Authentication, Authorization, and Accounting (AAA Framework) (SEC+ 1.2) (DONE)

Identification

this is who you claim to be

Authentication

prove you are who you say you are (Ex. password etc)

Authorization

based on your identification and authentication, what access do you have

Accounting

resources, login time, data sent and received, logout time

How can you truly authenticate a device?

Put a digitally signed certificate on the device

How does a certificate authentication work?

• an org has a trusted certificate authority (CA)

• the org creates a certificate for a device and digitally sign it

• the CA’s digital signature is now used to validate a certificate

How do you authorize a user or device after its been authenticated?

By putting an authorization model in the middle

What does a abstraction do?

it reduces complexity, and create a clear relationship between the user and the resource

Give an example of extraction

A shipping company creates a group that has access to multiple permissions. So anyone who needs access can just be added to the group, granting them access to multiple permissions.