Security concepts & principles
AAA (Authentication, Authorization, Accounting)
Overview
AAA is the access-control framework behind almost every login system — verifying who you are, what you're allowed to do, and recording what actually happened.
Key concepts
- Authentication vs. authorization vs. accounting
- Being authenticated doesn't mean being authorized
- MFA, RBAC, and logging as the practical tools
How it works
AAA stands for authentication, authorization, and accounting — an access-control framework that verifies identities, controls permissions, and records user activity.
| Component | Answers | Meaning |
|---|---|---|
| Authentication | "Who are you?" | Verifies the identity of a user, device, service, or application. |
| Authorization | "What are you allowed to do?" | Determines what an authenticated user is allowed to access or do. Being authenticated doesn't guarantee being authorized. |
| Accounting | "What did you do, when, and from where?" | Records user actions and system events for auditing, troubleshooting, incident response, and forensics. |
Common methods
| Component | Common methods |
|---|---|
| Authentication | Passwords, PINs, fingerprint scans, security keys, smart cards, authenticator apps. MFA combines two or more factor types. |
| Authorization | Role-based access control, access control lists, group permissions, least privilege. |
| Accounting | Logs of login attempts, IP addresses, files accessed, commands run, configuration changes, logout times. |
Putting AAA into practice
- Require strong passwords and MFA for accounts — especially admins, email, cloud platforms, and VPN access.
- Give users permissions based on job role, and remove access they no longer need.
- Apply least privilege so users get only the minimum permissions needed.
- Log successful and failed logins, privileged activity, file access, and configuration changes.
- Review user accounts regularly and disable ones that are no longer needed.
Worked example: signing into a VPN
A user signs in with a password and MFA code — that's authentication. The VPN checks whether the user belongs to the approved employee group — that's authorization. The VPN logs the account, device, IP address, connection time, and session duration — that's accounting.