Explain like I'm five · InfoSec

What are BLP and Biba?

The BLP and Biba access-control security models, told as a story about two rules that block climbing a rank ladder in opposite directions.

rank 3: the king's secret roomrank 2: the general's roomrank 1: the clerk's roomevery room in the castle carries its own secrecy rank

Every room in the castle carries its own secrecy rank.Under MAC (Mandatory Access Control), nobody can change a room's rank at will.

a low rank peeks at the king's secreta high rank writes the secret into a low ledgerpeeking up and writing down both leak the secret to lower ranks

With no rule for moving between ranks, the secret leaks.A low rank peeking up leaks the secret, and so does a high rank writing it down. Either way, the secret reaches lower ranks.

BLP — no leaking secretsno read upno write downconfidentiality — keeps secrets secretBiba — no corrupting the cleanno read downno write upintegrity — keeps clean records cleansame-shaped ladders, with mirror-image rules

BLP and Biba are two rules, paired as mirror images.BLP (1973) protects confidentiality; Biba (1977) protects integrity. The ladders look alike, but BLP ranks measure secrecy and Biba ranks measure trustworthiness.

BLP: no read upa low rank can't read a higher secret
BLP: no write downa high rank can't write into a low ledger
Biba: the exact mirrorno read down + no write up
Learn them as a pairexplain the difference by each rule's direction
modelrulewhat it protectsBLPno read upno write downconfidentialityBibano read downno write upintegritybothrules on same-shaped rank laddersMAC (mandatory access control)

Side by side, here are the four rules.BLP blocks a secret leaking downward; Biba blocks something untrustworthy creeping upward.

the strict BLP/Biba rules make everyday work awkwardso they're sometimes blended with role-based access (RBAC)BLP and Biba were born in military and classified systems — leading rule sets for MAC

Strict as they are, BLP and Biba are sometimes blended with other models.BLP and Biba are leading models that spell out MAC as concrete rules. Most company systems lean more on RBAC instead.

In one breath

BLP keeps a secret from leaking by letting nobody read up or write down the rank ladder; Biba mirrors it exactly, letting nobody read down or write up, to keep clean records clean.

Bell-LaPadula (BLP, 1973) is a confidentiality-focused MAC model enforcing No Read Up / No Write Down. Biba (1977) is an integrity-focused model enforcing No Read Down / No Write Up, so a lower-trust subject can never corrupt higher-ranked data. Biba's ranks are separate integrity levels, not secrecy levels. Both are leading formal models that spell out label-based Mandatory Access Control (MAC) as mathematical rules, originating in military and government classified systems.

When grown-ups say it

Bell-LaPadula
The rule that keeps a secret from leaking. No read up + no write down, protecting confidentiality.
Biba
The rule that keeps something untrustworthy from creeping in. No read down + no write up, protecting integrity.
No Read Up
A low rank can't read a higher secret. BLP's first rule.
No Write Down
A high rank can't write into a lower ledger. BLP's second rule.
No Read Down / No Write Up
Biba's mirror-image pair of rules. Blocks the opposite direction from BLP, to protect integrity instead.
Mandatory Access Control
The king's rank-list — not even the owner can override it. BLP/Biba are leading models that spell out MAC as concrete rules. → three ways to decide who holds the key
Confidentiality · Integrity
No peeking · no tampering. Two of the three legs of the CIA triad. → three things to keep
RBAC
The model real organizations lean on more than BLP/Biba. BLP/Biba are strict enough that they're sometimes blended with role-based rules. → a key ring for every hat
Next story
The State-Picked Seal-Shops, Now Joined by Many →
Want another term as a picture book? Request →