No Write Up (Star Integrity Property)
The Biba rule that a subject cannot write to a higher integrity level, stopping unreliable processes from injecting bad data into trusted records.
No Write Up is the second rule of the Biba model, formally the Star Integrity Property. A subject may write to an object only when the object’s integrity level is equal to or lower than the subject’s own. A script running at low integrity may write to its own scratch files, but it cannot write into the verified ledger that finance systems read from.
The rule protects the meaning of the label. A record marked high integrity is making a claim about how much it can be relied on, and that claim survives only if everything permitted to modify it is at least as reliable. One low-integrity write would quietly reduce a trusted file to the trustworthiness of its weakest contributor, while leaving the label unchanged and the consumers unaware.
Where the rule sits among its siblings
| Rule | Model | Formal name | Protects | Direction blocked |
|---|---|---|---|---|
| No Write Up | Biba | Star Integrity Property | Integrity | Writing to higher integrity |
| No Read Down | Biba | Simple Integrity Property | Integrity | Reading from lower integrity |
| No Write Down | Bell-LaPadula | Star Property | Confidentiality | Writing to lower classification |
| No Read Up | Bell-LaPadula | Simple Security Property | Confidentiality | Reading from higher classification |
Read the table by column rather than by row and the symmetry does the memorising: Simple governs reading, Star governs writing, and the two models point their restrictions in opposite directions because they want opposite things. Bell-LaPadula herds information upward, Biba herds it downward.
A worked case
A public-facing web form collects supplier bank details. The form handler runs at low integrity because anything reaching it came from the internet. The supplier master file is high integrity because payment runs read it directly.
No Write Up forbids the handler from touching the master file. The workflow that satisfies the model is the one an auditor would want anyway: the handler writes to a low-integrity pending queue, a verification step confirms the change through a separate channel, and only that trusted step promotes the record. Notice this is the same structural answer that a well-formed transaction gives in Clark-Wilson, arrived at from a different starting point.
The source
The rule is defined in K. J. Biba, Integrity Considerations for Secure Computer Systems, MITRE Technical Report MTR-3153 (1977). Biba wrote it explicitly as the dual of the Bell-LaPadula confidentiality model, which is why the two sets of rules mirror each other so exactly and why examiners like putting them side by side.
Exam relevance: a scenario is likely to feature untrusted input reaching a trusted store, and the expected answer restricts the write rather than sanitising the data afterwards. The trap worth rehearsing is the phrase “Star Property” appearing alone, which conventionally means Bell-LaPadula’s No Write Down; Biba’s rule is normally written “Star Integrity Property” or described as an integrity axiom. When only the direction is given, decide the model from the goal first, then apply the rule.
Frequently asked questions
- What is the Star Integrity Property?
- The Star Integrity Property is the Biba model rule usually stated as No Write Up: a subject may write to an object only if the object's integrity level is equal to or lower than the subject's own. It stops a process of uncertain reliability from placing data into records that other systems trust. Star marks it as the rule governing writing, the same convention Bell-LaPadula uses.
- Why is writing upward the dangerous direction for integrity?
- Because integrity is about the trustworthiness of data, and a record is only as reliable as the least reliable thing allowed to modify it. If a low-integrity process can write into a high-integrity file, every consumer of that file has silently inherited the low-integrity process's reliability. Blocking the upward write preserves the meaning of the higher label.
- How does No Write Up differ from No Write Down?
- They block opposite directions for opposite reasons. No Write Down belongs to Bell-LaPadula and stops a cleared subject writing secrets into a lower classification where uncleared readers could see them, protecting confidentiality. No Write Up belongs to Biba and stops an untrusted subject writing into higher-integrity data, protecting accuracy. Confidentiality restricts writing downward; integrity restricts writing upward.