CIA, data confidentiality and AAA (authentication, authorisation, accounting)

The CIA triad and cryptography

• Confidentiality: uses encryption to hide data from anyone not authorised to see it.
• Integrity: uses hashing algorithms to prove data wasn't changed in transit or storage.
• Availability: makes sure data and services are accessible when needed, through network hardening, redundancy and backups.

Guidelines for data confidentiality

• Encrypt sensitive files so they are unreadable without the right key or password.
• Manage access: give access only to people with a genuine need to know, use strong passwords and MFA, review access lists regularly and remove access promptly when it is no longer needed.
• Physically secure devices and paper documents in locked areas; never leave them unattended in public.
• Dispose securely of data, devices and paper records that are no longer needed (wipe, shred or destroy).
• Manage devices: anti-malware, patching, application allow-listing, screen locks, inactive session timeouts, firewalls and full-disk encryption.

AAA: who, what and when

Authentication, Authorisation and Accounting (AAA) controls which administrators can connect to which devices, what they can do there, and keeps a record of what they actually did.

• Authentication: proves identity, usually with a username and password, plus MFA where possible. Example: checking an administrator who logs in to a router's console or SSH.
• Authorisation: decides what an authenticated user may access and which commands or changes they may make.
• Accounting: records actions and sessions: commands entered, time connected, data used. It is used for auditing, troubleshooting, billing and capacity planning.

Without AAA, devices rely on a single shared line password, often over Telnet, which is easy to brute-force and leaves no record of who did what.

Local AAA vs server-based AAA

• Local AAA: usernames and passwords are stored on each device. Simple, but every device must be updated separately. Always keep a local account as a backup.
• Server-based AAA: the device sends login details to a central AAA server, which checks them. Accounts are managed in one place and logging is centralised.

RADIUS vs TACACS+

Configuring server-based AAA (Cisco IOS)

1. Enable AAA.
2. Define the AAA server's address.
3. Set the shared secret key.
4. Tell the device to authenticate logins with the server, falling back to local accounts.

aaa new-model
username admin secret Str0ng-Local-Backup
tacacs server TAC1
 address ipv4 192.168.10.50
 key Sh4red-T4cacs-Key
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
line vty 0 4
 login authentication default
 transport input ssh