A breach at a government agency resulted in the public release of top secret information. The Chief Information Security Officer has tasked a group of security professionals to deploy a system which…

DAC is user-managed and cannot reliably enforce no read-up or no write-down because individual data owners can override permissions, making it unsuitable as the primary control for mandatory classification boundaries.

No write-up and no read-down are the Biba integrity model properties, not the Bell-LaPadula confidentiality properties needed to prevent top-secret data from leaking to lower classification levels.

MAC enforcing no read-up (the Simple Security Property) prevents subjects from reading data classified above their clearance level, while MAC enforcing no write-down (the Star Property) prevents subjects from copying top-secret data into lower-classified storage. These two rules together form the Bell-LaPadula model, the standard mandatory access control model designed specifically to preserve confidentiality in government classified environments. DAC is then used for discretionary access decisions within those mandatory boundaries.

DAC enforcing classification boundaries is insufficient because it allows the data owner to grant read or write permissions at their discretion, which is incompatible with mandatory government classification requirements.