Essential Security Principles · Topic 4 of 5
Access Management, AAA, RADIUS, MFA and Passwords
Learn authentication, authorization and accounting, how RADIUS centralises access, multifactor authentication factors and a good password policy.
- 4 min
- AAA stands for authentication, authorization and accounting.
- Authentication proves who you are, and authorization decides what you can do.
- Accounting records activity for auditing.
What it is
Access management decides who can use a system, what they can do, and what they did.
The framework for this is AAA, which stands for authentication, authorization and accounting. Each A answers a different question about a user.
This page also covers RADIUS, which carries AAA requests to a central server, multifactor authentication, and the rules that make passwords harder to attack.
How it works
AAA happens in a fixed order, and each stage depends on the one before it.
The three A's
| Stage | Question it answers | Example |
|---|---|---|
| Authentication | Who are you? | Entering a username and password |
| Authorization | What are you allowed to do? | Read only access to one folder |
| Accounting | What did you do? | A log of logins and commands |
Authentication comes first, because the system must know who you are before it decides what you may do. Accounting then records the activity, which supports auditing and investigation.
A useful way to remember it is a visit to an office. The badge check at the door is authentication, the list of rooms your badge opens is authorization, and the visitor log is accounting.
RADIUS
RADIUS stands for Remote Authentication Dial In User Service. It is a protocol that lets network devices ask a central server to carry out AAA for them.
Without it, each switch, firewall or access point would hold its own list of users. With RADIUS, users are managed in one place, and the devices act as clients that forward the request.
Key points about RADIUS:
- it is a client and server protocol, and the network device is the RADIUS client
- it is widely used for wireless logins, VPN logins and network access control
- it combines authentication and authorization in one exchange
- it uses UDP
Cisco also uses TACACS+ for device administration, but RADIUS is the one named in the outline for this topic.
Authentication factors and MFA
An authentication factor is a category of proof. There are three classic categories.
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | A secret in your memory | Password, PIN |
| Something you have | An object you hold | Phone app code, hardware token, smart card |
| Something you are | A body trait | Fingerprint, face scan |
Multifactor authentication (MFA) needs proof from two or more different factors. A password plus a code from a phone app is MFA. A password plus a PIN is not, because both are things you know.
MFA protects an account even when a password is stolen, because the attacker also needs the second factor. It is one of the most effective single steps for reducing account takeover.
Password policies
A password policy is a set of rules that makes passwords harder to guess or reuse. Common elements are:
- a minimum length, since longer passwords are harder to crack
- a mix of character types, or a long passphrase
- no common words, names or easy patterns
- no reuse of old passwords
- a change after a suspected breach
- account lockout after repeated failed attempts, which slows guessing attacks
A password manager helps people use a unique strong password for each account. A common mistake is reusing one password everywhere, because one breach then exposes every account.
Passwords should be stored as hashes, not as readable text. The encryption page in this chapter explains hashing.
What to remember for the exam
Seven facts cover most questions on this topic.
- AAA stands for authentication, authorization and accounting.
- Authentication proves who you are, and authorization decides what you can do.
- Accounting records activity for auditing.
- RADIUS lets network devices send AAA requests to a central server.
- The three factors are something you know, have and are.
- MFA needs two or more different factors, not two of the same kind.
- Longer passwords, no reuse and account lockout make a password policy stronger.
To test whether something is MFA, count the factor categories. Two categories or more means MFA.
Common mistakes
These four errors are common.
Mixing up authentication and authorization. Logging in is authentication, and the permissions you receive afterwards are authorization.
Calling password plus PIN multifactor. Both are knowledge factors, so this is still one factor.
Forgetting accounting. Accounting is not about access decisions. It is the record that allows audits and investigations.
Assuming complexity beats length. A long passphrase is usually stronger than a short password full of symbols.
Do not share a one time code with anyone who asks for it by phone or message. Attackers use this trick to defeat MFA.
Check yourself
Work through these three questions.
Which AAA stage records what a user did?
Accounting. It keeps logs that support auditing and investigation.
Why is a password plus a PIN not multifactor authentication?
Both are something you know, so they are the same factor. MFA needs two or more different factors.
What does RADIUS let a network device do?
It lets the device send AAA requests to a central server, so users are managed in one place.
Topic 4 of 5 in Essential Security Principles
Test yourself on Essential Security Principles
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.