What Is Authentication, Authorization and Accounting (AAA) Security?

What Is AAA Security?

Authentication, Authorization, and Accounting, commonly shortened to AAA, is a security framework for controlling access to systems and networks. It verifies who a user or device is, decides what that identity is allowed to do, and records what happened during the session.

AAA is important in network management because access control is not only about letting people in. A mature AAA design also limits privileges, supports auditing, helps investigate misuse, and gives administrators a reliable record of network and device activity.

The Three Parts of AAA

Authentication

Authentication proves identity. A user may provide something they know, such as a password; something they have, such as a hardware key or token; or something they are, such as a fingerprint or other biometric factor. In enterprise environments, authentication is usually integrated with IAM, directory services, MFA, and access policy.

Authorization

Authorization happens after identity is verified. It determines whether the user can access a VPN, manage a switch, open a business application, run privileged commands, or view sensitive data. This is where least privilege and role-based access become practical.

Accounting

Accounting creates an audit trail. It can record when a user logged in, how long the session lasted, which service was used, what commands were executed, and which IP address or device was involved. That record supports troubleshooting, compliance, incident response, and usage reporting.

Why AAA Matters in Network Security

AAA helps reduce unauthorized access and makes legitimate access easier to govern. If credentials are stolen, authorization limits what the account can do. If a trusted user abuses access, accounting logs provide evidence for review.

• Protects network entry: users and devices must prove identity before access is granted.
• Limits privilege: administrators can assign access based on role, device, location, or business need.
• Improves accountability: logs make it easier to understand who accessed what and when.
• Supports compliance: audit records help demonstrate access control and administrative oversight.
• Strengthens incident response: activity records help investigate suspicious sessions and privilege misuse.

Two Common AAA Use Cases

Network access focuses on who can enter the network. Device administration focuses on who can manage infrastructure after reaching it. Both are important, but the policy model and protocol choice may differ.

Types of AAA Protocols

AAA protocols give network devices and identity systems a standard way to exchange access requests, responses, attributes, and accounting records.

RADIUS

Remote Authentication Dial-In User Service, or RADIUS, is a client/server AAA protocol commonly used for VPN, Wi-Fi, wired network access, and remote access. A network access server sends an access request to the RADIUS server, and the server responds with accept, reject, or challenge.

RADIUS is widely used because it combines authentication and authorization in a practical way for network access. It also supports accounting records so teams can track session start, stop, and usage details.

Diameter

Diameter evolved from RADIUS and is commonly associated with LTE, telecom, and multimedia network environments. It was designed to handle mobile and carrier-grade access scenarios that need more robust signaling and scalability.

TACACS+

Terminal Access Controller Access-Control System Plus, or TACACS+, is commonly used for network device administration. It separates authentication, authorization, and accounting more cleanly than RADIUS, which makes it useful when teams need granular command authorization on routers, switches, and firewalls.

RADIUS vs TACACS+ vs Diameter

AAA Security Best Practices

• Use MFA for sensitive access: require strong authentication for VPN, remote access, and administrator logins.
• Apply least privilege: give users and admins only the permissions needed for their role.
• Separate admin roles: use different privilege levels for read-only, operator, and full administrator tasks.
• Log accounting records centrally: send AAA logs to a SIEM or log platform for retention and correlation.
• Protect AAA servers: harden, monitor, back up, and restrict access to RADIUS, TACACS+, IAM, and directory systems.
• Use secure management paths: avoid exposing administration services broadly and prefer SSH, VPN, and trusted management networks.
• Review inactive accounts: remove stale users, old service accounts, and unused administrator access.

AAA Example in a Network

Imagine an engineer connecting to a firewall over SSH. The firewall asks the AAA server to authenticate the engineer. After the identity is confirmed, the AAA server returns authorization attributes that decide which commands the engineer can run. As the engineer works, accounting records capture login time, logout time, source address, and administrative commands.

This workflow protects the device, reduces shared local passwords, and gives the security team a record of administrative activity.

What Is Authentication, Authorization and: Tags and Keywords

AAA security, authentication authorization accounting, AAA framework, AAA server, RADIUS, TACACS+, Diameter, IAM, MFA, network access, device administration, command authorization, accounting logs, VPN authentication, Wi-Fi authentication, access control, zero trust.