Identity, Authentication and Network Access Control

Introduction and Context

Network security begins with a basic question: who or what is requesting access, and what should that subject be allowed to do? Identity and access controls provide the mechanisms for answering that question. They protect services from unauthorized use while allowing legitimate users, devices, applications, and administrators to work efficiently.

Access control is commonly organized around the AAA model:

• Authentication establishes identity.
• Authorization determines permitted actions.
• Accounting records activity for auditing, billing, troubleshooting, and compliance.

These functions are related but distinct. A user may authenticate successfully but still be unauthorized to modify a router. Similarly, an accounting record does not itself prevent misuse; it provides evidence about what occurred.

In professional environments, identity management must cover human users, service accounts, computers, network devices, virtual machines, cloud workloads, and application programming interfaces. Weak identity controls can allow credential theft, privilege escalation, lateral movement, data loss, and regulatory violations.

Learning Objectives

After studying this chapter, you should be able to:

1. Explain identity, authentication, authorization, and accounting.
2. Implement secure password and multifactor authentication practices.
3. Compare role-based and attribute-based access control.
4. Describe directory services and their relationship with network authentication.
5. Explain the operation and appropriate use of RADIUS and TACACS+.
6. Apply privileged access management and least-privilege principles.
7. Describe network access control for users and devices.
8. Evaluate an access-control design using a practical case.

Identity and the AAA Security Model

An identity is a representation of a subject recognized by an information system. A subject may be a person, device, process, or service. An account is the technical record associated with that identity. Identity information may include a username, employee number, device certificate, group membership, department, or organizational role.

Authentication answers: How does the subject prove possession of an identity? Authorization answers: What may the authenticated subject do? Accounting answers: What did the subject do, when, and from where?

A useful access-control sequence is:

1. A subject makes a request.
2. The system identifies the subject.
3. One or more credentials are validated.
4. Policy evaluates the requested resource and action.
5. The system permits or denies the action.
6. Relevant events are logged and monitored.

Figure: The AAA process connects identity proof, policy evaluation, resource access, and accountability.

Authentication Factors and Password Security

Authentication factors are normally classified as:

Multifactor authentication (MFA) requires two or more independent factor categories. Entering a password and answering a security question usually remains single-factor authentication because both are knowledge factors. A password plus a hardware security key is stronger because compromise of one factor does not automatically compromise the other.

Passwords should be long, unique, and protected against guessing, reuse, phishing, and offline cracking. Systems should not store plaintext passwords. Instead, they should store a salted, deliberately slow password hash produced by a modern password-hashing algorithm. A salt is a unique random value stored with the password hash; it prevents identical passwords from producing identical stored values and reduces the usefulness of precomputed tables. Encryption is reversible with a key, whereas password hashing is designed to be one-way.

Important password controls include:

• prohibit common, breached, and organization-derived passwords;
• encourage password-manager use;
• apply rate limiting, progressive delays, or temporary lockout carefully;
• transmit credentials only over protected channels;
• protect password-reset procedures as strongly as login procedures;
• avoid unnecessary forced rotation that encourages predictable changes;
• notify users of suspicious authentication events;
• use phishing-resistant MFA for administrators and sensitive systems.

Account lockout can reduce online guessing but may also enable denial-of-service attacks if an attacker deliberately triggers lockouts. Risk-based controls, throttling, monitoring, and strong MFA are often preferable to indefinite lockout.

Biometrics are convenient but not secret in the same way as passwords. A fingerprint cannot normally be replaced after compromise. Biometric systems should therefore use protected templates, liveness detection where appropriate, fallback methods, and clear privacy controls.

Authorization Models

Authorization should follow least privilege: each subject receives only the permissions necessary for an approved task, for only as long as necessary. Least privilege reduces the damage caused by stolen credentials, mistakes, and malicious insiders.

A discretionary access control (DAC) system allows resource owners to grant permissions. It is flexible but can produce uncontrolled permission sharing. A mandatory access control (MAC) system applies centrally managed classifications and labels; it is useful where information must follow strict security classifications. Role-based access control (RBAC) assigns permissions to roles and assigns users to roles. For example, a help-desk role may reset user passwords but not alter firewall policy.

RBAC can be represented conceptually as:

This is a policy relationship rather than a numerical equation. A user should normally inherit permissions through an approved role rather than receive numerous individual permissions.

Separation of duties divides a sensitive process among different people or roles. For example, one employee requests a payment and another approves it. Privileged access management (PAM) applies these principles to powerful accounts by using vaulting, approval workflows, just-in-time access, session recording, and emergency-access procedures.

RBAC may become difficult when access depends on device health, location, time, data sensitivity, or risk. Attribute-based access control (ABAC) evaluates attributes of the subject, resource, action, and environment. A policy might allow a finance employee to view payroll data only from a managed device during working hours and only in the finance application. ABAC is expressive but requires accurate, trusted attributes and well-governed policies.

The principle of deny by default means that access is refused unless an explicit rule permits it. Exceptions must be documented, approved, tested, and periodically reviewed.

Directory Services and Identity Lifecycle

A directory service stores and organizes identity and resource information for centralized lookup and administration. Common directory technologies include LDAP-compatible directories and Microsoft Active Directory Domain Services. A directory may contain users, groups, computers, organizational units, certificates, and policy-related attributes.

Directory services support centralized authentication, group-based authorization, naming, and administration. They do not automatically make an organization secure. Poor group design, excessive administrator rights, weak synchronization controls, and stale accounts can undermine the directory.

The identity lifecycle consists of:

1. Joiner: create an account and assign approved access when a person or device joins.
2. Mover: change access when duties, department, or location changes.
3. Leaver: disable accounts, revoke tokens, recover equipment, and remove access promptly.

Periodic access certification asks managers or data owners to confirm that access remains necessary. Shared accounts should be avoided because they weaken accountability. If a technical requirement makes one unavoidable, compensating controls should include individual check-out procedures, vaulting, time limits, and detailed logging.

Directory synchronization with cloud services requires secure connectors, strong administrative protection, clear source-of-authority rules, and monitoring for abnormal changes. Federation allows one identity provider to authenticate users for multiple services. SAML, OAuth 2.0, and OpenID Connect serve different purposes: SAML and OpenID Connect commonly convey authentication or identity information, while OAuth 2.0 primarily delegates authorization to applications. These technologies must not be treated as interchangeable.

RADIUS and TACACS+

RADIUS is widely used for centralized network access authentication, authorization, and accounting. A network access server (NAS), such as a wireless controller or VPN gateway, sends an access request to a RADIUS server. The server validates credentials and returns an accept, reject, or challenge response, often with authorization attributes such as VLAN assignment or session limits. RADIUS commonly uses UDP and is especially associated with user network access.

TACACS+ is commonly used to control administrative access to network devices. It separates authentication, authorization, and accounting more distinctly and supports command authorization. This enables a policy such as allowing an operator to view interface status but not change routing configuration. TACACS+ commonly uses TCP and encrypts the packet body; deployments must still protect the channel, secrets, servers, and endpoints.

Both protocols require resilient server design, protected shared secrets, synchronized time, carefully limited administrator access, and logging. A fallback local account should be protected as an emergency mechanism, not used as the normal authentication path.

Network Access Control

Network access control (NAC) evaluates whether a user or device may connect to a network and what level of access it should receive. NAC may use identity, device certificates, switch-port information, operating-system state, antivirus status, patch status, and location.

A typical architecture includes:

• a supplicant, such as a laptop or phone seeking access;
• an authenticator, such as a switch or wireless access point;
• an authentication server, commonly RADIUS;
• enforcement controls such as VLAN assignment, downloadable access rules, firewall policy, or quarantine.

IEEE 802.1X provides port-based network access control and commonly uses EAP methods. The access point or switch does not necessarily validate the credentials itself; it relays authentication exchanges to the authentication server. Certificate-based methods can provide strong, phishing-resistant device or user authentication, but certificate issuance, renewal, revocation, and private-key protection must be managed.

NAC decisions should distinguish among at least three states: trusted access, restricted or remediation access, and denied access. Guest access should be isolated from internal administrative and sensitive networks. IoT devices that cannot perform modern authentication may require segmentation, restrictive rules, monitoring, and carefully controlled exceptions.

NAC is not a complete security solution. A compliant device can still be compromised after admission, and an unmanaged device may evade controls through wireless, physical, or application-level paths. Continuous monitoring and segmentation are therefore essential.

Accounting, Monitoring, and Evidence

Accounting records should answer who performed an action, what occurred, when it occurred, where it originated, which resource was involved, and whether the action succeeded. Network accounting may include session start and stop times, source address, assigned address, bytes transferred, authentication result, and disconnect reason.

Logs should be time-synchronized, protected from unauthorized alteration, retained according to legal and operational requirements, and made searchable for investigation. Central collection reduces the risk that an attacker can erase evidence from an individual device. Monitoring should identify impossible travel, repeated failures, unusual privilege use, access outside normal patterns, and changes to privileged groups.

Logging also creates privacy responsibilities. Organizations should define a legitimate purpose, limit collection, restrict access to logs, protect retention, and disclose monitoring appropriately. Excessive collection can create legal, ethical, and security risks.

Privileged Access Controls

Privileged accounts can install software, change security policy, create accounts, disable logging, or alter network routing. They require stronger controls than ordinary accounts.

Recommended practices include:

• separate everyday and administrative identities;
• require MFA for privileged access;
• prohibit direct routine use of built-in superuser accounts;
• use a password vault with automatic rotation;
• grant just-in-time and time-limited permissions;
• require approval for high-risk operations;
• record administrative sessions where lawful and appropriate;
• alert on privilege elevation and unusual commands;
• maintain a tested break-glass process;
• review privileged assignments regularly.

A break-glass account can preserve availability during identity-provider failure, but it should be tightly protected, monitored, and tested. Availability and security must be balanced: an access design that prevents all emergency administration can itself create operational risk.

Illustrative Case: Regional College Network

Background

A regional college operates wired laboratories, campus Wi-Fi, a VPN, cloud applications, servers, and network devices. Former students sometimes retain active accounts, help-desk staff share a powerful administrator account, and wireless authentication is based on a common password.

Problem

An attacker obtains the shared wireless password and enters the student network. A separate phishing attack compromises a staff password. Because network-device administration uses shared local credentials, investigators cannot determine which administrator changed a firewall rule.

Analysis

The college has failures in authentication strength, identity lifecycle management, segmentation, least privilege, and accounting. A single password does not provide individual accountability. The shared administrator account prevents reliable attribution. Former accounts increase the attack surface.

Approach and Solution

The college implements the following design:

1. A central directory becomes the authoritative source for staff and student identities.
2. Joiner–mover–leaver procedures connect human-resources and student-record events to account workflows.
3. Staff and administrators use MFA; administrators use phishing-resistant security keys.
4. WPA-Enterprise with 802.1X and RADIUS replaces the common wireless password.
5. Students, staff, guests, laboratory devices, and infrastructure are assigned separate network segments.
6. TACACS+ centralizes network-device administration and authorizes commands by role.
7. Help-desk personnel receive a limited support role; network engineers receive a separate engineering role.
8. Privileged sessions use a vault, approval, time limits, and recording.
9. RADIUS, TACACS+, directory, VPN, firewall, and endpoint events are sent to centralized monitoring.
10. Quarterly access reviews and annual recovery exercises validate the controls.

Outcome

The college gains individual accountability, faster removal of leavers, stronger resistance to password reuse, and reduced lateral movement. NAC and segmentation limit the effect of an infected endpoint. The design does not eliminate risk: phishing, stolen devices, misconfiguration, and service outages remain possible. Continuous review is therefore retained as part of the control system.

Learning Points

Identity controls work as a system. MFA cannot compensate for excessive authorization; logging cannot compensate for shared accounts; and NAC cannot compensate for poor endpoint security. Effective protection combines identity lifecycle management, strong authentication, least privilege, segmentation, resilient services, and evidence-based monitoring.

Challenges, Governance, and Contemporary Developments

Identity systems are attractive targets because compromise can provide broad access. Common challenges include MFA fatigue, phishing proxies, credential theft, misconfigured cloud roles, orphaned accounts, excessive permissions, unreliable device attributes, and outages at a centralized identity provider.

A zero-trust approach does not treat network location alone as proof of trust. It continuously evaluates identity, device, application, resource, and context, while applying least privilege and assuming that compromise is possible. Zero trust is an architectural and governance approach, not a single product.

Passkeys based on public-key credentials can reduce dependence on passwords and resist many phishing attacks. However, organizations must plan recovery, device replacement, account enrollment, accessibility, and administrator support. Machine identities are also growing rapidly through APIs, containers, cloud workloads, and automation. They require ownership, rotation, scoped permissions, secure storage, and lifecycle termination just like human identities.

Artificial intelligence can help identify anomalous authentication patterns and prioritize investigations, but automated decisions may generate false positives, encode biased assumptions, or be manipulated by attackers. Human review, explainability appropriate to the risk, protected training data, and documented governance remain necessary.

A professional access-control program should align with applicable privacy, cybersecurity, education, employment, and sector-specific obligations. Controls should be documented, risk-based, tested, and reviewed after incidents or major architectural changes.

Best-Practice Implementation Sequence

A practical implementation sequence is:

1. Inventory users, devices, services, privileged accounts, and sensitive resources.
2. Define owners and access requirements for each resource.
3. Establish a central identity source and lifecycle process.
4. Remove shared accounts and apply unique identities.
5. Deploy MFA, beginning with administrators and high-risk services.
6. Design roles around job duties and enforce least privilege.
7. Centralize network authentication with RADIUS or TACACS+ as appropriate.
8. Deploy NAC and segmentation for users, devices, guests, and infrastructure.
9. Centralize logs, synchronize time, and define alerting and retention.
10. Test failure, recovery, account removal, and incident-response procedures.
11. Review access regularly and measure whether controls reduce risk without unacceptable operational harm.

Chapter Summary

Identity and access control provide the foundation for network security. Authentication verifies a claimed identity, authorization evaluates permitted actions, and accounting records activity. Strong programs combine unique identities, secure password storage, multifactor authentication, least privilege, separation of duties, and carefully governed roles.

Directory services centralize identity and group information, while lifecycle processes ensure that access changes when people join, move, or leave. RADIUS is widely used for network access such as wireless and VPN services; TACACS+ is particularly useful for administrative control of network devices and command authorization. NAC combines a supplicant, authenticator, authentication server, and enforcement policy to admit, restrict, or deny devices and users.

Privileged access requires stronger safeguards, including vaulting, approval, time limits, session monitoring, and separate administrative identities. Accounting and centralized monitoring provide evidence and support detection, but they must respect privacy and retention requirements. Contemporary practice extends these principles to zero-trust architectures, passkeys, cloud identities, machine identities, and carefully governed analytical tools.

Key Terms

Identity: A recognized representation of a person, device, process, or service.

Authentication: Verification of a claimed identity.

Authorization: Determination of permitted actions or resources.

Accounting: Recording access events and activities for accountability.

Multifactor authentication: Authentication using two or more independent factor categories.

Salt: Random data added to a password before hashing.

Hash: A one-way transformation used to represent data digitally.

Least privilege: Granting only the access necessary for an approved task.

RBAC: Role-based access control, in which permissions are assigned through roles.

ABAC: Attribute-based access control using subject, resource, action, and environmental attributes.

Separation of duties: Dividing sensitive responsibilities among different roles or people.

Directory service: A centralized system for organizing and retrieving identity and resource information.

RADIUS: A protocol commonly used for centralized network access authentication, authorization, and accounting.

TACACS+: A protocol commonly used for centralized administrative access to network devices.

NAC: Network access control that evaluates and enforces connection permissions.

Supplicant: A device or client requesting network access.

Authenticator: A switch or access point enforcing the access process.

Privileged access management: Controls for high-power accounts and administrative sessions.

Zero trust: An approach that continuously evaluates access rather than trusting network location by default.

Passkey: A public-key-based credential designed to provide convenient, phishing-resistant authentication.

Review Questions

Short Answer Questions

1. Distinguish authentication from authorization.
2. What are the three main authentication-factor categories?
3. Why is a salt used in password storage?
4. State one common use of RADIUS and one common use of TACACS+.
5. What is the purpose of a leaver process?

Long Answer Questions

1. Explain the AAA model and show how its three components cooperate during a VPN connection.
2. Compare DAC, MAC, RBAC, and ABAC, including one appropriate application for each.
3. Describe a secure privileged-access-management design for network administrators.
4. Explain how directory services support the identity lifecycle and access reviews.
5. Describe an 802.1X-based NAC architecture and discuss its limitations.

Analytical / Application Questions

1. A company discovers that contractors use one shared administrator password. Analyze the risks and propose a staged remediation plan.
2. Design an access policy for a college in which students, staff, guests, and IoT devices share wireless infrastructure. Identify authentication, authorization, segmentation, and monitoring decisions.
3. During an incident, logs show successful authentication from two distant locations within ten minutes. Explain possible causes, evidence to collect, immediate containment actions, and longer-term control improvements.

Multiple Choice Questions with Answers

Question 1

Which AAA function determines whether an authenticated user may change a firewall rule?

A. Authentication

B. Authorization

C. Accounting

D. Identification

Correct Answer: B. Authorization

Question 2

Which combination is a genuine example of multifactor authentication?

A. Password and PIN

B. Password and security question

C. Password and hardware security key

D. Two different passwords

Correct Answer: C. Password and hardware security key

Question 3

What is the primary purpose of a salt in password storage?

A. To make encryption reversible

B. To prevent identical passwords from producing identical stored hashes

C. To transmit passwords without TLS

D. To replace multifactor authentication

Correct Answer: B. To prevent identical passwords from producing identical stored hashes

Question 4

Which access-control model assigns permissions through job-related roles?

A. RBAC

B. DAC

C. MAC

D. NAT

Correct Answer: A. RBAC

Question 5

Which protocol is particularly associated with command authorization for network-device administrators?

A. FTP

B. DNS

C. TACACS+

D. SMTP

Correct Answer: C. TACACS+

Question 6

In a typical 802.1X deployment, which component requests network access?

A. Supplicant

B. Directory controller

C. Accounting collector

D. Firewall rule

Correct Answer: A. Supplicant

Question 7

What is the main purpose of just-in-time privileged access?

A. To provide permanent administrator rights

B. To grant elevated rights only for an approved, limited period

C. To disable all auditing

D. To replace user identity management

Correct Answer: B. To grant elevated rights only for an approved, limited period

Question 8

Which lifecycle event should normally trigger account disabling and token revocation?

A. Joiner

B. Mover

C. Leaver

D. Reviewer

Correct Answer: C. Leaver

Question 9

A network access server needs centralized authentication and VLAN assignment for wireless users. Which technology is most appropriate?

A. RADIUS

B. TACACS+ command authorization only

C. ARP

D. NTP

Correct Answer: A. RADIUS

Question 10

Which principle means access is refused unless an explicit rule permits it?

A. Open trust

B. Deny by default

C. Shared administration

D. Permanent privilege

Correct Answer: B. Deny by default