Authentication, Authorization and Accounting (AAA)

What is AAA?

AAA stands for Authentication, Authorization and Accounting — a fundamental security framework used to control access to systems and resources and to keep a record of activity.

AAA is not a single product. It is a way of thinking about access control. A secure system needs to establish a user's identity, determine the permissions associated with that identity, and maintain useful records of what happened.

The three parts of AAA

These functions are closely related but they are not interchangeable. A person can successfully authenticate and still be denied access to a resource because they do not have the required authorization.

1. Authentication — Who are you?

Authentication is the process of verifying identity. Before a system can decide what someone is allowed to access, it needs confidence about who is making the request.

Common authentication methods include passwords, PINs, hardware security keys, authenticator applications, smart cards, certificates and biometrics.

Example: logging into a company laptop

You enter your username and password. The operating system checks the supplied credentials against an identity system. If they are valid, the system has authenticated you.

Authentication is used everywhere

• Logging into Windows or Linux
• Signing into an email account
• Accessing a VPN
• Connecting to a corporate Wi-Fi network
• Accessing cloud applications
• Connecting to network devices such as routers and switches
• Signing into a banking or shopping application

Authentication factors

Authentication becomes stronger when systems use different categories of evidence rather than relying on one secret.

Not every system uses every factor. The appropriate combination depends on risk, usability, cost and the sensitivity of the resource being protected.

Multi-Factor Authentication (MFA)

MFA requires two or more authentication factors from different categories. The goal is to reduce the damage caused when one authentication factor, such as a password, is compromised.

For example, a user may provide a password and then approve a sign-in with an authenticator application or use a hardware security key.

See also the PasswordGeeks guide to password managers for a broader look at password security and credential management.

2. Authorization — What are you allowed to do?

Authorization happens after identity has been established. It determines which resources an authenticated user, device or application can access and which actions it can perform.

Authorization decisions can be based on roles, groups, resource ownership, security policies, device status, location and other contextual information.

A simple example

Imagine three employees have authenticated into a company's file server:

• Employee: Can read files in their department's shared folder.
• Manager: Can read and modify department files.
• Administrator: Can manage accounts, permissions and system configuration.

All three users may successfully authenticate. Their different permissions are an authorization decision.

Common authorization and access-control models

Role-Based Access Control (RBAC)

Permissions are assigned to roles, and users receive those roles. For example, a help-desk role might be allowed to reset passwords but not modify firewall policies.

Attribute-Based Access Control (ABAC)

Access decisions can use attributes such as the user's department, device security state, resource classification, time or location.

Discretionary Access Control (DAC)

The owner of a resource can generally determine who can access it. File permissions on many operating systems provide familiar examples.

Mandatory Access Control (MAC)

Access is governed by centrally defined security labels and policies. Users cannot simply override the rules because they own the resource.

Least privilege

Regardless of the access-control model, a key security principle is least privilege: give an identity only the access required to perform its legitimate task.

3. Accounting — What did you do?

Accounting is the process of recording and tracking activity. In many modern security environments, this function overlaps with auditing and security logging.

Accounting data can help organizations understand who accessed a system, when a session occurred, what resources were used and what actions were performed.

Examples of accounting information

• Login and logout timestamps
• Source IP address
• Session duration
• Commands executed
• Resources accessed
• Files transferred
• Network or service usage
• Authentication failures
• Administrative changes

Audit Trail Example
File: images/aaa-accounting-audit-logs.png

Why accounting matters

Imagine an administrator account makes a major configuration change at 2:15 AM. Without useful logs, an investigator may have no reliable way to determine who made the change or what happened immediately before it.

With good accounting and centralized logging, analysts can correlate events and reconstruct a timeline. This is especially important for security monitoring and incident response.

How AAA works together

AAA is easiest to understand when you follow a complete access request from beginning to end.

Access Control Flow
File: images/aaa-access-control-flow.png

AAA in network security

AAA is particularly important in network environments where many users and administrators need controlled access to routers, switches, VPNs, wireless networks and other infrastructure.

Instead of storing a separate local username and password on every network device, an organization can use a centralized AAA service. Network devices communicate with that service when users attempt to authenticate.

Example: administrator access to a router

1. An administrator connects to the router.
2. The router asks for authentication credentials.
3. The credentials are checked against a centralized AAA service.
4. The administrator is assigned an appropriate authorization level.
5. The session and administrative activity can be recorded.

This centralized approach makes access control easier to manage and can provide better visibility than relying entirely on local accounts.

RADIUS vs TACACS+

Two important protocols you will encounter when learning network AAA are RADIUS and TACACS+.

These protocols are not interchangeable in every deployment. The appropriate choice depends on the type of access being controlled and the organization's architecture.

Common attacks against AAA systems

Because AAA protects access to valuable systems, attackers frequently target authentication and authorization mechanisms.

For a broader introduction to these threats, continue with the PasswordGeeks guide to Types of Cybersecurity Attacks.

AAA security best practices

• Use strong, unique passwords and passphrases.
• Enable MFA for important accounts whenever possible.
• Apply least privilege and avoid unnecessary administrator access.
• Use role-based permissions where appropriate.
• Remove or disable unused accounts.
• Review privileged accounts regularly.
• Centralize authentication and authorization where practical.
• Protect administrative interfaces with strong authentication.
• Collect and protect authentication and administrative logs.
• Monitor failed logins, unusual access and privilege changes.
• Synchronize system clocks so security events have reliable timestamps.
• Keep AAA servers and related infrastructure patched and securely configured.

Hands-on AAA practice

You can understand AAA much faster by seeing it in a controlled lab environment.

Lab 1 — Linux users and permissions

Create multiple test users and groups on a Linux virtual machine. Give each group different file permissions and observe the authorization differences.

Lab 2 — Investigate authentication logs

Generate successful and failed login attempts in a lab and inspect the relevant Linux or Windows logs. Identify usernames, timestamps, source information and results.

Lab 3 — Network device AAA

In a legal lab environment, explore centralized AAA concepts using a network simulator or virtual network infrastructure. Compare local authentication with centralized authentication.

Lab 4 — Connect AAA to SOC monitoring

Forward authentication and authorization events into a SIEM such as Splunk or Wazuh. Create a simple detection for repeated failed logins or an unusual privileged login.

Where AAA fits in your cybersecurity learning path

AAA should be learned early because identity and access control appear throughout cybersecurity.

If you are following the PasswordGeeks course, this lesson naturally connects the Networking for Cybersecurity fundamentals with later topics such as defensive security, SOC monitoring and incident response.

AAA FAQ

Related PasswordGeeks lessons