1.3Principles of access management

The purpose of access management comes down to letting "the right person use only the needed scope, while leaving a record." Just as a safe in a room anyone can enter is pointless, even the sturdiest system cannot be protected if the entrance is managed loosely. This section organizes the three questions that structure that entrance—"who are you" (authentication) / "what may you do" (authorization) / "what did you do" (accounting)—via AAA, along with the centralized authentication of RADIUS, verifying identity with several factors through multi-factor authentication (MFA), and a safe password policy, as introductory-level judgment.

1.3.1The three pillars of AAA and RADIUS

• Authentication verifies "are you really that person" (ID/password, biometrics, certificates). Authorization grants an authenticated party "how far they may go" (read-only, administrator rights). Accounting records "when, who, and what was done" (audit logs).
• The three together are called AAA. The order is authentication -> authorization -> accounting, and the point is that "proving identity," "granting permission," and "recording" are separate stages. Being able to log in (authentication) and being allowed a particular operation (authorization) are different—do not confuse them.
• RADIUS is a protocol that centralizes authentication for many devices and users (centralized authentication). Instead of each device holding passwords, devices query an authentication server for a yes/no, so account management and logging are unified; it is widely used for Wi-Fi and VPN authentication (such as 802.1X).

1.3.2Multi-factor authentication and password policy

• Multi-factor authentication (MFA) verifies identity with multiple factors of different kinds. There are three: knowledge (a password or PIN—something you know), possession (a phone, token, or IC card—something you have), and inherence (a fingerprint or face—something you are). Even if a password leaks, another factor of a different kind is still required, making a breach harder.
• Stacking two of the same knowledge factor, like "password + secret question," is not MFA (both are "something you know"). True MFA combines different kinds. "Password + a one-time code on your phone" is knowledge + possession, a correct MFA.
• A password policy is an operational rule set to resist guessing, brute force, and reuse: sufficient length and complexity, no reuse, periodic or breach-triggered changes, and banning dictionary words and known-breached passwords. Long, memorable passphrases and a password manager that safely stores many strong passwords are also effective.

Suppose you manage an internal system and get a request: "let a temp staffer in sales view the customer list." Thinking "just hand over an account that can log in" mistakes the stages of access management. Being able to log in only means authentication (who you are) passes; how far that staffer may handle the customer list—authorization—must be designed separately. If viewing is all that is needed, do not grant write or delete rights; by the principle of least privilege, allow "only the needed scope." Also configure accounting (audit logs) so you can later trace "who viewed what data and when," letting you detect and follow any improper access. Reconsider the strength of authentication too: if the temp account has only a password, it is breached the moment that password leaks. Enabling multi-factor authentication (MFA)—requiring, on top of the password (knowledge), a one-time code on a phone (possession)—largely blocks intrusion even if the password leaks. Thinking "making it a password plus a secret question is MFA" is wrong, because both are knowledge factors and are not of different kinds, so the MFA benefit is not obtained. Furthermore, if the many internal devices each hold separate accounts, management collapses, so centralizing authentication with RADIUS unifies adding/suspending accounts and reviewing logs. The key is the staged thinking: design "can get in (authentication)," "what may be done (authorization)," and "what was done (recording)" separately, and strengthen authentication itself with MFA and a password policy. At the introductory stage, correctly separating these stages prevents common accidents like over-granting privileges or missing audit trails.

1.3.3Section summary

• AAA is the separate stages authentication (who) -> authorization (what you may do) -> accounting (record of what you did); do not confuse authentication with authorization
• RADIUS centralizes authentication and is widely used for Wi-Fi and VPN
• MFA requires two or more of different kinds among knowledge/possession/inherence (stacking the same kind does not count); a password policy centers on length, complexity, and no reuse