CISSP GLOSSARY · SECURITY ARCHITECTURE
No Write Down (Star Property)
The Bell-LaPadula rule that a subject cannot write to a lower classification level, stopping cleared users from leaking secrets into documents that lower clearances can read.
No Write Down is the second rule of the Bell-LaPadula model, formally the Star Property. A subject may write to an object only at or above their own level. The point is subtle enough that the exam tests it often: the rule is not about protecting the lower-level document, it is about protecting the higher-level information in the subject’s head. A Top Secret analyst pasting into an Unclassified memo would move secrets to where anyone can read them, so the write is refused.
The rule complements No Read Up: together they close both directions of leakage. It also produces Bell-LaPadula’s famous side-effect, that a high-level subject cannot even write an innocent note downward, which real systems soften with trusted subjects that are exempt from the Star Property. The Biba model mirrors the rule as No Write Up, where low-integrity subjects cannot corrupt high-integrity data.
Exam relevance: Star means write, in both models. If a question quotes “Star Property” alone it means Bell-LaPadula’s No Write Down; “Star Integrity Property” or “integrity axiom” phrasing signals Biba’s No Write Up. Deciding which model is in play from the goal, disclosure versus modification, settles the direction.