2 cissp ® Official Study Guide Eighth Edition

Discretionary Security Protection (C1) 
A discretionary security protection system con-
trols access by user IDs and/or groups. Although there are some controls in place that 
limit object access, systems in this category provide only weak protection.
Controlled Access Protection (C2) 
Controlled access protection systems are stronger 
than C1 systems. Users must be identified individually to gain access to objects. C2 
systems must also enforce media cleansing. With media cleansing, any media that are 
reused by another user must first be thoroughly cleansed so that no remnant of the previ-
ous data remains available for inspection or use. Additionally, strict logon procedures 
must be enforced that restrict access for invalid or unauthorized users.

---

298
Chapter 8 
■
Principles of Security Models, Design, and Capabilities
Mandatory Protection (Categories B1, B2, B3) 
Mandatory protection systems provide 
more security controls than category C or D systems. More granularity of control is man-
dated, so security administrators can apply specifi c controls that allow only very limited 
sets of subject/object access. This category of systems is based on the Bell-LaPadula model. 
Mandatory access is based on security labels. 
Labeled Security (B1) 
In a labeled security system, each subject and each object has a 
security label. A B1 system grants access by matching up the subject and object labels 
and comparing their permission compatibility. B1 systems support suffi cient security to 
house classifi ed data. 
Structured Protection (B2) 
In addition to the requirement for security labels (as in 
B1 systems), B2 systems must ensure that no covert channels exist. Operator and administra-
tor functions are separated, and process isolation is maintained. B2 systems are suffi cient 
for classifi ed data that requires more security functionality than a B1 system can deliver.