Talk:Bell–LaPadula model

Cleanup Request August '06

I put in the 'cleanup request for the following reasons:

1. The article doesn't distinguish between the abstract mathematical model and the implementation. The article probably needs separate sections to talk about them.
2. The "See Also" section points to some other models, but the article may need some discussion of how the other models are related.
3. Having a section on "Strong * Property" suggests that the article should talk more specifically about BLP extensions of all kinds. I think the only reason Strong * Property is in there is because some deluded person in the CISSP training world included it in study materials, despite its relative unimportance. But we can't talk about extensions unless we distinguish between those that extend the theoretical model (System Z for example) and those that seem more implementation related (Strong * Property).

If the cleanup doesn't happen otherwise I might get to it in a month or two. Cryptosmith (Rick Smith) 15:50, 14 August 2006 (UTC)

This article desperately needs a section on criticisms of the Bell-LaPadula model. One of the most serious criticisms is that the *-property, by requiring "high" processes to only communicate with other "high" processes, forces many processes by to labelled higher than they would otherwise need to be, and that this works directly against the Principle of Least Authority. Other criticisms of BLP and skepticism about its real-world relevance are discussed in these threads:

http://www.eros-os.org/pipermail/cap-talk/2005-December/004597.html

http://www.eros-os.org/pipermail/cap-talk/2006-January/004712.html

http://www.eros-os.org/pipermail/cap-talk/2006-July/005501.html

--DavidHopwood 15:17, 31 December 2006 (UTC)

--Mattpalmer1086 13:53, 2 March 2007 (UTC) Matt Palmer: I second that this article be cleaned up... can I suggest whoever does so actually reads the original paper by Bell and LaPadula? Especially on the topic of the *-property, which is stated in the original as "in any state, a current access (subject, object, attribute) implies: level(object) dominates current-level (subject) if attribute is a; level (object) equals current-level (subject) if attribute is w; and level (object) is dominated by current-level (object) if attribute is r." The * property does NOT prevent high level subjects from writing to low level objects. It merely prevents an access state existing that would allow downwards information flow. A high level subject, if he doesn't hold any observe access at a high level, is free to operate at a lower level, and write to a low level object. It's all in the original - this extra stuff seems to be a bit like chinese whispers (even the way I was taught it was actually wrong by the terms of the original paper that * property implies level(object) >= level(subject).). It doesn't - it just says no alter access can be granted lower than current observe access, and no observe access higher than current alter access. This implies that a subject can only write at a single leve, as the write operation in BLP implies both observe and alter. The single level requirements follows from the * property - a write at two levels would involve an observe access dominating an alter access - which is prohibited.

I may have a go at rewriting myself if I get time. By the way, the links to the capability section is interesting (eros), but they aren't the best people to criticise MLS approaches. Personally, I love capabilities and the E language stuff - but it's a million miles away from MLS. Finally, the article as it stands does not do justice to security levels - some more examples would be nice.

Features section

The article is not mentioning the property called the Strong * Property value. According to this property, the subject can only read/write at the same security level (clearance and classification must be equal). In some resources, this property is cited instead of the The Discretionary Security Property.

Please refer to:

Chapter 5 - Security Models and Architecture

CISSP: All-in-One Exam Guide, Third Edition by Shon Harris McGraw-Hill/Osborne © 2005

--Rygar81 22:08, 6 August 2006 (UTC)

• This appears to be a bogus term, even if it shows up in a CISSP Study Guide (yes, even such writers are human). A Google search uncovered two references - one to that Study Guide itself, and one to Rob Slade (he reviews a lot of security books) who argues that the term is bogus. I've seen systems implement such a property, but it's usually because the system has no way of allowing write only access to objects, so they need to make the shortcoming sound like a feature. Certainly it is not part of the classic BLP model. I know of no formal mathematical arguments that rely on defining a strong * property (anyone else know of one?). If Rygar81 would like to include a description in the BLP entry, go ahead, but be sure to cite the source (which I don't have) and note that the term is not widely used. Rick Smith 18:41, 7 August 2006 (UTC) (PhD, CISSP, ISSAP, ISSEP).
• I did a bit more poking around with Google (search: bell la padula "strong * property") and I can't find any primary references that use the term. I can find two sources: CISSP Exam Prep Guides of various sorts, a book Secured Computing published in '02 by one Carl Endorf, and reviews by Rob Slade of said books (including a suggestion that Endorf's book is essentially a prep guide, too). The definition is, as I said above, somewhat plausible, but I suspect it's a marketing term introduced by a vendor rather than a serious term used in the industry. I've been dealing with mulitlevel models and technology for a long time, and I can say that I've never used it myself. Rick Smith 19:21, 7 August 2006 (UTC)
• OK, I've found a link that appears to be to a relevant chapter of the 2nd edition of the Shon Harris book. On page 213 Harris illustrates a total lack of understanding of the BLP model, by claiming that it consists of 3 parts: the Simple Security Property, the * Property, and the Srong * Property, with the latter defined as above (write to current level only!!!). In fact, you only need one of those * properties, not both. So Harris is not a reliable source and should not be used as a reference for defining the Strong * Property, assuming it really exists. Rick Smith 19:21, 7 August 2006 (UTC)
• Hi Rick, I have also made some researches.

From:

Chapter 5 - Security Architecture and Models The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, Second Edition by Ronald L. Krutz and Russell Dean Vines John Wiley & Sons © 2004

"In some instances, a property called the Strong * Property is cited. This property states that reading or writing is permitted at a particular level of sensitivity but not to either higher or lower levels of sensitivity."

This is another source which talks about this property. I infer it is not a bogus term. I agree with you that Shon Harris book is confusing about BLP model. However this term seems to exist. Rygar81 00:20, 11 August 2006 (UTC)

• Let me say that Shon Harris is not confusing so much as she is wrong. I haven't been able to find the term anywhere except in CISSP study guides. I find that very suspicious, but I will go ahead and add something about it, based on my research on the subject. Cryptosmith (Rick Smith) 20:15, 12 August 2006 (UTC)

Success! I found a reference to a paper by Ravi Sandhu that defines the Strong * Property. The article will be edited accordingly. Cryptosmith (Rick Smith) 21:27, 12 August 2006 (UTC)

That's great! I completely agree with your last change about Strong * Property. Rygar81 21:29, 13 August 2006 (UTC)

--Mattpalmer1086 13:23, 2 March 2007 (UTC) The Strong *-Property is a complete red-herring. It's not used by anyone who does work on MLS models as far as I'm aware (and I've built database systems based on BLP). The paper by Ravi Sandhu states that "It is motivated by integrity considerations. The (weak) star-property allows a U user to write S-data. This can result in overwriting...". This is just not true by the terms of BLP, but may be true in other mandatory models. In BLP, a U user can never write to S data - they can only append - which is an alter without an observe. So no data can be overwritten. He is talking specifically in the context of database systems that are mandatory and multi-level secure. Although a better reference for MLS databases is the work on SeaView by Dorothy Denning. Anyway, at best it's an almost unheard of security property that no-one in the industry uses. It would be far better to spend time getting the actual *-property right. We must make the general distinction between mandatory multi-level secure systems in general - whether database oriented or not - and the specific BLP model.

Philomorph (talk) 18:31, 5 January 2018 (UTC) The third security property is an incomplete sentence that doesn't sensibly describe the property. I'm not familiar enough with the model to correct the problem - can someone else? The Discretionary Security Property states that use of an access matrix to specify the discretionary access control.

Merge High watermark

High watermark was introduced in Clark Weissman's Security controls in the ADEPT-50 timesharing system that appeared in the AFIPS Conference Proceedings, volume 35, pages 119--133. FJCC, 1969. As such it preceded the Bell-La Padula work. Volume 1 appeared in 1972. It is not appropriate to include as part of the BLP. David Bell 21:31, 18 December 2006 (UTC)

Proposing that High watermark be merged into Bell-LaPadula model as it is an extension of that model & the current article is very short. Dthvt 04:45, 9 December 2006 (UTC)

--Mattpalmer1086 13:30, 2 March 2007 (UTC) But it has nothing specifically to do with the actual BLP model! It's related by the more general concept of multi-level secure systems, but BLP doesn't work like this. A link would be OK, but it has no direct relevance.

Well, I don't see any reason to leave the merge tag on this page, so removing it... Dthvt 22:42, 27 June 2007 (UTC)

Requested move

The following discussion is an archived discussion of a requested move. Please do not modify it. Subsequent comments should be made in a new section on the talk page. No further edits should be made to this section.

The result of the move request was: page moved. Jclemens (talk) 22:59, 10 October 2010 (UTC)

---

Bell-La Padula model → Bell-LaPadula model — LaPadula is not spelt La Padula (see, e.g. http://www.albany.edu/acc/courses/ia/classics/belllapadula1.pdf). Benl (talk) 23:43, 3 October 2010 (UTC)

The above discussion is preserved as an archive of a requested move. Please do not modify it. Subsequent comments should be made in a new section on this talk page. No further edits should be made to this section.

External links modified

Hello fellow Wikipedians,

I have just modified one external link on Bell–LaPadula model. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:

• Added archive https://web.archive.org/web/20080608080857/http://www.selfless-security.org:80/presentations/lookingback/looking-back.html to http://www.selfless-security.org/presentations/lookingback/looking-back.html

When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at {{Sourcecheck}}).

This message was posted before February 2018. After February 2018, "External links modified" talk page sections are no longer generated or monitored by InternetArchiveBot. No special action is required regarding these talk page notices, other than regular verification using the archive tool instructions below. Editors have permission to delete these "External links modified" talk page sections if they want to de-clutter talk pages, but see the RfC before doing mass systematic removals. This message is updated dynamically through the template {{source check}} (last update: 18 January 2022).

• If you have discovered URLs which were erroneously considered dead by the bot, you can report them with this tool.
• If you found an error with any archives or the URLs themselves, you can fix them with this tool.

Cheers.—InternetArchiveBot (Report bug) 11:31, 30 October 2016 (UTC)

Review

·       What is the article's overall status?

o  I believe the article is informative and gives the reader a great starting point for researching the subject. The links also are a great place to research the subject matter as well.

·       What are the article's strengths?

o  The article does a great at clearly conveying the topic. It also gives enough detail to understand the full concept that’s being presented.

·       How can the article be improved?

o  The article could address its limitation such as covert channels being expanded upon.

·       How would you assess the article's completeness - i.e. Is the article well developed? Is it underdeveloped or poorly developed?

o  After the updates from the community I think the article is well developed and in a mature state.

Abrown106 (talk) 03:23, 21 January 2024 (UTC)