Cissp Security Models

Front 1

Bell-La Padula Model

Back 1

Explores the rules that would have to be in place if a subject is granted acertain level of clearance and a particular mode of access. (read down, write up)

Front 2

Biba model

Back 2

Lattice-based model with multiple levels like Bell-La Padula. Focuses on integrity. (read up, write down)

Front 3

Clark-Wilson model

Back 3

Uses 3-part relationship (subject/transaction/object). Subjects must use program/transaction to access objects.

Front 4

Brewer and Nash model

Back 4

This model focuses on preventing conflict of interest when a given subject has access to objects with sensitive information associated with two competing parties. (Chinese model)

Front 5

Graham-Denning model

Back 5

Primarily concerned with how subjects and objects are created, how subjectsare assigned rights or privileges, and how ownership of objects is managed.

Front 6

Zachman Framework

Back 6

A logical structure for identifying and organizing the descriptive representations (models) that are important in the management of enterprises and to the development of the systems, both automated and manual, that comprise them.

Front 7

TOGAF

Back 7

The Open Group Architecture Framework

An architecture content framework (ACF) to describe standard building blocks and components as well as numerous reference models.

Front 8

SABSA

Back 8

Sherwood Applied Business Security Architecture Framework

Holistic life cycle for developing security architecture that begins with assessing business requirements and subsequently creating a “chain of traceability” through the phases of strategy, concept, design, implementation, and metrics.

Front 9

Harrison-Ruzzo-Ullman model

Back 9

Composed of a set of generic rights and finite set of commands. Concerned with situations in which a subject should be restricted from gaining particular privileges.

Front 10

COBIT

Back 10

Control Objects for Information and Related Technology

Provides a set of generally accepted processes to assist in maximizing the benefits derived using information technology (IT) and developing appropriate IT governance.

Front 11

NIST SP 800-14

Back 11

“Generally Accepted Principles and Practices for Securing Information Technology Systems”

Provides a foundation upon which organizations can establish and review information technology security programs.

Front 12

ISO/IEC 21827:2008

Back 12

The Systems Security Engineering – Capability Maturity Model (SSE-CMM)

Describes the essential characteristics of an organization’s security engineering process that must exist to ensure good security engineering.

Front 13

ITIL

Back 13

IT Infrastructure Library

Defines the organizational structure and skill requirements of an IT organization as well as the set of operational procedures and practices that direct IT operations and infrastructure, including information security operations.