TechKnowSurge
NIST 800-53 IA-1 CompTIA Tech+ 6.4 Cisco CCNA 5.8 ISC2 CC 3.2 CompTIA Network+ 3.5 Cisco CCST Cybersecurity 2.5 CompTIA A+ Core 1 2.1
TechKnowSurge Catalog Videos IAM and Authentication, Authorization, Accounting (AAA)
VideoSecurityFree

IAM and Authentication, Authorization, Accounting (AAA)

Authentication, authorization, and accounting (AAA) is a security framework that controls who accesses a network, what they can access, and tracks what actions occur. Core protocols like RADIUS, TACACS+, and Diameter implement these functions across network infrastructure.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Authentication, authorization, and accounting (AAA) is a network security framework built around three core functions. Authentication confirms the identity of a user or device. Authorization determines which resources that identity is permitted to access. Accounting tracks and logs activity across the network, capturing events such as data access, configuration changes, document revisions, and browsing history. Together, these three functions provide a structured approach to controlling and monitoring access within a network environment. AAA is closely related to Identity and Access Management (IAM), and in practice the two terms are often used interchangeably. Both are frameworks used to evaluate and guide how organizations implement access controls. The distinction, where one exists, is largely a matter of scope and context. IAM functions as a broader umbrella concept, covering organizational policies and appearing in cloud service contexts such as AWS IAM. AAA is more specific to internal network infrastructure and is tied to concrete protocols and services designed for that environment. The three protocols most commonly associated with AAA are TACACS+, RADIUS, and Diameter. These protocols govern communication between network access devices, such as switches and wireless access points, and the backend authentication servers that process and verify requests. When a user or device attempts to connect to a network, one of these protocols carries the authentication exchange between the access point and the server. Understanding both AAA and IAM, along with the protocols that support AAA in practice, is essential for anyone working in network security or IT administration.

What you'll learn

What's covered

AAA Services

Aligned to

NIST 800-53
IA-1 Policy and Procedures
CompTIA Tech+
6.4 Compare and contrast authentication, authorization, accounting, and non-repudiation concepts
Cisco CCNA
5.8 Compare authentication, authorization, and accounting concepts
ISC2 CC
3.2 Understand logical access controls
CompTIA Network+
3.5 Compare and contrast network access and management methods
Cisco CCST Cybersecurity
2.5 Implement secure access technologies
CompTIA A+ Core 1
2.1 Compare and contrast Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports, protocols, and their purposes

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Authorization
The process of determining what actions or resources an authenticated user is permitted to access.
Identity and Access Management
IAM
A framework of policies and technologies that ensures the right users have appropriate access to resources.
Accounting
The tracking and logging of user activity, resource access, and system changes on a network for auditing and oversight purposes.
Authentication, Authorization, and Accounting
AAA
Authentication, Authorization, and Accounting is a security framework that controls network access by verifying user identity, determining permitted actions, and logging activity for auditing and billing purposes.
Terminal Access Controller Access-Control System Plus
TACACS+
A Cisco proprietary AAA protocol that encrypts the entire body of its messages and separates authentication, authorization, and accounting into independent functions, allowing granular control over each. TACACS+ uses TCP port 49 and is commonly used to authenticate administrator access to network devices.
Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Diameter
An AAA protocol designed as the successor to RADIUS, offering improved reliability, security, and support for modern network environments.

Topics

Iam Aaa Framework Radius Tacacs Plus Network Access Control Identity Management Cybersecurity

Transcript

What AAA Stands For

AAA stands for authentication, authorization and accounting. Authentication, as we've already discussed, just means proving who you are. Authorization is, what resources do I have access to? And the last A means accounting. Accounting just means that you're tracking what's happening on your network, what's changing on your network.

Some examples of this might be logs on a server that track what's happened on that server, data access logs of what data has been accessed, change logs if anything changes — a log of what changes on those systems — and document versioning, where when you make changes to a document it keeps the old changes and who has changed what elements of that document. You also have things like web browser history that tracks where you've gone on the web.

AAA and IAM

This is all sounding a lot like IAM, but maybe with the addition of the accounting piece. But not really, because if you look at the IAM model, the accounting piece is built into the access management side of it, as when you access something then it logs that information. So really the two are very similar. In fact, so much so that there are a lot of resources out there that really define it as the same thing. For the most part you could actually use these terms interchangeably, and it's not going to make that big of a difference; no one's going to call you out on it. They are both technically frameworks, and you can use them to measure up against your technologies to make sure that you're implementing them correctly.

There is a technical difference between these two. IAM is more of a general umbrella term, versus AAA speaks to certain technologies. IAM is like, I have IAM policies that I roll out for the companies that I work with to make sure that they're doing identity and access management correctly. It also can refer to specific services in cloud services, like there's AWS IAM services. Versus AAA is specific to the internal computer network, and there are some specific protocols that are defined around this AAA concept.

AAA Protocols

The three most common protocols and services that are associated with this are TACACS, RADIUS and Diameter. You would have some sort of services running on this bank of servers here that would be performing these functions and would be communicating with something like an access point or a switch via these protocols. So when a computer or device or user goes to authenticate, then it will use one of these protocols and services between the access point and the servers.

As you can see, there really is a lot of overlap between authentication, authorization and accounting and this term IAM. They are technically different, but because they're so closely related, a lot of times they're used interchangeably out there. You don't need to necessarily know the technical difference between the two, but you do need to be familiar with both of the concepts.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →