Abstract :
A method for evaluating security models is developed and applied to the model of Bell and LaPadula. The method shows the inadequacy of the Bell and LaPadula model, in particular, and the impossibility of any adequate definition of a secure system based solely on the notion of a secure state. The implications for the fruitfulness of seeking a global definition of a secure system and for the state of foundational research in computer security, in general, is discussed.
