Skip to main content

Short note: information security model

Short answer

An information security model defines goals and rules for secure systems, centered on the CIA triad: confidentiality (encryption, access control), integrity (hashes, permissions), and availability (backups, redundancy). Additional goals include authentication, authorization, and non-repudiation. Formal models like Bell-LaPadula (confidentiality) and Biba (integrity) guide secure OS design. The security process involves policy, mechanisms, and assurance.

Write a short note on information security model.

An information security model describes the goals and rules that a secure system must satisfy. The basic model is the CIA triad.

  • Confidentiality: information is disclosed only to authorised users (protects against snooping). Achieved by encryption, access control.
  • Integrity: information is changed only by authorised users in authorised ways. Achieved by hashes, checksums, permissions.
  • Availability: the system and data are usable when needed (protects against DoS). Achieved by backups, redundancy, firewalls.

Additional goals: authentication, authorisation, non-repudiation and accountability.

        Confidentiality
            /\
           /  \
          /    \
  Integrity ---- Availability

Security process model

  1. Policy: what is allowed.
  2. Mechanism: tools that enforce the policy (authentication, ACL, encryption).
  3. Assurance: confidence that the mechanisms work properly (testing, auditing).

Examples of formal models

  • Bell-LaPadula: confidentiality; "no read up, no write down".
  • Biba: integrity; "no read down, no write up".

These models are used to design secure operating systems with different security levels (e.g. confidential, secret, top secret).

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Operating System chapter 8 questions →