Authentication, Authorization, & Account 1.2

Question 1

Describe the step of IDENTIFICATION in the AAA Framework?

Answer 1

• This is the first step.
• The user provides information claiming to be the registered user of that system.

Question 2

Describe the step of AUTHENTICATION in the AAA Framework?

Answer 2

• Checks between your username, passwords, and other authentication factors.
• Proves that you are who you say you are.

Question 3

What is the purpose of the AUTHORIZATION step of the AAA Framework?

Answer 3

• Once authentication has been completed, the next step is determine what systems the user will have access to.

Question 4

What is the AAA Framework?

Answer 4

Refers to a system that implements the use of Authentication, Authorization, and Accounting.

Question 5

What is the purpose of ACCOUNTING?

Answer 5

• Records the resources used when engaging with a system.
• Resources used can include: Login time, data sent and received, logout time.

Question 6

What way can a device be authenticated to access an internal system?

Answer 6

• External devices can use certificates which is digital signed and checked at the login process.

Question 7

What are some systems that can validate or authenticate an external device?

Answer 7

• Certificates can be validated using a VPN concentrator or management software that validates the end device

Question 8

What is the role of a CERTIFICATE AUTHORITY when authenticating an external device?

Answer 8

• A device or software that manages all the certificates within the environment.
• Creates certificates that are digitally signed by the Certificate Authority.

Question 9

What is the role of an AUTHORIZATION MODEL in granting an external device access?

Answer 9

• Grants a registered user access to specific applications and systems.
• Is placed in the middle of granting the user access to the system.
• Authorization is granted by the user’s assigned roles, organization, or attributes.

Question 10

What are the caveats to having no AUTHORIZATION MODEL in place?

Answer 10

• Can still grant a user specific access to certain systems, however, without this method does NOT SCALE well when granting access to a large amount of systems or data to a larger amount of users.

Question 11

Describe the application of ABSTRACTION in the Authorization Model

Answer 11

• Separates the users from the information they need to access.