AAA Model

I've seen the AAA concept called a principle, a model, a framework, a technology — I've seen it called by many different things. Just know that really the principle, the model, the framework, there is differences between these terms, but for the most part there's a lot of overlap between them, and so calling it by these different names doesn't mean too much to a certain degree.

But I do want to stress that there is a little difference between AAA as a model and AAA protocols or technologies. What we have here is what really started out as some protocols that were used to implement AAA, but it became a good model, so we use it as a model as well. Commonly, when we refer to AAA, we're referring to both, but there could be times when we refer to it just as a model and times when we just refer to the technologies.

Why We Need Access Control

We talked about segmentation and how we want to segment our data into different files and folders and databases so that way it doesn't intermingle. Of course, if we don't have any access control over these, it doesn't really matter. That is, if Juan has access to sales but we don't have any access control, then they also have access to management and operations. So somehow we need to get some access control to allow a user to only have access to certain shares and certain resources.

Authentication, Authorization and Accounting

AAA stands for authentication, authorization and accounting. Authentication is really validating somebody and making sure they are who they claim they are — so it's verifying identity. Authorization is determining what level of access that they have. And then accounting is some sort of auditing or tracking or logging of that information.

When you see that first A, authentication, think of logging into a system. What do you have? You have some sort of username, some sort of ID that identifies who you are, and a password to make sure that you're not just identifying anybody, but you're identifying yourself. You have some sort of credentials to get into the system. This is authentication. It's authenticating you to make sure that you are who you say you are.

Authorization is what gives us access to certain resources. Now that they've identified who I am and verified who I am, what do I have access to? Maybe I have access to a server, maybe some keys, maybe some files. But when Juan accesses it or logs into it, he has access to maybe a database, maybe some different files, maybe some different resources on here. So we have different access levels. Authentication is authenticating who I am, and then authorization is what do I have access to.

Then there's the accounting piece. The accounting piece is that we are logging maybe some sort of transaction. So what is this user Jay Jones doing? Well, the resource they're accessing is the accounting database. What are they doing? They're just logging in. A Smith is accessing employee files and has deleted something. Maybe B. Norris has exec presentation, accessing that and doing an edit on it. So they're going through and accessing and deleting and adding, and we are recording those actions. So now what we can do is we can go back and audit to see if people are doing something that they shouldn't do.

This really plays into that segmentation. We use segmentation to split out our different regions, our different networks, our different files, our different resources. And then we use AAA to gain access to the resources that we need, or making sure that certain users have access to the resources that they need to carry out their job.

Other Models

Do realize that there are other models that are out there. For instance, IAM — identity and access management. You see these on a lot of services that are out there, and essentially it's the identity and the access. Not that you don't want to do accounting; it's just built into the access side of things.

The AAA for the CISSP adds also identification and auditing to this. These are some additional things that they'll add to it. So it really is built into the AAA — they just want to stress that there are some other components that you need to make sure that you think through in this process. So really it all is covered in these different models, but they're just different models that are used out there.

I think of IAM as being more from an infrastructure base. So when you're using something like AWS services, you're using IAM, and it's to really control the whole environment. When you think AAA, it's generally associated with networking. But since it's a model, it really can be applied to other areas and we can use it in other areas, though it really is heavily involved with networking and networking services and protocols. And then the CISSP, like I say, has added a couple elements just so you can make sure that you're thinking about all aspects of authorization and logging in and all of that.

The AAA Protocols

We mostly talked about the model, but I do want to briefly mention the protocols and why it's associated largely with networking. I don't want to get too in-depth into this, but a AAA protocol would be like when a machine is trying to access an access point, and the access point needs to communicate with a directory service. A directory service is going to be where it stores like your usernames and passwords and verifies who you are. Some services need to talk to that server and verify who you are.

In this example right here, it's an access point. So how is it going to talk to this server? It uses protocols like TACACS or RADIUS or Diameter to communicate with that server to understand and verify the username and password. So here's where the AAA protocol and services come into play: the protocol being that communication that happens back and forth, and the services being what's running on each side sending that information and receiving that information and doing the verification.

So we have these protocols and services, and like I say, from there developed this model, this AAA model, which we can apply to other areas, not just networking.