What Is Authentication Authorization and Accounting? Security Definition

Imagine you are going to a large office building that has many different rooms and floors. The first thing you must do when you arrive is prove who you are. You show your employee badge or scan your fingerprint at the front door. This step is authentication. It is the process of verifying that you are really who you say you are. The system checks your credentials against a database of known users. If your credentials match, the system says yes, you are a valid user.

Once you are inside the building, you cannot go everywhere. Some rooms are for managers only. Some floors require special clearance. The security system checks a list of permissions that are associated with your identity. For example, your badge might let you enter the main office and the break room, but not the server room or the CEO's office. This step is authorization. It decides what resources you can use and what actions you can perform, such as reading a file, printing a document, or installing software.

Finally, every time you enter a room or use a resource, the system records the event. It notes the time, the door you opened, and how long you stayed. This record is kept for later review, such as when an audit is done or when a security incident is investigated. This step is accounting. It creates a trail of activity that can be used to track usage, bill for services, or detect unusual behavior. In IT, the same three steps apply to users accessing networks, servers, applications, and cloud services. AAA is the foundation of security and access control in almost every modern system.

Authentication, Authorization, and Accounting, commonly abbreviated as AAA, is a security architecture framework that provides centralized access control, policy enforcement, and usage tracking for network devices, servers, and applications. It is most commonly implemented using the Remote Authentication Dial-In User Service (RADIUS) protocol or the Diameter protocol, though other protocols like TACACS+ (Terminal Access Controller Access-Control System Plus) and LDAP (Lightweight Directory Access Protocol) are also used in specific environments.

Authentication is the process of verifying the identity of a user, device, or service. It typically involves one or more factors: something you know (password or PIN), something you have (smart card or token), or something you are (biometric like fingerprint or iris scan). In enterprise networks, authentication is often handled by a centralized server that checks credentials against an identity store such as Active Directory, an LDAP directory, or a database of user accounts. Protocols like EAP (Extensible Authentication Protocol) are used to carry authentication messages between the client and the server.

Authorization follows successful authentication. It determines what resources and operations the authenticated entity is permitted to access. Authorization policies are defined by administrators and stored on the AAA server. For example, a user might be authorized to access the internet but not to administrative functions on a router. In RADIUS, authorization attributes are sent back to the network access server (NAS) in the form of vendor-specific attributes (VSAs) and standard attributes like service type, filter ID, and session timeout. These attributes enforce the allowed level of access.

Accounting is the collection and logging of session information. It tracks when a session starts, when it ends, the amount of data transferred, the duration of the session, and which resources were accessed. This data is stored centrally and can be used for billing, capacity planning, security auditing, and compliance reporting. RADIUS accounting packets are sent from the NAS to the RADIUS accounting server at the start and end of each session, as well as periodically during the session.

In real IT environments, AAA is used for a wide range of scenarios. Remote access VPN users authenticate to a corporate network through a RADIUS server. Wireless network access points use AAA to authenticate clients before granting them network access. Network device administrators authenticate to routers and switches using TACACS+ or RADIUS, which also authorizes specific command sets. Public cloud providers like AWS and Azure implement AAA through Identity and Access Management (IAM) services, which authenticate users, authorize actions via policies, and log all API calls via audit trails like CloudTrail.

AAA is a core security concept because it enforces three critical principles of information security: identification, access control, and accountability. Without authentication, anyone could claim to be anyone else, and an attacker could impersonate a legitimate user. Without authorization, once a user is authenticated, they would have unrestricted access to all systems, which could lead to data breaches or accidental damage. Without accounting, there would be no way to know who did what, when, and for how long, making it impossible to investigate security incidents or to enforce usage policies.

In practical IT work, AAA is used daily by system administrators, network engineers, and security professionals. For example, when a network engineer configures a router to use AAA for administrative access, they ensure that only authenticated users can log in, that each user has a specific privilege level, and that every command they type is logged. This is essential for compliance with regulations like PCI-DSS, HIPAA, and SOX, which require strict access controls and audit trails.

AAA also enables centralized management. Instead of configuring usernames and passwords on every device individually, an organization can maintain a single AAA server or directory service that all devices query. This simplifies user management, reduces errors, and allows for quick revocation of access when an employee leaves the company. In cloud environments, AAA is the foundation of IAM policies that control who can launch virtual machines, read databases, or delete storage buckets.

From a troubleshooting perspective, understanding AAA is crucial. If a user cannot access a network resource, the issue might be authentication failure (wrong credentials or account locked), authorization failure (user authenticated but not allowed to access), or an accounting problem (system not properly logging or tracking usage). Without a clear understanding of the three A's, diagnosing access issues becomes much harder.

AAA appears in exam questions in several distinct patterns. The most common is the definition or identification question. The exam presents a short description and asks you to choose the correct AAA component. For example, Which AAA component verifies the identity of a user? with answer options like Authentication, Authorization, Accounting, or Access Control. Another variation asks you to match actions to components, such as A user is granted permission to read a file matches Authorization.

Scenario questions are very common. A typical scenario might describe an employee using a badge to enter a building, then going to a restricted area where the badge is checked again, and finally the system records the entry time. The question asks which AAA components are illustrated in the scenario. You must identify that the first check is authentication, the second check is authorization, and the recording is accounting.

Configuration and troubleshooting questions appear more on Network+ and Security+. For example, you might be told that a user can authenticate to a RADIUS server but still cannot access a network resource. The question asks for the most likely cause. The answer would be an authorization issue, such as missing permissions in the RADIUS policy. Another question might describe a network administrator who logs into a router and sees that previous commands are not being logged. The question asks what AAA component is not functioning correctly, and the answer is accounting.

Protocol-related questions are also common. You may be asked to compare RADIUS and TACACS+. For instance, Which protocol separates authentication and authorization? TACACS+. Or, Which protocol encrypts the entire authentication packet? TACACS+. Or, Which protocol is most commonly used for wireless network authentication? RADIUS. Sometimes questions ask about the port numbers used by RADIUS (UDP 1812 for authentication, UDP 1813 for accounting) or by TACACS+ (TCP 49).

Finally, some questions test your understanding of AAA as a framework. For example, A company wants to ensure that all user activity is logged for compliance purposes. Which AAA component should they focus on? Answer: Accounting. These questions are designed to see if you can apply the framework to real-world needs.

AAA is not just a theoretical concept; it is implemented in almost every IT environment. As a professional, you need to know how to configure and troubleshoot AAA in common systems. The most widespread implementation is RADIUS, which is used for wireless network authentication (WPA2-Enterprise), VPN access, and network device administration. To set up a basic RADIUS system, you need a RADIUS server (like FreeRADIUS or Microsoft Network Policy Server) and a RADIUS client (the network device, such as a wireless access point or a VPN gateway).

When configuring a RADIUS client, you must define the IP address of the RADIUS server and a shared secret password. This shared secret is used to encrypt communication between the client and server. The client sends authentication requests to the RADIUS server on UDP port 1812, and accounting requests on UDP port 1813. The server checks the credentials against an identity source like Active Directory, and then returns an Access-Accept with authorization attributes or an Access-Reject.

One common problem is a RADIUS authentication failure. This can be caused by a mismatch in the shared secret, incorrect IP address, or the user account being disabled in Active Directory. Another issue is that a user authenticates successfully but cannot access certain resources. This often points to an authorization policy misconfiguration. For instance, the RADIUS server may send back attributes that place the user in a specific VLAN, but if the VLAN does not have the required permissions, the user will be isolated.

Accounting is often overlooked, but it is critical for troubleshooting and compliance. If accounting logs are not being written, check that the accounting ports are open and that the RADIUS server is configured to accept accounting packets. Many organizations use accounting data to track billable usage for clients, or to detect anomalous behavior such as a user logging in at 3 AM.

AAA connects to broader IT concepts like identity management, directory services, and security compliance. It is a foundational building block for zero trust architectures, where every access request must be authenticated, authorized, and logged, regardless of whether the user is inside or outside the corporate network. Understanding AAA gives you a strong framework for designing and maintaining secure networks.