Security · Topic 2 of 5
CIA, AAA, MFA and Identity Stores
Learn the CIA triad, how AAA works, what multifactor authentication adds, and how Active Directory stores user identities for a whole network.
- 4 min
- CIA stands for confidentiality, integrity and availability.
- Confidentiality is about keeping data private. Integrity is about keeping it correct. Availability is about keeping it accessible.
- AAA stands for authentication, authorization and accounting.
What it is
These are the basic ideas behind keeping systems and data safe, and controlling who may use them.
Four terms matter most.
- The CIA triad describes what security aims to protect.
- AAA describes how access is controlled.
- MFA makes signing in harder to fake.
- An identity store keeps the list of users.
You will meet these terms in every security topic, so learn them first.
How it works
The CIA triad sets the goals, and the other tools are ways to reach them.
The CIA triad
| Goal | Meaning | Example of protection |
|---|---|---|
| Confidentiality | Only authorised people can read the data | Encryption, access controls |
| Integrity | The data is accurate and has not been changed without permission | Hashes, change controls |
| Availability | Systems and data are there when needed | Backups, spare equipment, protection from attacks |
A single event can hit more than one goal. A stolen laptop with unprotected files harms confidentiality, and it also removes the files from the owner.
AAA
AAA stands for authentication, authorization and accounting.
| Part | Question it answers | Example |
|---|---|---|
| Authentication | Who are you? | Entering a username and password |
| Authorization | What are you allowed to do? | A normal user cannot change a router configuration |
| Accounting | What did you do? | A log of logins and commands |
The three steps happen in order. A user is first identified, then given the right level of access, and finally their actions are recorded.
Network devices often send AAA requests to a central server, using a protocol such as RADIUS or TACACS+. This way, accounts are managed in one place and not on every device.
Multifactor authentication
A factor is a kind of proof. There are three main kinds.
- Something you know, such as a password or PIN.
- Something you have, such as a phone app, a hardware token or a smart card.
- Something you are, such as a fingerprint or face.
Multifactor authentication, or MFA, needs proof from at least two different kinds. A password plus a code from a phone app is MFA. Two passwords are not, because both are something you know.
MFA helps because a stolen password alone is no longer enough.
Identity stores and Active Directory
An identity store, or directory, is a database of users, groups and their details, held in one place.
Active Directory is Microsoft's directory service. It is used in many organisations to manage the accounts of people and computers in a domain. A user signs in once with a domain account, and the server that holds the directory, called a domain controller, checks it.
Groups make it easy to give the same access to many users at once. When a person leaves, disabling one account removes their access everywhere.
What to remember for the exam
Seven facts cover most questions on this topic.
- CIA stands for confidentiality, integrity and availability.
- Confidentiality is about keeping data private. Integrity is about keeping it correct. Availability is about keeping it accessible.
- AAA stands for authentication, authorization and accounting.
- Authentication proves who you are. Authorization decides what you may do. Accounting records what you did.
- MFA uses at least two different kinds of factor.
- Active Directory is Microsoft's identity store, with accounts managed on domain controllers.
- A central identity store means one place to add or remove accounts.
Match the word to the question. Who are you is authentication, what may you do is authorization, and what did you do is accounting.
Common mistakes
These four errors appear again and again.
Mixing up authentication and authorization. Authentication proves identity. Authorization sets permissions.
Calling two passwords MFA. Both are the same factor, so it is not multifactor.
Forgetting availability. Security is also about keeping systems running, not only about secrecy.
Leaving old accounts active. Disable accounts when people leave.
A code sent in a message is better than a password alone, but any factor can be tricked. Never give a code to someone who asks for it.
Check yourself
Work through these three questions.
What do the letters in CIA stand for?
They stand for confidentiality, integrity and availability.
Which AAA function records what a user did?
Accounting records it.
Why is a password plus a code from a phone app multifactor?
The password is something you know and the app code is something you have, which are two different kinds of factor.
Topic 2 of 5 in Security
Test yourself on Security
The full Cisco CCST 100-150 Networking question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.