and protects integrity by stopping a subject reading below its integrity level. If the scenario is about secrets leaking the model is Bell-LaPadula; if it is about data being corrupted the model is Biba.