- AAA stands for authentication, authorization,
and accounting. Authentication is the process
of providing the identity of a subject or a user.
Once the subject has identified itself,
the enforcers has to validate the identity that is, y'know
to be sure that the subject,
or the user is the one that he claims to be.
This is done by requesting a subject, or a user to
provide something which is unique to the requester.
There are several authentication methods out there.
The first one is authentication by knowledge.
And that's something that the user knows, something
like a password or a PIN.
The next one is authentication by ownership,
which is something that the user owns.
An example of that is a smart card, or a batch, or a token.
And then authentication by characteristics.
And that's actually something that the user is,
or is not, right?
So that means things like, y'know, biometric, y'know,
authentication like fingerprinting, hand geometry,
the keystroke, or the dynamic keystroke
of the user and other, y'know, methodologies.
Now authorization is the process
of granting access to objects,
or a resource of, y'know, to a specific subject.
And this typically happens
after the subject has completed the
authentication, y'know, process.
An authorization policy
should implement two different concepts.
Implicit deny, and that means that if no rule is specified
for the transaction subject or, or for an object,
the authorization policies should deny the transaction.
And then, the second one is a need to know basis.
So they need to know is where a subject should be
granted access to an object only
if the access is needed to carry
out the job of that subject or that user.
Now accounting is the process of auditing and monitoring
what a user does once a specific resource is accessed.
This process is sometimes overlooked.
However, as a security professional it is important
to be aware and to advocate
that accounting is implemented due
to the great help that it provides during the detection
and investigation of cybersecurity breaches.
When accounting is implemented
an audit trail is created and stored
detailing when the user has accessed the resource,
what the user did whenever, y'know,
it was actually accessing that resource,
and when the user stopped using that resource.
Now, given the potential of sensitive information included
in audit logs, special care should be taken in
protecting them from unauthorized access.