CCT 278: Security Models Demystified - CISSP Domain 3.2
Sep 08, 2025Check us out at: https://www.cisspcybertraining.com/
Get access to 360 FREE CISSP Questions: https://www.cisspcybertraining.com/offers/dzHKVcDB/checkout
Get access to my FREE CISSP Self-Study Essentials Videos: https://www.cisspcybertraining.com/offers/KzBKKouv
Security models can be one of the most challenging concepts for CISSP candidates to grasp, yet they form the bedrock of how we implement and understand security controls. In this comprehensive episode, we break down Domain 3.2's security models in plain, accessible language with real-world examples that will finally make these abstract concepts click.
We start with an analysis of the recent TransUnion data breach affecting 4.4 million individuals, using it as a practical reminder of why proper security architecture matters. This breach, occurring through a third-party application, perfectly illustrates the dangers when security models aren't properly implemented.
The episode then demystifies the Trusted Computing Base (TCB), explaining its role as the foundation of creating secure code. We explore key components including the Security Kernel, Reference Monitor, Trusted Path, and TCB Boundary, translating these complex concepts into understandable terms.
The heart of the episode focuses on the "Big Eight" security models you need to know for the CISSP exam. From Bell-LaPadula's "no read up, no write down" confidentiality focus to Biba's integrity-centered approach, we provide clear explanations and memorable scenarios for each model. You'll learn how Clark-Wilson enforces business integrity through separation of duties, how Brewer-Nash prevents conflicts of interest, and how the remaining models address specific security concerns.
Rather than simply memorizing names and concepts, this episode gives you a framework for understanding each model's purpose, category (confidentiality, integrity, information flow, or access), and practical application. We conclude with exam preparation tips, highlighting which models deserve the most attention during your studies.
Whether you're preparing for the CISSP exam or simply want to deepen your cybersecurity knowledge, this episode transforms abstract security models into practical tools you can apply to real-world security challenges. Visit CISSPCyberTraining.com for free questions and additional resources to support your certification journey.
TRANSCRIPT
Speaker 1:
Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time. Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast. Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge. Alright, let's get started. Let's go. Cybersecurity knowledge.
Speaker 2:
All right, let's get started, hey y'all, sean Gerber, with CISSP Cyber Training and hope you all are having a beautifully blessed day today. Today is CISSP Training Monday and we are going to be going over some amazing parts around Domain 3.2. And this is the fundamentals of the Biba. I can never say these names. I'm just going to tell you right now Biba StarModel, bella Pula Pula Bula. I can never say these names, I'm just going to tell you right now Biba Star Model, bella Pula Pula Bula, the different security models that are related to Domain 3.2. So we're going to get into some of those, along with the end of it, some exam tips to how to be better prepared for this, because this is probably one of those that trip up a lot of people because they're just a bunch of guys' names and they don't really make a whole lot of sense. But we'll try to break that down into a way that makes a little bit more sense to you and give you kind of maybe a little bit of a training aid to help you get ready for the cissp exam. But before we do had a really quick article I wanted to bring up to your attention, like we do every single episode. So this is the transunion data breach that occurred in july and this is approximately 4.4 million people were affected by this breach. So the interesting part is actually 4,461,511. Okay, that's very specific, but those are the people that were affected by this breach that occurred on July 28, 2025.
Speaker 2:
Now, this was not done via their own systems per TransUnion. This was done through a third party application. Oh, no, heaven forbid a third party once again. Yes, we all talk about that and there's actually an article I read as well today that in Sweden, I think, there's a big ransomware attack that occurred in Sweden due to third parties not properly securing their connections. So, yes, it is happening through third parties. And why is this the big factor? Well, because these guys and gals know that if they go after the third parties, that will cause massive disruption and can cause all kinds of drama. This was done through. Things that were lost were names, security numbers and dates of birth. Again, if you haven't froze your credit by now, shame on you. You need to go freeze it if you're here in the United States, specifically because, yeah, you're always getting breached one way or another, and if they can go ahead and attack TransUnion and get access to names, social security numbers and date of birth. They've got your stuff. They probably have it multiple times and, yeah, if you're not freezing your credit, you are really setting yourself up for some sort of disaster.
Speaker 2:
The attack appears to be a broader one from the Salesforce related breaches that have occurred, and I saw another one from Salesforce that might have affected Gmail as well. This is the threat group called Shiny Hunters, believed to be responsible specifically for this exploit as well. So TransUnion has come out and said that they're working with law enforcement, le and the cybersecurity experts to investigate and contain the breach. Obviously, they offered you the 24 months of free credit reporting and monitoring assistance. Yes, that is always what they offer and it's kind of like a placebo. It's, after the fact, freeze your credit and then that isn't necessarily a big factor and also use multi-factor on any sort of banking transactions you may have.
Speaker 2:
Again, they, a transunion, will urges vigilance against phishing and unsolicited requests and verifies communications by contacting source directly, kind of. All the stuff we talk about in the security training world is that you need to contact the source directly if somebody rings or pings you outside of normal channels. Basically, if they're asking something from you, do not do it. You reach out to them on the first set of it. That's a good thing. If they're reaching out to you, someone's trying to just say, hey, you've been compromised, click this link. Don't do it. You guys know this, I know you do, but don't do it. They also throw out the obligatory. Make sure you have other security tools in place, such as antivirus tools, vpn, secure browsers and the like. Yes, so don't really know other than to say it's another one of those things that just occurred. You need to plan for it and make sure you embrace and talk to your people about this. Make sure that you involve them in this overall plan. I I would give them some, maybe even one pager sending that out saying that you may be getting something from TransUnion, but don't click on links. Just go ahead and TransUnion will reach out to you and, if they haven't already, and explain the situation. So again, make sure that you have a good plan prepared for your people and that you are also freezing your credit as well. All right, so let's move on to what we're going to talk about today.
Speaker 2:
Okay, so this is domain 3.2, understanding the fundamental concepts of security models. These are the various models and we're going to get into those. There's basically eight big models that we'll go through, but there are some additional ones that may get called out in the CISSP, and so we'll just kind of go through those as well in today's lesson. All right, so here's an overview of what we're going to kind of get into. The security models are for a designer's map, basically to create a security policy to development from beginning to end. The security policies are typically non-prescriptive. Right Models will help, they will help bind all that together, and the models must support the overall security policy that you have come in place. These are very similar to a framework, but their ultimate point is to provide guidance. They don't necessarily aren't very prescriptive, but they're to provide some high-level guidance around what you should potentially do.
Speaker 2:
Okay, so this is the trusted computing base. We're going to get into that. This is the foundation of creating secure code, and the trusted computing base is a basis of what you do coding, and if you don't have a good trusted computing base, you have all kinds of drama that we'll talk about. So this includes the operating system and the associated security mechanisms that are tied to this. This means your hardware, your physical locations, hard network, your software, all of those different types of activities are all tied into and need to be part of your trusted computing base. Now, in this the provisions will be of the following access authorization to resources, user authentication and your overall backup of data. Those are some specific provisions that are set within the TCB.
Speaker 2:
Now the total combination of hardware, software and firmware that enforces security policy is the TCB and it is trusted to enforce the CIA triad. It's your confidentiality, integrity and availability. Anything outside of the TCB is not trusted and therefore security mechanisms must be in place and it is not trusted to be enforced any level of security for your operating system. So you'll hear the use of the trusted computing base a lot, especially when you're dealing with various levels of development activities. Now the TCB came up by a gentleman by the name of John Rushby. He defined the TCB as a combination of kernel and trusted processes. So when we talk about the kernel, that is the hardware aspects that you'll deal with your system and that is down to the kernel level processes, software. These are trusted processes that are layered on top. Now the TCP, the TCB, is very small in size and it basically works together to form a trusted base between the software, the hardware aspects of the, the kernel and the software aspects to enforce the security policy, between the two.
Speaker 2:
Now there is a book series and that's not like Nancy Drew or any see, I just dated myself or any other book series could be Harry Potter. It's part of what they call the Rainbow Series and this defines TCB. There's different books there's orange, there's red and so forth, and these different books are defining this type of activity. Now the orange book defines specifically the TCB and the total protection of mechanisms within it, including hardware, firmware and software, and the combination of which is responsible for enforcing the overall computer security policy. This is what the Orange Book does and it defines the TCB as well. Now the Orange Book defines the boundaries of the TCP, depending significantly on the definition of the overall security policy that is in place. So again, this is stuff that is a little. You're not going to have an Orange Book in your environment, but it's defining the different types of policies or the different types of what a TCB should be, so that if you and the manufacturers of these systems and of the software will use this as a reference. So it's not typically something you deal with, but it's something that the developers will deal with that are making a software and or hardware.
Speaker 2:
So as an example, we'll bring out here a web server. This is a multi-user application maybe is created for this web server and it's not part of the operating system's TCB. So this provides access controls to prevent individuals from usurping others' rights, and a breach of the application does not constitute a breach of the operating system's TCB. So, realistically, you have a web server and the web server has an application on it. The operating system is running right, but there's multi-user applications that are going back and forth utilizing this. But if it's just accessing the system itself, it's providing the access controls to prevent individuals that are set up in the web server from usurping the other's rights. Now this, if someone were to breach that, it would not breach the operating systems TCB. That's the whole point of it. The breach of the application does not constitute the breach of the operating systems TCB. So they're separate. Right, if you have your operating system operating doing what it's doing, but if you have an application that has user activity, if someone breaches the user activity, it does not necessarily breach the trusted computing base of the operating system, because those two are separate.
Speaker 2:
Tcb software protection. This is where the orange book speaks of TCBs need to protect against tampering. So your trusted computing base must prevent its own software from being written to. What that basically means is that you have as a trusting computing base of that operating system. It must prevent that its software from being written to by outside entities. They cannot just go in and start making changes. A good example is Microsoft. Microsoft does not allow you to go in and make changes to its overall fundamental foundational code, and so therefore you can have users that are operating in and out of the applications that are tied to microsoft, but you as an individual are not allowed to actually access the operating systems code to, to make, make any changes to it or manipulate it. Same concept with the hardware and the kernel you are not allowed to make changes to the kernel level code. Now there are Issues that come up. Right, we know of vulnerabilities that pop up where individuals can access the kernel in certain situations and then those are then patched. But the TCB, the trusted computer base, is saying that it cannot be written to and it needs to be defined so that your operating systems that are created within your environment cannot be written on the fundamental code that's created Now a memory management unit or an MMU, will also add protections to this as well, and we'll get into that a little bit later on.
Speaker 2:
Now, programmable by the operating system, this allows or defines access to a specific range of systems or memory that can be run. There is a supervisor mode in some of these cases, within the operating system, which will allow or restrict the access that can be managed to this memory. So, really, what it comes down to is, if you have the ability within the operating system to go in and make specific changes to memory and there are specific ranges in which you can do this, you may have to run this in what they call the supervisor mode. This is not. Again, this is very restrictive. This is not allowing people to just go in and make changes to it. You, as a cybersecurity person, need to be aware of this Not that you're going to be going and making any of these changes, but if you have a software development team within your environment, they need to be aware of what is the TCB. They also need to be aware of the basics around that their application should never touch the operating system's core, foundational code. However, knowing and understanding where all these buckets lie is an important part with any software development company to ensure that they are putting in place the proper protections and that they're not trying to go beyond the boundaries of what is actually expected.
Speaker 2:
So now we're getting to some other key components. Security kernel Now this is the core of the TCB and it's usually a very small portion of the operating system. This enforces reference monitor functions basically from a complete mediation, isolation and verifiability. This is a point that is very tight. It's a very small subset of development code and it is working in conjunction with the operating system and the hardware. What makes it? Marries those two together. Marries is not the right word, it's marry yeah, better word Brings them together. Cohesive, big $10 words mess me up. I need like thing plus thing equals two. That didn't even make sense either. But bottom line is you bring the both of them together.
Speaker 2:
Reference monitor this is kind of an abstract concept. A lot of this is abstract. Let's just kind of be blunt here. Basically, it needs a security kernel and it's for it to be implemented and it ensures that all access requests are checked against the security policy. That's what a reference monitor will do.
Speaker 2:
Trusted path this is a secure communication channel between the user and the tcb. So an example of this would be control, alt, delete in a windows screen. That would be your login, that's your secure communication channel between the user and the trusted computing base. The testing the tcb boundary is a logical fence around all trusted components. Everything within the boundary must be examined, tested, tested and verified. So these are some key terms that you may hear about the security kernel, the reference monitor, trusted path or TCB boundary.
Speaker 2:
Now some characteristics of the TCB it is smaller is better, right. The smaller the TCB, the easier it is to secure, test and verify. So you want to keep it as tight as you possibly can. It must be protected, it must be isolated from untrusted processes. It should be testable, which is verifiable via the formal methods, by using a rigorous testing method, and it should be essentially enforced so that basically all critical decisions pass through the TCB. So those are important parts of anything that goes on within a system.
Speaker 2:
So some concepts that may come up related to the exam or some different terms is you have trusted platform module. This is a hardware chip that supports trusted boot and attestation. So you're going to hear about TPM in various other parts of the CISSP, cyber training, but the TPM is basically a chip that's put on the system and it is used to support a trusted boot and it's designed to keep all the processes without any sort of injection of code. It's not the same as the TCB but conceptually they are related. Okay so, the TPM, the TCB, they're similar, like-minded things.
Speaker 2:
Assurance versus functionality the TCB will provide functions, but assurance comes from providing the trusted computing base works as intended. So you have insurance versus functionality. Tcb provides functions, provides functionality, but there is an assurance that what it does and what's in place is actually going to work as intended. Okay, so a concept you need to understand for the exam, or something that may give you a little bit of a hint, is if you see that all the protection mechanisms of a system, air quotes or hardware, software, firmware enforcing the security policy, the answer will be TCB. Okay so all protection mechanisms that would be everything is the TCB. Or if there's hardware, software, firmware, that again, all three of those that are enforcing the security policy, then the answer would be associated with the TCB. So just keep that in mind.
Speaker 2:
Now, reference monitors and security kernels. A reference monitor is access to every resource. It sits between the object and the user and this is the gatekeeper allowing for access to the object. This enforces your discretionary access control module, your mandatory access controls, role-based accesses and other forms that are tied to it. So it's the reference monitor. It has access to every resource within the operating system, within the system itself. The security kernels. They act as appropriate references for the reference monitor. This is a trusted component that allows communication between the subjects and it mediates any access requirements or rules. It's basically considered what they call a trusted advisor, right? So it's the security kernel.
Speaker 2:
Now some other key points to think about. We're going to get into the models now. Now the models. You have your state machine model, information flow model and non-interference model. Your state machine model this is a secure state machine which basically boots into and maintains a secure state. You have your information flow model, which prevents unauthorized information flow between levels of security, and we'll get into all of these here when we start getting into the various models that are out there. And then you have your non-interference model. This is based on informational flow model and is designed to avoid data leakage and programs such as Trojans. That's the ultimate point of a non-interference model.
Speaker 2:
Okay, so these are the big eight security models that you can see in the CISSP core and if you're listening to this on the podcast, obviously you can go out to CISSP Cyber Training and get access to this as well. But this is a table broken down about all the different the main security model, eight main security models that you'll hear about on the CISSP exam, and the point of it is is that and we'll go I'm just quick, doing a quick shot of this, but we'll come back to it at the end as I go through all the various models and then you'll have this it's a really good reference tool to be able to look at and go. Okay, so the Bell LaPula BLP. Its category is specifically around confidentiality. It's got no read up, no read down. It protects secrecy. It's based on the military and classified systems. This is a really good reference chart that will help you.
Speaker 2:
And it goes through all of them, from Bell, laputa, bibba, clark, wilson and so forth. But we'll come back over this again at the end, when we're done with these various models. Okay, so the big eight security models we'll start off with the bellaputa model, the belt, but I can't say that. Lapula, papula okay, you know what I mean. It's number one, it's the people's last name, so it's bell and lapula l-a-p-a-d-u-l-a. That's the model. Right, the bellaputa model okay, so it's got no read up, nru and no write down okay, that's the ultimate point of that model. And it's got no read up NRU and no write down Okay, that's the ultimate point of that model. And it's designed for military and DOD classified systems. The ultimate goal is to prevent an unauthorized disclosure of the information itself.
Speaker 2:
Now, this focuses around secrecy versus integrity, because it doesn't really care so much if the data gets corrupted, because it's all self-contained. So let's give you a scenario A military officer with a secret clearance cannot open a top secret file Yep, no read up. And cannot save a secret report to an unclassified system no, write down. But if he's secret, can he read down? Yes, he can, but he can't write down. He can't send anything lower. If he's a top secret person. Can he write down to a security? He can't write down at all, but he can read down the ultimate point. If you start doing right down to different aspects it can just cause all kinds of confusion. So it's designed around specifically around dod type systems.
Speaker 2:
The bibba model is. This focuses primarily on integrity. It's built on a state machine concept and is a multi-level model. It's designed to address three integrity issues one prevent the modification of objects by unauthorized subjects. Two prevent unauthorized modification of objects by authorized subjects. Or three, protect internal and external object consistency. So let's give you a scenario A junior accountant cannot modify the company's financial ledger no write-up, but it can read it.
Speaker 2:
Financial ledger no write up, but it can read it. Conversely, they cannot rely on unverified intern notes when preparing reports no read down. So the point of that is, again, this is based around the Biba model and it's focused on a multi-level model to ensure the consistency of or the integrity of those basic aspects. Right? So accountant can't modify the company's financial ledger, can't write up, because, again. So accountant can't modify the company's financial ledger, can't write up because, again, accountant, junior accountant, doesn't have the rights. But he can read it. You know, basically you can read the document itself. Conversely, they cannot rely on unverified intern notes when preparing reports. Obviously, no read down. So just a concept around the BIBA model, the Clark-Wilson model.
Speaker 2:
This enforces well-informed transactions through programs and requires a separation of duties. And we've talked about this a lot on CISSP, cyber Training. Especially in this aspect is separation of duties is an important part. The users will then have. It uses certified programs plus enforcement rules to help prevent fraud and enforce business integrity. So let's give you an example.
Speaker 2:
The bank teller enters a transaction into a banking system. So they go in, they make their modifications, they put it in the system. The transaction must go through a certified software. Okay, so a well-formed transaction. So it must go through a process in which it's going to do this. That could be software that's purchased, it could have a plan, basically an approval plan, built into it. But it is a certified software that's going to go in and then the supervisor must approve it, which is the separation of duties, and then that the supervisor approves, then it can happen. So then there's multiple people involved, not just one. That is the Clark-Wilson model, brewer and Nash model.
Speaker 2:
This access based on previous access history, so it prevents conflicts such as an analyst can't go in and access competitor data. It also has a dynamic access model allowing permissions that can change over time. It's very good in consulting legal financial sectors, et cetera, et cetera. So what's the scenario around that A consultant at PwC, pricewaterhousecoopers something like that can access the bank A's confidential financial records but then is blocked from seeing blank B's competitor data? Now this can get very squishy, especially when you're dealing with consultants especially. I've dealt with this right. But the bottom line is it's trying to have the separation between Bank A and Bank B. They can see they can access Bank A's confidential financial records, but it can't see Bank B's competitor data. So again, it's all looking based on access. The Gorgon Messinger See, that's even worse than the Laputa, it's G-O-G-U-E-N and then Messinger M-E-S-S-E-Q-U-E-R Messinger model.
Speaker 2:
So this is based on formal mathematical models for security. The subjects can't interfere with other subjects' operations. It prevents covert channels from occurring, and then the focus is around information flow security. Basically, here's a scenario A classified system user cannot cause their activity to alter or leak into unclassified systems. No signal is sent from top secret domain to an unclassified domain. So the ultimate goal then is that you can't go into and put information into unclassified systems. It's an information flow model and it keeps the information from leaving that specific area.
Speaker 2:
The Sutherland model focuses on system states and transitions. This prevents users from making inferences about secrets, and it's often used in databases. The ultimate goal is to stop indirect disclosure through observation, and I did this when I was a red teamer. We would look for observation all the time and try to discern different types of information disclosure through that. So, as an example, in a medical database, a doctor can see the aggregated statistics about patient illnesses, but cannot infer which patient individual patient potentially has HIV based on indirect patterns. So the goal, though, is to hide or mask some of that activity, and that is the Sutherland model, and again, that is focused around indirect disclosure through observation.
Speaker 2:
And now we're on seven and eight, graham-denning model. This provides eight primitive operations, such as create, delete, object subjects, grant, revoke. All those pieces are all tied to the Graham-Denning model, and it describes securely sharing, managing these specific rights, the models on how these rights are controlled in the specific system, and this is a framework for access control mechanisms. So, as an example, a file server enforces rules, such as admin creates a new user, the user grants read rights to a file, the system deletes an object. These are all different types of aspects tied to the Graham-Denning model and so it's all set up to be specifically around what it can do for securely sharing and managing the rights.
Speaker 2:
The Harrison-Russo-Ullman model, hru. It's an extension of the Graham-Denning model but its focus is around the air quotes safety problem. Can rights leak over time? And this uses access matrix plus specific rules, and it proves that some safety problems are undecidable. All right, so let's give you a scenario in an hr system, if user a grants user b air quotes delete rights, so giving them delete and user b later grants it to c. So then b goes thanks for the delete rights, I'm going to move that to c. The rights can eventually leak to unauthorized users. That is the question, right.
Speaker 2:
Hru analyzes this and makes that if that is decidable or not, can they just, can they that person do that? Can user b grant access to user c? And then user c could potentially be an unauthorized user. That's what they're asking. That's how the Harrison-Russell model, russell-ullman model works is if a person can move rights from one person and leak those rights over time to another person. They're asking is that decidable? Can you make the decision around that. Can you determine if that would occur?
Speaker 2:
That is the HRU model. Now those are the big eight security models and those are the ones that if you're going to see on the CISSP, those are the ones you're probably going to see Now. You may see some of these other ones that are coming up here in a minute, but highly it's more likely that you're going to see one of the big eight on the CISSP. So again, this is a graph that goes over the big eight, talks about each of the models of those and then it goes into the categories. So, such as Bell is confidentiality, biba is integrity, clark-wilson is integrity, brewer-nash is confidentiality, gogan is information flow, sutherland is information flow and Graham-Denning is access, as well as HRU is access. There's also a key exam principle you can want to think about on the right versus. That will kind of focus on each of those that you can study this at your leisure. But again, you can go to CISSP, cyber Training, and that'll be there and available for you. So let's go to the other models that are there Lippner model. So the Lippner model. This is, again, these are ones that you may or may not see. I have seen the Tate Grant model that's popped up at time to time At least people have talked about it. The Lipner model this focuses on basically combines the Bellaputa plus the Biba and its use case where you might see this is commercial environments where you need both confidentiality and integrity, not just the one. Okay, so when you want to consider it, look for the hybrid model. If you see it on the test, consider the hybrid model.
Speaker 2:
Lattice-based access controls. So this is LBAC, not like RBAC or any of those other ones. Lbac this assigns subjects and objects a label in a lattice structure, such as top secret, secret and confidential. This is where you're dealing with mandatory access controls and this really helps explain multi-level security and clearance levels. So if you're going to see this on the exam, multi-level security and clearance levels could be based on the latest lattice-based access control.
Speaker 2:
Next one is the TAKE slash GRANT model. Now, this model here defines how rights can be taken or granted to another subject. This is one that is not the last name of somebody of take or grant. It is actually you're taking it or you're granting it. This simplifies basically more dynamic access rights and it's often compared to the Graham-Denning or HRU models, but how rights can be taken or granted to another subject. The access control matrix this is a table of subjects versus objects, showing which subject has the right to which object. This is usually a foundational piece that is tied to most access control lists and capability lists. It's usually more of a stepping stone, it's not necessarily a primary model, but it's something they may talk about as the access control matrix. So, if you see it don't even I would really don't bite off on it as a model because it's not. It's more of just a concept in thought process.
Speaker 2:
The state machine model this focuses a system remains secure as it transitions from one state to another. A use case around this is a foundational for formal security proofs. Something to consider when you're looking at it from an exam standpoint is it ties into Sutherland and is generally part of the trusted computing base. The state machine model Again, focus is on secure as it transitions from one state to another. If they talk about states and going from one state to another, probably the state machine model. Okay, the last thing we have is some exam tips, some things for you to consider.
Speaker 2:
High priority that you might expect to see on the exam is the Bell, laputa, bibb, clark-wilson, brewer, nash. Those are ones that you might expect to see questions around. Some that may have questions is the Goggan, messinger, sutherland, graham denning and hru. So those between those right there I mean, if you look at a priority wise, bibba, bell, clark, wilson and brewer nash are probably the ones you may see something about. The rare but good to know is the lipner lattice base, take, grant, access, controls, matrix and state machine. Those are obviously the lower risk ones that you're going to see. But but if you're planning on anything, think of Bell, laputa, biba Clark-Wilson, brewer and Nash. If you don't have time and all you remember is those, your odds are better that you're going to probably run into one of those on the test than you will the Gogan, mussinger, sutherland, graham Denning and so forth. So again, that's the models. They can be very confusing, they can be very challenging. I highly recommend that you go to CISSP Cyber Training. Go check out the video that'll be out there, as well as also the table that I created related to each of the big eight models. Okay, I hope you guys have a wonderful, wonderful day.
Speaker 2:
Go out to CISSP Cyber Training, check it out, get some free stuff. That's there. I mean, there's tons of free stuff there. It's all free Go. All you got to do is just give me your email address. That's it, no more than that. That's all we're asking for.
Speaker 2:
Lots of free stuff, though I got all of my rapid reviews are going to be getting posted out there. You'll have access to all the rapid reviews. You have access to all of my questions. Everything is available to you at CISSP Cyber Training. If you need some more help, I have paid products that are out there as well. If you need these videos, it's all paid. You actually can get access to the videos and all the extra content that I have. So, again, lots of great stuff.
Speaker 2:
Go to CISSPCyberTrainingcom. Check it out. Lots of great stuff. All right, we'll talk to you later and we'll catch you on the flip side, see ya. Thanks so much for joining me today on my podcast. If you like what you heard, please leave a review on iTunes, as I would greatly appreciate your feedback. Also, check out my videos that are on YouTube and just head to my channel at CISSP Cyber Training and you will find a plethora, or a cornucopia, of content to help you pass the CISSP exam the first time. Lastly, head to CISSP Cyber Training and sign up for 360 free CISSP questions to help you in your CISSP journey. Thanks again for listening.
CISSP Cyber Training Academy Program!
Are you anĀ ambitiousĀ Cybersecurity or IT professionalĀ who wants to take yourĀ careerĀ to a wholeĀ new levelĀ by achieving the CISSP Certification?Ā
LetĀ CISSP Cyber TrainingĀ help you pass the CISSP Test theĀ first time!
