Page 515 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Discretionary Protection (Categories C1, C2) Discretionary
protection systems provide basic access control. Systems in this

category do provide some security controls but are lacking in more
sophisticated and stringent controls that address specific needs for
secure systems. C1 and C2 systems provide basic controls and
complete documentation for system installation and configuration.

Discretionary Security Protection (C1) A discretionary

security protection system controls access by user IDs and/or
groups. Although there are some controls in place that limit object
access, systems in this category provide only weak protection.

Controlled Access Protection (C2) Controlled access
protection systems are stronger than C1 systems. Users must be
identified individually to gain access to objects. C2 systems must

also enforce media cleansing. With media cleansing, any media that
are reused by another user must first be thoroughly cleansed so that
no remnant of the previous data remains available for inspection or
use. Additionally, strict logon procedures must be enforced that
restrict access for invalid or unauthorized users.

Mandatory Protection (Categories B1, B2, B3) Mandatory

protection systems provide more security controls than category C or
D systems. More granularity of control is mandated, so security
administrators can apply specific controls that allow only very limited
sets of subject/object access. This category of systems is based on the
Bell-LaPadula model. Mandatory access is based on security labels.

Labeled Security (B1) In a labeled security system, each subject
and each object has a security label. A B1 system grants access by
matching up the subject and object labels and comparing their
permission compatibility. B1 systems support sufficient security to
house classified data.

Structured Protection (B2) In addition to the requirement for
security labels (as in B1 systems), B2 systems must ensure that no

covert channels exist. Operator and administrator functions are
separated, and process isolation is maintained. B2 systems are
sufficient for classified data that requires more security
functionality than a B1 system can deliver.