---
title: "Short note: information security model"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:info-security-model-note"
source: https://www.bctengineer.com/q/semester_6/operating_system/info-security-model-note
site: BCT Engineering
---

# Short note: information security model

Operating System · Chapter 8: Security

- Asked in: 2070 Magh, 4 marks
- Video: [CIA Triad: Confidentiality, Integrity & Availability | Cybersecurity](https://www.youtube.com/watch?v=PR96L-gCQd8) — Gate Smashers
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/info-security-model-note
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

Write a short note on information security model.

## Short answer

An information security model defines goals and rules for secure systems, centered on the CIA triad: confidentiality (encryption, access control), integrity (hashes, permissions), and availability (backups, redundancy). Additional goals include authentication, authorization, and non-repudiation. Formal models like Bell-LaPadula (confidentiality) and Biba (integrity) guide secure OS design. The security process involves policy, mechanisms, and assurance.

## Answer

An **information security model** describes the goals and rules that a secure system must satisfy. The basic model is the **CIA triad**.

- **Confidentiality:** information is disclosed only to authorised users (protects against snooping). Achieved by encryption, access control.
- **Integrity:** information is changed only by authorised users in authorised ways. Achieved by hashes, checksums, permissions.
- **Availability:** the system and data are usable when needed (protects against DoS). Achieved by backups, redundancy, firewalls.

Additional goals: authentication, authorisation, non-repudiation and accountability.

```text
        Confidentiality
            /\
           /  \
          /    \
  Integrity ---- Availability
```

#### Security process model
1. **Policy:** what is allowed.
2. **Mechanism:** tools that enforce the policy (authentication, ACL, encryption).
3. **Assurance:** confidence that the mechanisms work properly (testing, auditing).

#### Examples of formal models
- **Bell-LaPadula:** confidentiality; "no read up, no write down".
- **Biba:** integrity; "no read down, no write up".

These models are used to design secure operating systems with different security levels (e.g. confidential, secret, top secret).

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What do the CIA triad letters stand for?
   A. Control, Identity, Authorisation
   B. Confidentiality, Integrity, Availability
   C. Confidentiality, Identity, Access
   D. Cryptography, Integrity, Authentication
   Answer: B. They are the three basic security goals. (Key point: CIA)

2. Which goal does protecting against DoS serve?
   A. Confidentiality
   B. Integrity
   C. Availability
   D. Non-repudiation
   Answer: C. Backups, redundancy and firewalls help keep systems usable. (Key point: Availability)

3. What does Bell-LaPadula enforce?
   A. Integrity: no read down, no write up
   B. Availability: no write up
   C. Authentication: no read down
   D. Confidentiality: no read up, no write down
   Answer: D. Biba is the integrity model. (Key point: Bell-LaPadula)

4. In the process model what is 'assurance'?
   A. Confidence that mechanisms work properly (testing, auditing)
   B. The rules of what is allowed
   C. Tools like ACLs
   D. Passwords length rules
   Answer: A. Policy is what is allowed; mechanism enforces; assurance verifies. (Key point: Policy mechanism assurance)

## Related in other subjects

- [Threats, controls and security measures](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-threats-controls-measures) — Information System, chapter 2, asked 3×
- [IS security threats and safeguards](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-threats-controls) — Information System, chapter 2
- [Security audit and security protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-audit-role-protocols) — Information System, chapter 2
- [Process of developing IS security plan](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-plan) — Information System, chapter 2