TechKnowSurge
NIST 800-53 IA-2 NIST 800-53 AC-3 NIST 800-53 AU-2 CompTIA Security+ 4.6 NIST NICE K0742 NIST NICE K0686 ISC2 CISSP 5.2 CompTIA SecurityX 2.1
TechKnowSurge Catalog Videos Authentication, Authorization, and Accounting (AAA)
VideoSecurityFree

Authentication, Authorization, and Accounting (AAA)

AAA (Authentication, Authorization, and Accounting) is a core security framework that controls who accesses a network, what they can access, and tracks all activity. This content also covers how AAA relates to IAM and introduces the key protocols used to implement it, including TACACS+, RADIUS, and Diameter.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

AAA — Authentication, Authorization, and Accounting — is a foundational framework in network security that governs how users and devices gain access to resources and how that access is monitored. Authentication is the process of verifying identity, authorization defines the scope of access granted to a verified user, and accounting captures a record of activity including server logs, data access records, change logs, document versioning, and browsing history. Together, these three components provide a structured approach to securing and auditing network environments. AAA is implemented through specific protocols, most commonly TACACS+, RADIUS, and Diameter, which handle communication between network access points — such as switches and wireless access points — and the backend servers responsible for enforcing access decisions. AAA and IAM are closely related and are frequently treated as interchangeable in practice. The meaningful distinction is that IAM is a broader umbrella concept that encompasses organizational policy and extends to cloud-based services such as AWS IAM, while AAA is more tightly scoped to internal network infrastructure and the protocols that operate within it. Both serve as useful frameworks for evaluating whether an organization's identity and access controls are properly implemented, and familiarity with both terms is essential for anyone working in IT or cybersecurity.

What you'll learn

What's covered

AAA Services Overview

Aligned to

NIST 800-53
IA-2 Identification and Authentication (Organizational Users)
AC-3 Access Enforcement
AU-2 Event Logging
CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
NIST NICE
K0742 Knowledge of identity and access management (IAM) principles and practices
K0686 Knowledge of authentication and authorization tools and techniques
ISC2 CISSP
5.2 Design identification and authentication strategy
CompTIA SecurityX
2.1 Given a scenario, analyze the security requirements and objectives to provide the appropriate authentication and authorization controls.

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Authorization
The process of determining what actions or resources an authenticated user is permitted to access.
Identity and Access Management
IAM
A framework of policies and technologies that ensures the right users have appropriate access to resources.
Accounting
The tracking and logging of user activity, resource access, and system changes on a network for auditing and oversight purposes.
Terminal Access Controller Access-Control System Plus
TACACS+
A Cisco proprietary AAA protocol that encrypts the entire body of its messages and separates authentication, authorization, and accounting into independent functions, allowing granular control over each. TACACS+ uses TCP port 49 and is commonly used to authenticate administrator access to network devices.
Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Diameter
An AAA protocol designed as the successor to RADIUS, offering improved reliability, security, and support for modern network environments.

Topics

Aaa Framework Authentication Authorization Access Control Tacacs Plus Radius Identity Management

Transcript

AAA stands for authentication, authorization and accounting. Authentication, as we've already discussed, just means proving who you are. Authorization is what resources do I have access to. And the last A means accounting, and accounting just means that you're tracking what's happening on your network, what's changing on your network.

Some examples of this might be:

  • Logs on a server that track what's happened on that server.
  • Data access logs of what data has been accessed.
  • Change logs — if anything changes, a log of what changes on those systems.
  • Document versioning, where when you make changes to a document it keeps the old changes and who has changed what elements of that document.
  • Web browser history, that tracks where you've gone on the web.

AAA versus IAM

This is all sounding a lot like IAM, but maybe with the addition of the accounting piece. But not really, because if you look at the IAM model, the accounting piece is built into the access management side of it: when you access something, then it logs that information.

So really the two are very similar, and in fact so much so that there are a lot of resources out there that really define it as the same thing. For the most part you could actually use these terms interchangeably and it's not going to make that big of a difference; no one's going to call you out on it. They are both technically frameworks, and you can use them to measure up against your technologies to make sure that you're implementing them correctly.

There is a technical difference between these two. IAM is more of a general umbrella term, versus AAA, which speaks to certain technologies. IAM is like, I have IAM policies that I roll out for the companies that I work with to make sure that they're doing identity and access management correctly. It also can refer to specific services in cloud services, like there's AWS IAM services. Versus AAA, which is specific to the internal computer network, and there are some specific protocols that are defined around this AAA concept.

The protocols

The three most common protocols and services that are associated with this are TACACS, RADIUS and Diameter. You would have some sort of services running on this bank of servers here that would be performing these functions and would be communicating with something like an access point or a switch via these protocols. Then when a computer or device or user goes to authenticate, it will, between the access point and the servers, use one of these protocols and services.

There really is a lot of overlap between authentication, authorization and accounting and this term IAM. They are technically different, but because they're so closely related, a lot of times they're used interchangeably out there. You don't necessarily need to know the technical difference between the two, but you do need to be familiar with both.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →