Ok. So the last 3 posts broke up what should probably have been one post into three for the sake of content.
This post will try something different. As this whole endeavour is a work in progress, we’ll see how it goes.
Identity, Authentication, Authorization, Accountability.
IAAA is a framework used primarily in the IAM (Identity and Access Management) side of Cybersecurity. The four realms are there to make sure that people are who they say the are and are accessing what they’re allowed to access.
Identity: Who YOU are. This is a personal identifier that is, generally, unique to you. A username. A Social Security number. An employee ID number. Something within the organization that narrows down the person for identification.
Employee IDs are generally preferred, as it helps keep the confidentiality Social Security Numbers — so there are fewer issues with identity theft — and usernames are fairly easy to spoof or created lookalikes that are close enough to the original to fool an quick visual check in.
Get Ron Rogers’s stories in your inbox
Join Medium for free to get updates from this writer.
Authentication: Prove who you are. This should always be something you do with Multi-Factor Authentication. There are 3 types of Authentication out there:
Type 1) Something you know. This is usually a password or a PIN number or something you’ve memorized or enter routinely.
Type 2) Something you have. This is typically an ID card of some kind. A smart card, a passport, something that is independent of your physical self that you have with you. PC cookies — the little pieces of code in internet browsers that store info about you for websites — can be considered Type 2, as they exist independent of you, even if they are just code.
Type 3) Something you are. This is usually something about you physically and is covered in the realm of Biometrics. A fingerprint, and iris scan, something along those lines. It’s far less common than the first two, but it also doesn’t change. So if it’s compromised in your system, it’s unusable and a different identifier has to be used.
Authorization: Ok. You’ve been identified. You’ve been authenticated. We know who you are now. The question becomes: What are you allowed to see? To access? To manipulate?
Access control models (and there are several) organize user access in ways that tell them what they are allowed to see, touch, and do in a system.
Examples include: DAC, RBAC, ABAC, and RUBAC.
DAC (Discretionary Access Control) is common in Windows operating systems. One can create a file, folder, or structure and then decide themselves who can access it and what rights they have (read, write, execute) to that information.
RBAC (Role-Based Access Control) is more common in network systems. You have defined roles within the network (User, Admin, Speciality, etc) and each of those roles has specific abilities, permissions, etc that they can do. You assign people to those roles as needed for their job titles, and they get the access that role permits automatically.
You get the idea. There will be more on different role-based systems in another lesson (or so I’m told).
Accountability: Tracing an action to a specific subject. This is the idea that, if an action is performed (the data in a file is changed, a program is edited, whatever), there is a record of who made what change when. This can come in the form of Digital Signatures, or the file itself recording which User saved the latest change within it.
So there we have it. Identity (Who are you?) leads to Authentication (Prove it) leads to Authorization (Fine. What are you allowed to do?) leads to Accountability (Ok. Do it. But we know what you did.)
