Biba integrity model

The idea

The Biba model focuses on integrity rather than confidentiality. In the strict integrity formulation, a subject should not read data at a lower integrity level or write to a higher integrity level. The intent is to stop less trusted information from contaminating trusted decisions and records. Other Biba policies exist, so specify which version you mean when applying or discussing its rules.

In practice

An unverified external spreadsheet should not directly update the organization’s authoritative financial ledger. A controlled validation process is needed before trusted records change.

A common misunderstanding

Biba is not simply another classification secrecy model. Its levels describe trust in information or subjects, not who is allowed to know a secret.

Check your understanding

Why restrict writing up to a higher integrity level?

Think it through: A lower-integrity subject should not corrupt information that higher-trust processes depend on.

Integrity levels describe trust, not secrecy

A fictional laboratory has unverified sensor uploads, reviewed measurements, and an authoritative published dataset. The integrity concern is preventing a less trusted input from silently becoming an authoritative result. The same upload might be public to read while still unsuitable to drive a high-trust decision. Confidentiality and integrity labels answer different questions.

In a strict integrity example, the subject's permitted reads and writes constrain contamination across levels. This is a deliberately strong abstraction and may be impractical without additional controlled processes in a real workflow. Specify the chosen Biba policy rather than implying that every variant uses identical rules.

Validation does not magically make arbitrary data trustworthy. A practical promotion process needs defined checks, responsible authority, and evidence that the result meets the required quality. It may reject a record, request review, or accept a constrained transformation. The business meaning of trust should be explicit.

Trace a measurement into a trusted record

For a paper exercise, create dummy raw, reviewed, and published measurements. Identify the subjects that read or modify each level under the stated strict formulation. Then describe a separately controlled review process that the real organization would need to move accepted information into its authoritative dataset.

Ask what happens if a low-trust spreadsheet can overwrite a high-trust total directly. The failure is not that outsiders learned a secret; it is that an authoritative decision now depends on unverified modification. This distinction makes integrity models useful for thinking about imports, analytics, and business records. They clarify a goal, while actual systems still need workable validation, authorization, and operational controls to achieve it.

Keep exploring

• Bell–LaPadula model
• Clark–Wilson model
• The CIA triad