- [Instructor] Accounting is the process
of auditing and monitoring what a user does
once a specific resource is accessed.
This process is sometimes overlooked.
However, as a security professional,
it is important to be aware of accounting
and to advocate that it be implemented
because of the great help it provides
during detection and investigation
of cybersecurity breeches.
When accounting is implemented,
an audit trail log is created and stored
that details when the user has accessed the resource,
what the user did with that resource,
and when the user stopped using the resource.
Given the potential sensitive information included
in the auditing logs,
special care should be taken to protect them
from unauthorized access.
In RADIUS, the accounting exchange consists of two messages,
accounting-request and accounting-response.
Accounting can be used, for example,
to specify how long a user
has been connected to the network,
the start and stop of a session.
The RADIUS exchange is authenticated
by using a shared secret key
between the access server and the RADIUS server.
Only the user password information
in the access request is encrypted.
The rest of the packets are sent in plain text.
You can configure periodic RADIUS accounting packets
to allow the RADIUS server, such as Cisco ISE,
to track which sessions are still active on the network.
In the following example,
periodic updates are configured to be sent
whenever there is new information
as well as a periodic update
once every 24 hours.