CISSP Practice Question: A financial firm must prevent internal fraud by ensuring specific users cannot…

Correct Answer: D. Brewer-Nash

Explanation (CISSP Manager Logic):

The Brewer-Nash model, also known as the Chinese Wall model, is specifically designed to prevent conflicts of interest by dynamically changing access controls based on a user's previous actions. In a financial or consulting environment, it ensures that once a consultant accesses data from one company, they are barred from accessing data from a competitor within the same conflict-of-interest class.

By implementing this solution, you:

• Mitigate the risk of insider trading and industrial espionage.
• Automate the enforcement of ethical boundaries and regulatory compliance.
• Provide dynamic access control that adapts to real-time user activity.

While the other options are relevant, they fall short because:

• A. Bell-LaPadula: Focuses strictly on multi-level confidentiality (no read up, no write down) and does not address conflicts of interest.
• B. Biba: Focuses on data integrity (no read down, no write up) rather than horizontal access barriers between competitors.
• C. Clark-Wilson: Focuses on data integrity through well-formed transactions and separation of duties, but lacks the dynamic conflict-of-interest logic.

Think like a manager:

When managing access in complex environments with competing interests, look for the model that addresses the context of the data relationship rather than just the sensitivity level.