Compare Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning and HRU. Score them against your requirements and export the result as a PDF.
This decision matrix scores six formal access-control models against the requirements you actually have, rather than asking you to memorise which one is “the confidentiality one”. Rate ten security requirements on a five-point scale, describe your environment, and the tool ranks Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, Graham-Denning, and Harrison-Ruzzo-Ullman by suitability, with a radar chart comparing your profile against each model’s strengths, a full comparison matrix, implementation guidance, and a PDF export of the recommendation.
Two audiences get value from it. Security architects deciding what enforcement model a new system should follow — and, more often, working out which model the system they inherited implicitly follows. CISSP and CISM candidates, for whom these models are examinable material in the Security Architecture and Engineering domain and are far easier to retain once you have seen how they score against different scenarios rather than as six paragraphs of definitions.
It is organised into four tabs.
The scoring is transparent rather than magical. Each model carries a weight for every requirement; your slider value divided by five is multiplied by that weight and summed, then bonuses are added for environment fit, primary concern, and regulatory regime, and the total is capped at 100%. A model that scores 40% is not bad — it is a poor match for the requirements you described.
Bell-LaPadula is the confidentiality model, developed for US military multi-level security. Its two rules are the simple security property — no read up, a subject cannot read data classified above its clearance — and the star property, no write down, a subject cannot write to a lower classification. The second rule is the one people find counter-intuitive, and it exists to stop a cleared user copying secret content into an unclassified file. Strengths: a rigorous mathematical proof of confidentiality, and a natural fit for clearance hierarchies enforced through MAC labelling. Weaknesses: it says nothing about integrity, it is vulnerable to covert channels, the write-down restriction is impractical in commercial settings, and the classification hierarchy is rigid.
Biba is Bell-LaPadula’s mirror image for integrity, and its rules invert accordingly: no read down (do not consume data less trustworthy than yourself) and no write up (do not contaminate data more trustworthy than yourself). It gives strong, formally proven integrity guarantees, but it is silent on confidentiality, can be extremely restrictive in practice, and assigning integrity levels to real data is harder than assigning classifications.
Clark-Wilson is the model that actually looks like commercial reality. Instead of labels, it works through transactions: constrained data items may only be modified by certified transformation procedures, and integrity verification procedures periodically confirm the data is still in a valid state. Separation of duties is built into the model rather than bolted on. It is the closest match for financial systems and ERP, its weakness being that a full implementation is complex, hard to retrofit, and requires the transformation and verification procedure definitions to be maintained over time.
Brewer-Nash, the Chinese Wall model, prevents conflicts of interest dynamically. Access is not decided by a static label but by history: once a consultant has read data from one client in a conflict-of-interest class, access to competitors in that class is automatically denied. It is the right model for professional services, law, audit, and investment banking — anywhere ethical walls are a regulatory requirement. Its weaknesses are its narrow focus, complexity that scales with the conflict dataset, and the fact that access tends to become more restricted over time with no clean way to reset history.
Graham-Denning is a foundational model defining eight primitive operations over subjects, objects, and rights — creating and deleting subjects and objects, and reading, granting, deleting, and transferring access rights. It is a complete formal account of the access-matrix lifecycle and underpins much of operating system security design, but it is theoretical: it is not something you deploy, it is something whose vocabulary you use.
Harrison-Ruzzo-Ullman extends that access-matrix formalism to ask the safety question: given a system and a set of commands, can a particular subject ever acquire a particular right? Its celebrated result is that the general case is undecidable — no algorithm can answer the question for every possible system. Restricted variants are decidable, which is why HRU is a foundation for formal verification research rather than an operational model.
Suppose you are architecting a payments platform for a regulated financial institution. You would rate integrity and commercial integrity 5, separation of duties 5, audit trail 5, regulatory compliance 5, confidentiality 4, and multi-level security 1 — there are no clearance levels here. Environment: commercial. Primary concern: integrity.
Clark-Wilson will lead comfortably, because that requirement shape is precisely what it was designed for. Biba will place respectably on the strength of the integrity weighting but lose ground on separation of duties and audit, which it does not address. Bell-LaPadula will score poorly, since its entire weighting rests on confidentiality and multi-level security, which you rated 4 and 1. Change the environment to government and set multi-level security to 5, and the ranking flips to Bell-LaPadula — which is the lesson the tool is really teaching. There is no best model, only a best fit for a stated requirement profile.
One thing worth stating plainly: these are not mutually exclusive, and mature systems combine them. A defence system may enforce Bell-LaPadula labelling for classification while applying Clark-Wilson transaction controls to its financial records; the Implementation tab lists complementary models for exactly this reason. And in practice these formal models are enforced through mechanisms you already know — SELinux and AppArmor for MAC labelling, RBAC and ABAC engines, database roles and row-level security, and maker-checker workflows for separation of duties. The model tells you what property you are trying to preserve; the mechanism is how you preserve it.
They are mirror images. Bell-LaPadula protects confidentiality with no read up and no write down. Biba protects integrity with no read down and no write up. One stops secrets leaking downward; the other stops contamination flowing upward.
Usually Clark-Wilson, because it models transactions, separation of duties, and verification — the things commercial systems actually enforce — rather than a classification hierarchy that most businesses do not have. Run the questionnaire to confirm against your own requirement profile.
Brewer-Nash. It prevents conflicts of interest by denying access dynamically based on what a user has already accessed: reading one client’s data in a conflict class automatically blocks that client’s competitors. It is the standard model for ethical walls in professional services.
Because HRU proved that for the general case there is no algorithm that can determine whether a subject could ever obtain a given right. Restricted forms of the problem are decidable, which is why HRU matters to formal verification research more than to daily operations.
Yes, and real systems commonly do — classification labelling for confidentiality alongside transaction controls for integrity, for example. The Implementation tab lists complementary models for whichever one scores highest.
Yes. These models are examinable in the Security Architecture and Engineering domain, and the comparison matrix plus the scoring behaviour makes the distinctions much easier to retain than definitions alone. The exported PDF is a compact revision sheet.
Each model has a weight per requirement. Your slider value divided by five is multiplied by that weight and summed across all ten requirements, then bonuses are applied for environment, primary concern, and regulatory regime, and the result is capped at 100%.
No. Scoring, charting, and PDF generation all happen locally; your requirement ratings are never transmitted. Related material sits in our security tools collection, and the cybersecurity ROI calculator helps with the business case once you have chosen an approach.
A security model decision matrix helps organizations select the appropriate access control and security architecture model based on their specific requirements, regulatory environment, and operational constraints. Security models define the rules governing how subjects (users, processes) interact with objects (files, resources, systems) and form the theoretical foundation for implementing access control in any system.
Choosing the wrong security model leads to either excessive restriction (impeding business operations) or insufficient protection (creating vulnerabilities). This tool guides you through the tradeoffs between models to match your organization's actual needs.
| Model | Full Name | Core Principle | Best For |
|---|---|---|---|
| DAC | Discretionary Access Control | Resource owners control access | General-purpose systems, file sharing |
| MAC | Mandatory Access Control | System-enforced labels and clearances | Military, classified data, high-security environments |
| RBAC | Role-Based Access Control | Access determined by job roles | Enterprise applications, healthcare, finance |
| ABAC | Attribute-Based Access Control | Access based on attributes and policies | Dynamic environments, cloud, context-aware systems |
| Bell-LaPadula | — | No read up, no write down | Confidentiality-focused (military/government) |
| Biba | — | No write up, no read down | Integrity-focused (financial, medical) |
| Clark-Wilson | — | Well-formed transactions, separation of duties | Commercial transaction integrity |
| Zero Trust | — | Never trust, always verify | Modern enterprise, cloud-native, remote workforce |
When selecting a security model, evaluate these dimensions:
Bell-LaPadula is a mandatory access control model focused on confidentiality. Its key rules are: "No Read Up" (Simple Security) - subjects cannot read objects at a higher classification, and "No Write Down" (Star Property) - subjects cannot write to objects at a lower classification. It prevents information from flowing to less secure levels.
The Biba model is the mathematical dual of Bell-LaPadula, focused on integrity instead of confidentiality. Its rules are: "No Read Down" - subjects cannot read objects at a lower integrity level, and "No Write Up" - subjects cannot write to objects at a higher integrity level. This prevents corruption of high-integrity data.
Clark-Wilson is preferred for commercial environments where well-formed transactions and separation of duties matter (e.g., financial systems). Biba is simpler and works for environments where integrity levels are clearly defined. Clark-Wilson enforces integrity through constrained data items (CDIs) and transformation procedures (TPs).
The Brewer-Nash model prevents conflicts of interest by dynamically restricting access based on what data a subject has already accessed. Once a consultant accesses data from Company A, they are blocked from accessing data from competing Company B. It is commonly used in financial services and consulting firms.
Consider your primary requirement: confidentiality (Bell-LaPadula for military/government), integrity (Biba for simple integrity, Clark-Wilson for commercial transactions), conflict of interest prevention (Brewer-Nash for consulting/finance), or access control management (Graham-Denning, HRU). This tool scores each model against your specific requirements.
Cross-reference controls between NIST CSF 2.0, CIS Controls, ISO 27001, and SOC 2
Create risk matrices and calculate risk scores. Prioritize risks by likelihood and impact. Free privacy-first risk assessment tool.
Design comprehensive data classification policies with government (TS/S/C/U) or commercial (Restricted/Confidential/Internal/Public) schemas. Define handling rules for storage, transmission, disposal, and access with compliance overlays for HIPAA, PCI-DSS, GDPR, and CMMC.