Authentication, Authorization, Accounting and Identity Management

Chapter Overview

In today’s interconnected enterprise environments, merely securing the perimeter is insufficient. The true battleground often lies within — specifically in managing who can access what resources, when, and how. This chapter delves into the fundamental pillars of internal security control: Authentication, Authorization, and Accounting (AAA). These three services form the bedrock of robust access management, ensuring only verified individuals or devices gain entry, are permitted only necessary privileges, and have their actions meticulously recorded.

We’ll explore how modern networks extend traditional AAA through sophisticated platforms like Cisco Identity Services Engine (ISE). ISE centralizes policy enforcement, allowing dynamic control over network access based on contextual attributes — not just static credentials. This capability is critical for supporting diverse user populations, varying device types (including BYOD), and granular security policies that adapt to changing threats.

Mastering AAA and identity management is vital for any security professional. A well-implemented AAA strategy protects sensitive data, prevents unauthorized system modifications, ensures regulatory compliance, and significantly reduces the attack surface.

Core Concepts

Authentication (AuthN)

Authentication verifies a subject’s asserted identity — confirming a user or device is who or what it claims to be. Proof of identity typically involves:

• Something you know — password or PIN
• Something you have — smart card or token
• Something you are — fingerprint or facial scan

Strong authentication is the first line of defense against unauthorized access.

💡 Real-world Example: A user connecting to the corporate VPN enters their username and password, then inputs a one-time passcode from a mobile authenticator app. This combination verifies identity before any network resources become accessible.

Authorization (AuthZ)

Authorization determines what an authenticated subject is permitted to do or access. Once identity is verified, authorization applies specific policies and permissions — granting or denying access based on roles, groups, device posture, location, and other attributes. The principle of least privilege is paramount: subjects receive only the minimum access required for their legitimate functions.

💡 Real-world Example: An authenticated employee logs into the company portal. Based on their department, their authorization policy allows viewing sales reports and updating customer records, but prevents access to HR or financial databases.

Accounting (Acc)

Accounting tracks and logs a subject’s actions and resource consumption once authenticated and authorized. It provides an audit trail of “who did what, when, and from where” — crucial for security forensics, regulatory compliance, usage monitoring, and capacity planning.

💡 Real-world Example: A network administrator makes configuration changes to a core router. The accounting service logs their login time, specific commands executed, and logout time — creating a verifiable record for auditing and troubleshooting.

RADIUS (Remote Authentication Dial-In User Service)

RADIUS is an open standard, UDP-based protocol primarily used for centralized Authentication and Authorization for network access. It is widely adopted for wireless and wired network access (802.1X) and VPN connections, known for its combined authentication and authorization messages.

💡 Real-world Example: A laptop user connects to corporate Wi-Fi. The wireless access point (RADIUS client) forwards credentials to a central RADIUS server (Cisco ISE). The server authenticates the user and sends back an Access-Accept message with a specific VLAN assignment, granting network access.

TACACS+ (Terminal Access Controller Access-Control System Plus)

TACACS+ is a Cisco proprietary, TCP-based protocol providing separate and highly granular Authentication, Authorization, and Accounting services — particularly for device administration. Its key strength is command-level authorization, allowing administrators to define precisely which commands a user can execute on a network device.

💡 Real-world Example: A junior network engineer logs into a Cisco switch via SSH. TACACS+ authenticates their credentials and authorizes only view and diagnostic commands — not configuration changes or shutdown commands — ensuring controlled administrative access.

Cisco Identity Services Engine (ISE)

Cisco ISE is a powerful, centralized policy management platform that enforces secure access to network resources. It unifies identity and access control across wired, wireless, and VPN connections — offering guest access, BYOD onboarding, posture assessment, and advanced profiling. ISE acts as a central AAA server, integrating with identity stores and enforcing policies dynamically.

💡 Real-world Example: A personal laptop connects to the corporate network. Cisco ISE detects it’s a BYOD device, initiates a posture check for antivirus compliance, and if compliant, directs the user to a captive portal for self-registration before granting access to a BYOD VLAN with internet-only access.

802.1X (Port-Based Network Access Control)

802.1X is an IEEE standard for port-based network access control, preventing network access through a port until the connecting device or user is successfully authenticated by an authentication server (typically RADIUS). It requires three components: a supplicant (client), an authenticator (switch/AP), and an authentication server.

💡 Real-world Example: A new employee plugs their laptop into an office Ethernet port. The switch port, configured for 802.1X, doesn’t grant immediate network access. It directs the laptop to authenticate with ISE using a machine certificate. Only upon successful authentication is full network access granted.

Multifactor Authentication (MFA)

MFA requires a user to present two or more different types of credentials from distinct categories. Categories include knowledge (password), possession (phone or token), and inherence (fingerprint). MFA is now considered a baseline security requirement.

💡 Real-world Example: When accessing a cloud application, a user enters their username and password, then receives a push notification on their registered smartphone which they must approve — or they enter a time-based one-time password (TOTP) from an authenticator app.

Change of Authorization (CoA)

CoA is a RADIUS extension allowing an authentication server (like Cisco ISE) to dynamically modify an authorized session without requiring re-authentication. This enables real-time enforcement of policy changes — changing a device’s VLAN, applying a different ACL, or disconnecting a session.

💡 Real-world Example: A corporate laptop initially granted full network access is found to have outdated security patches. An endpoint detection system notifies Cisco ISE, which sends a CoA message to the switch. The switch immediately moves the laptop’s port into a quarantine VLAN, restricting access until patches are applied.

Real World Analogy

🎭 Imagine an exclusive nightclub. Authentication is the bouncer checking your ID at the door. Authorization is the manager deciding — based on your VIP status — whether you enter the general area, the VIP lounge, or the backstage. Accounting is the security camera system recording your entry time, which sections you visited, and when you left. Cisco ISE is the intelligent manager overseeing the entire operation, dynamically adapting policies — moving a misbehaving patron to a restricted area (CoA) or allowing a guest through a special entrance (WebAuth).

Chapter Recap

This chapter provided a comprehensive look at Authentication, Authorization, and Accounting — the bedrock of secure network access. RADIUS excels in network access scenarios like 802.1X, while TACACS+ provides granular control for device administration. Cisco ISE brings together diverse identity management capabilities including guest services, BYOD, posture assessment, and dynamic policy changes via CoA.

From initial identity verification through authorization and accounting, these services create a robust framework. Combined with MFA and adaptive access controls (802.1X, MAB, WebAuth), organizations ensure only legitimate users and devices access the right resources under the right conditions.

Key Exam Points

• RADIUS operates over UDP (ports 1812 for authentication/authorization, 1813 for accounting).
• TACACS+ operates over TCP port 49 and separates Authentication, Authorization, and Accounting into distinct services.
• TACACS+ offers granular command authorization; RADIUS provides limited command authorization.
• 802.1X requires three components: supplicant (client), authenticator (switch/AP), and authentication server (RADIUS).
• MAC Authentication Bypass (MAB) authenticates non-802.1X devices using their MAC address — less secure as MACs can be spoofed.
• Web Authentication (WebAuth) uses browser-based captive portal — commonly for guest access and BYOD onboarding.
• Cisco ISE distributed deployment nodes: Policy Administration Node (PAN), Policy Service Node (PSN), Monitoring and Troubleshooting (MnT).
• Change of Authorization (CoA) allows dynamic session updates (VLAN change, dACL push) from the AAA server to the Network Access Device.
• MFA requires two or more distinct authentication factors: something you know, something you have, something you are.
• The principle of least privilege must underpin all authorization policies.

Common Mistakes to Avoid

⚠️ RADIUS and TACACS+ are not interchangeable — RADIUS is best for network access (user/device authentication); TACACS+ is superior for administrative access to network devices due to granular command authorization and separate AAA services.

⚠️ 802.1X isn’t the only access control mechanism — While ideal for corporate endpoints, 802.1X isn’t suitable for legacy devices or guests. MAB and WebAuth provide crucial alternatives for non-802.1X capable or temporary access scenarios.

⚠️ Don’t neglect Accounting — Comprehensive accounting provides vital audit trails for compliance, forensic analysis, and troubleshooting. It’s often overlooked but critical for a complete security posture.

⚠️ Always apply least privilege in authorization — Granting users excessive permissions beyond their role significantly increases the attack surface and potential for insider threats.

⚠️ Passwords alone are a major vulnerability — MFA adds significant layers of defense against credential theft and unauthorized access. It is now a baseline security requirement, not an optional enhancement.