Understanding AAA: Authentication, Authorization, and Accounting

From Security Goals to Access Management

Before diving into the "three A's," let's connect them to the core security goals we discussed in our first lesson. The CIA triad (Confidentiality, Integrity, Availability) defines what we aim to protect. The AAA framework provides the mechanism for how we enforce that protection.

As the diagram shows, AAA is about enforcement:

• Authentication enforces security by verifying user identities.
• Authorization enforces it by controlling permissions.
• Accounting enforces it by logging activity for auditing and analysis.

Let's begin with a clear, high-level overview of this entire process from Professor Messer.

Now, let's break down each component in detail.

1. Authentication: "Who are you?"

Authentication is the process of verifying a claimed identity. When a user presents credentials, the system checks them against a database to prove they are who they say they are. This is the first gate in any secure access process.

For a comprehensive definition and examples of different authentication methods, please read the following sections from an article by CrowdSec.

As you read, it's important to realize that authentication isn't just for human users. Devices, services, and applications also need to be authenticated to ensure that only legitimate components are communicating on your network.

2. Authorization: "What are you allowed to do?"

Once a user's identity is authenticated, the system must determine their permissions. Authorization is the process of granting or denying specific permissions to an authenticated user based on their role or identity. This is where the Principle of Least Privilege is directly implemented.

An authenticated user does not automatically get access to everything. Authorization ensures they only have access to the resources required for their job.

The following text from the Cisco Community provides an excellent, practical example of authorization.

At a small scale, you could assign permissions to users individually. However, this quickly becomes unmanageable. In any real-world environment, authorization is handled through groups and roles, a concept known as Role-Based Access Control (RBAC).

Professor Messer provides a powerful visual explanation of why this group-based approach is essential for scalability.

3. Accounting: "What did you do?"

Accounting is the process of logging and tracking user actions. It answers the "what, when, and where" of a user's session. This function creates an audit trail that is indispensable for security analysis, troubleshooting, and compliance.

For a SOC Analyst, accounting logs are the lifeblood of an investigation. They provide the evidence needed to reconstruct an attacker's steps, identify a policy violation, or simply understand normal system behavior.

The "Learn with Cisco" video provides another excellent way to think about this third 'A'—as auditing.

The AAA Process in Action

Now let's see how these three distinct services work together in a typical network interaction. The following diagram shows a user trying to access a Cisco router that uses a central AAA server for access control.

Let's trace the steps:

1. Authentication: The user provides credentials (user1/cisco123) to the router. The router forwards this to the AAA server, which verifies the credentials and sends back a "Login OK!" message. The user is now authenticated.
2. Authorization: The user types a command (show version). The router asks the AAA server, "Allow 'show version' command?". The server, knowing the user's role, approves the request. The user is authorized to run this command.
3. Authorization (Denial): The user then types a more sensitive command (show run). The router again asks the AAA server for permission. This time, the server denies the request based on the user's privileges. The command is denied.
4. Accounting (Implied): Throughout this entire session, every action—the successful login, the allowed command, the denied command—is sent to the AAA server to be logged. This creates the audit trail.

This simple flow perfectly illustrates the separation of concerns: proving who you are (Authentication), checking what you can do (Authorization), and recording what you did (Accounting).

Conclusion

In this lesson, you have dissected the AAA framework and seen how its three components work in concert to enforce access control policies. Understanding this distinction is fundamental to nearly all aspects of operational security.

Here are the key takeaways:

• Authentication is the process of verifying a user's identity. It asks, "Who are you?".
• Authorization is the process of granting or denying permissions based on that verified identity. It asks, "What are you allowed to do?".
• Accounting is the process of logging user activity for auditing and security analysis. It records, "What did you do?".
• The AAA framework is the practical implementation of access control principles like the Principle of Least Privilege, often using Role-Based Access Control (RBAC) for scalable management.

What's Next?

We've now established a solid foundation for understanding security goals (CIA), security strategies (DiD, POLP), and the access control framework that enforces them (AAA). We understand the "good guys" and the rules they follow. In the next lesson, we will shift our focus to the adversaries. We will explore the world of threat actors, classifying them by their motivations, capabilities, and the common tactics they employ to bypass the very controls we've been discussing.