Understanding authentication, authorization, and accounting

This chapter discusses how the security model was built using the three A's‐authentication, authorization, and accounting. In the realm of IT security, the AAA (Authentication, Authorization, and Accounting) acronym is a model for access control. Authentication is the process of identifying an individual, usually based on a user name and password. After a user is authenticated, the user can access network resources based on the user's authorization. Authorization is the process of giving individuals access to system objects based on their identity. Accounting, also known as auditing, is the process of keeping track of a user's activity while accessing the network resources, including the amount of time spent in the network, the services accessed while there, and the amount of data transferred during the session. Nonrepudiation prevents one party from denying actions they carry out. If proper authentication, authorization, and accounting have been established, a person cannot deny their own actions. Hackers will try to crack passwords by first trying obvious passwords, including the name of spouse or children, birthdays, keywords used by the user, hobbies of the user, and common passwords. Then hackers will try brute force attacks, which consist of trying as many combinations of characters as time and money permit. A subset of the brute force attack is the dictionary attack, in which all words in one or more dictionaries are tested. Lists of common passwords are also typically tested.