The Bell-LaPadula model is a formal security model built for the US Department of Defense to enforce confidentiality in systems handling multiple classification levels. It expresses access through two core rules: the simple security property, no read up, meaning a subject cannot read data above its clearance, and the star property, no write down, meaning a subject cannot write to a level below its own.
Its deliberate narrowness is the point candidates most often miss. Bell-LaPadula protects confidentiality and nothing else, so it says nothing about whether data is accurate or trustworthy. The Biba model is its mirror image for integrity, using no read down and no write up. On the exam the two are frequently contrasted, and confusing which direction each rule points is an easy way to lose a question that is really just testing careful reading.
How is Bell-LaPadula tested on the CISSP?
Bell-LaPadula belongs to Domain 3: Security Architecture and Engineering. Candidates should place it alongside Biba, Clark-Wilson, and Brewer-Nash and state precisely which security property each model is designed to enforce. A classic trap swaps the properties, describing no write down as an integrity rule, so read each option slowly.