At 2:14 a.m., someone changed the direct-deposit account on a payroll record. The application log says the edit came from the account jdiaz, over the VPN, from an address in another country. Jamie Diaz says she was asleep. Whether the company can work out what really happened depends on decisions it made long before that night.
Those decisions fall under four ideas: authentication, authorization, accounting and non-repudiation. On the CompTIA Security+ SY0-801 exam they sit under objective 1.1, which expects you to explain the core concepts that every control is built on. This lesson covers the AAA model, how people and devices prove who they are, how access is granted and recorded, and what it takes to make an action impossible to deny.
AAA answers three questions in a fixed order
AAA stands for authentication, authorization and accounting. Each step answers one question, and each depends on the one before it.
Just before authentication comes identification: the claim of an identity. A username, an email address, a badge number or the name inside a device certificate is a claim. On its own it proves nothing, because anyone can type a username.
Here is the sequence when Jamie connects to the VPN on a normal day:
- Identification: she enters
jdiaz. - Authentication: she types her password and approves a push prompt on her phone, which proves the claim.
- Authorization: the VPN gateway applies the finance group's policy, which allows the payroll application but not the server management subnet.
- Accounting: the gateway records when the session started, where it came from, the internal address it was given, how much data moved and when it ended.
The order matters. An authorization decision is meaningless if the system doesn't know who it is authorizing, and an accounting record is only useful if the action is tied to an identity that was actually proven.
In many networks one central AAA server performs all three steps for VPNs, Wi-Fi and network equipment, so every device asks the same server instead of keeping its own user list. RADIUS, which uses UDP 1812 for authentication and 1813 for accounting, is the protocol you'll meet most often in that role.
Authentication proves a claimed identity with one or more factors
People authenticate with factors, which are categories of evidence:
- Something you know: a password, passphrase or PIN.
- Something you have: a hardware token, a smart card, or a phone running an authenticator app.
- Something you are: a fingerprint, face or other biometric.
Some systems also weigh where you are, such as country or network, and how you behave, such as typing rhythm, as extra signals. Multifactor authentication combines factors from different categories. A password plus a security question is still single-factor, because both are things you know. The specific MFA methods, passkeys and password policy are covered in the identity and access management section.
Behind every login is an identity store that holds the account and checks the evidence: Active Directory, an LDAP directory or a cloud identity provider. On Windows, the result shows up in the Security log as event 4624 for a successful logon and 4625 for a failure.
Authentication is only as strong as its weakest path. A company can require phishing-resistant MFA at login and still be beaten by a help desk that resets passwords for anyone who knows an employee's birthday. When you evaluate authentication, look at enrollment, password reset and account recovery as well as the login page.