5.1.2. Identity and Access Management

AAA Framework:

• Authentication: Prove who you are (credentials, certificates, biometrics)
• Authorization: What you're allowed to do (permissions, roles)
• Accounting: Record what you did (audit logs)

Authentication Methods:

• Multi-factor (MFA): Combines two or more different factor types—something you know (password), have (token or authenticator app), are (biometric), or somewhere you are (location). A password plus a PIN is still single-factor
• Certificate-based: PKI certificates prove identity
• SSO (Single Sign-On): Authenticate once, access multiple systems
• LDAP: Directory service for centralized identity management

PAM (Privileged Access Management): Vaults administrative credentials and issues them on a check-out basis for a limited time (just-in-time access), with every use logged—shrinking the window in which privileged credentials can be misused and preserving individual accountability.

AAA Protocols:

• RADIUS: Remote Authentication Dial-In User Service—common for network access (UDP 1812/1813; encrypts only the password)
• TACACS+: Cisco protocol (TCP 49)—separates authentication, authorization, accounting; encrypts entire payload

Access Control Models (authorization):

Authorization Principles:

• Privilege creep: Access that accumulates as a user changes roles. It violates least privilege—revoke old-role access at every transfer, and run periodic access reviews to catch what was missed.
• Separation of duties: Split a critical task so no single person can complete it alone (the person who approves payments can't also issue them).