"Identification" is the process of uniquely distinguishing an individual. In most cases, identification needs to be provided prior to authenticating the user. Common forms of identification are a name or an account number. Identification can refer to a person, computer system, or program. Identification is important because, if everyone had the same bank account number for example, it would be almost impossible for a bank to know how much money you have in your account. In a network environment, a username is your unique identification. Some organizations also provide employees with a corporate identification number or a badge number as a separate identification mechanism.

"Authentication" is the process of verifying that users are who they say they are. Access and privileges should not be provided to a user unless verification has occurred. Authentication can take many forms when it is based on identity. Every form of authentication is based on "something you have," "something you are," or "something you know."

You can set up remote access authentication using authentication methods already covered in this book, such as multi-factor authentication. Most enterprises implement two-factor authentication, such as requiring a personal identification number (PIN) and token when connecting to the internal network via a VPN. This is necessary because the security concerns specifically associated with remote access are greater. Allowing a remote computer to directly access an organization's network poses a high risk. It is necessary to use stronger authentication methods so that identity verification is correct and is not being mimicked by an attacker. Remote access authentication can also be achieved through protocols that you will learn about later in this chapter. Some of these protocols are PAP, CHAP, and EAP.

Once authentication is completed, authorization can occur. Authorization is determining which actions are allowed or not allowed by a user or system. Although a user may have provided identification and was authenticated, this does not mean the user is authorized to access all systems or run all commands. Once the user performs an action, mechanisms such as an access control list are used to authorize or not authorize user actions. Although authorization is not necessarily tied to remote access, it is important to understand how the IAA systems work together and complement one another. Remote access is an important part of the infrastructure, and authorization provides a secondary layer to securing the network and data that resides on the network.

Authentication, authorization, and accounting (AAA) are network services that provide 1) security through a framework of access controls and policies, 2) enforcement of policies, and 3) information needed for billing purposes. The benefits associated with AAA are increased security, increased control over the network, and the capability of auditing your network. Employing an AAA framework within an organization enables communication between IT systems over multiple networks. Specific protocols can address the AAA framework as a combined AAA protocol or as separate entities. The framework provides the flexibility and control for AAA configuration, using standardized protocols, and allows for scalability. Many of these capabilities will be addressed through the specific protocols described in the following sections.

Authentication provides a way of identifying a user. As discussed in Chapter 10, there are multiple ways to authenticate users. As the method increases to two-factor and three-factor authentication, the options increase. Some examples of authentication are a user ID and password, PIN and token, and biometrics. Once a user enters his or her credentials, the authentication server compares them with the user's credentials stored in a database. Authentication is the first of the services provided in the AAA framework because you cannot limit or deny access without knowing who the user is.

Authorization is determining whether a user has the right to do certain actions. These actions may include commands or accessing internal resources. Authorization cannot occur unless the user has authenticated. Policies define authorization capabilities. Policies based on services or user access requests determine whether the resulting actions are denied or allowed.

Accounting provides the ability of the system to collect statistics on networks or users for auditing and billing purposes. Accounting enables tracking of system usage, start and stop times of resources, number of data packets, as well as other metrics that identify what was used and for how long.

The AAA is a framework that multiple protocols are based on. Protocols may ensure that all or some components of the AAA framework are available in the construct of the protocol. The entities of the framework may work together or separately or may not be included at all. For example, the RADIUS protocol uses the AAA framework to provide the three AAA components, but supports authentication and authorization separately from accounting. If a network administrator does not want to employ accounting, he or she has this flexibility. Next you will review several of these protocols whose foundation is focused around this AAA framework.

Figure 12-1. RADIUS infrastructure.

Remote Authentication Dial In User Service (RADIUS) is a client/server protocol that provides authentication and authorization for remote users. RADIUS also provides accounting capabilities. Livingston Enterprises developed RADIUS for its network access server product. The standards related to RADIUS are:

RADIUS is a network protocol that provides communication between a network access server (NAS) and an authentication server. Enterprises use the protocol to provide network authentication for their remote users. Internet service providers (ISPs) use the protocol to authenticate users and to grant access to the Internet. ISPs and internal corporate departments also use RADIUS for billing purposes by tracking the start and stop times of sessions. For example, an internal corporate department may charge other departments for use of its infrastructure. RADIUS can be used to provide the chargeback to the departments. RADIUS provides configuration information, authentication, and authorization between the NAS and RADIUS server. The communication information provided identifies the type of service delivered to the client. A simplified RADIUS infrastructure is shown in Figure 12-1.

RADIUS can manage a large number of users through a single source. The users' configuration information and user IDs and passwords are stored in a database, text file, or Lightweight Directory Access Protocol (LDAP) server. Verification of the user ID and password is a part of the RADIUS protocol. RADIUS also supports Extensible Authentication Protocol (EAP). EAP is an authentication framework that supports multiple authentication mechanisms. EAP will be discussed later in this chapter.

The RADIUS protocol works as follows:

Authentication and authorization are combined in RADIUS. When the user ID and password are found in the database, text file, or LDAP server, the RADIUS server returns the access-accept response. This response acknowledges the user is authenticated. Authentication usually only includes verification of the password, but it can also include a list of requirements that must be met including the port number of the RADIUS client. The RADIUS server also provides authorization to the RADIUS client via an access list. Independent of authentication and authorization, RADIUS accounting provides the start and end time of individual sessions. As stated, this data can be used by an organization to determine the amount of time and data that was used during a session.

In the preceding example, SMS messaging was discussed as a challenge-response authentication method. It is important to know that two-factor authentication is often used for challenge-response authentication. An example of this is the PIN and token combination discussed in Chapter 10. If the client receives a request for this information, the user enters in the appropriate PIN and token, resulting in a passcode. The second access request sends the passcode and additional data to the RADIUS server. The RADIUS server verifies the passcode against the authentication server. If a match occurs, the RADIUS server sends an access-accept response to the client.

Although RADIUS was originally developed for dial-in access, the protocol is currently used for supporting VPNs, wireless, and other access management needs. For example, RADIUS provides authentication capabilities for wireless access points. Using the previous RADIUS communication example, the wireless access point is the RADIUS client, which sends the request with the credentials to the RADIUS server. The RADIUS server also determines the level of access a user has on a network by comparing the authenticated user against the ACLs.

A remote access server (RAS) provides authentication for remote access in an Internet and dial-up scenario. A user connects to the RAS, and his or her credentials are compared against the database. If the credentials match, authentication has occurred and the user is granted access to the network. Users and systems use remote access for gaining access to a specific network. It is necessary to implement strong security when using a RAS. Often, organizations forget that modems are connected to servers or assume that other safeguards such as firewalls will protect access. This is not always the case, and therefore you should implement the following rules for remote access servers:

Terminal Access Controller Access Control System (TACACS) is a client/server protocol that was developed to control who could use dial-up lines. A dial-up network consists of end nodes, routing nodes, and links. Routing nodes can connect dedicated lines or accept dial-up lines. A "TIP" is a routing node that accepts a dial-up line. The TACACS protocol was formed to allow a TIP to accept a username and password and send a query to the TACACS authentication server. The authentication server either accepts or denies the request and sends the response back. The TIP allows access or denies it based on the response. The determination of who is allowed or denied access is determined by the administrator of the TACACS authentication server. For example, an administrator may allow access to users only between 8:00 a.m. and 5:00 p.m., Monday through Friday. The administrator who manages the TACACS daemon defines this access control in the system.

TACACS combines authentication and authorization over a TCP/IP network. A user may enter a user ID and password to achieve authentication. Authorization determines what the user may access and when. TACACS is not a secure protocol because user IDs and passwords are transmitted in clear text through a User Datagram Protocol (UDP) packet or a Transmission Control Protocol (TCP) data stream.

Extended TACACS (XTACACS) is a client/server protocol developed in 1990 by Cisco. XTACACS is an extension of TACACS. XTACACS separates authentication, authorization, and accounting. Separating the AAA methods means that they can be achieved individually; one method does not rely on another. For example, a user named Jackie normally authenticates with her user ID and password before authorization to a system is determined. If there is separation between authentication and authorization, authorization can occur without Jackie having to authenticate first. Joining the two would achieve a more secure environment but it is not needed.

Terminal Access Controller Access Control System Plus (TACACS+) is a Cisco-proprietary protocol developed to provide access control for routers, network access servers, and other network devices via one or more centralized servers. TACACS+ utilizes TCP, ensuring the delivery of the message. TACACS+ is an extension of TACACS but differs by separating the authentication, authorization, and accounting architecture and allowing for additional methods of authentication. TACACS+ also encrypts the communication, unlike TACACS. TACACS+ uses a client/server model. The following information defines how AAA is achieved with TACACS+:

TACACS+ authentication has three packet types: start, continue, and reply. The TACACS+ daemon always sends reply packets, and the client always sends start and continue packets. When an authentication request is made, the client sends a start packet to the TACACS+ daemon. This packet contains the type of authentication to be performed (such as PAP or CHAP) and authentication data. In response, the daemon responds with a reply packet, indicating when it is finished or if additional information is needed. If additional information is required, the client obtains this data and responds with it in a continue packet. TACACS+ is the only one of the three protocols—TACACS, XTACACS, and TACACS+—currently being used because it is the only one that's secure.

The TACACS+ protocol is responsible for communications between the NAS and the TACACS+ daemon. The protocol also provides confidentiality by encrypting communications between the NAS and the TACACS+ daemon.

RADIUS and TACACS+ are both client/server protocols providing AAA capabilities. It is important to understand how the two approaches differ, ensuring the best protocol is provided for a particular system.

RADIUS and TACACS+ both use TCP/IP. RADIUS uses UDP as its transport protocol and TACACS+ uses TCP. UDP is a connectionless protocol and therefore packet drops are not detected by the network. TCP is a connection-oriented protocol and therefore an acknowledgement is sent after a request has been received. To make up for the deficiency with UDP, RADIUS must use supplemental code to provide lost packet detection.

RADIUS and TACACS+ both use encryption. RADIUS encrypts the password only. Therefore, additional information such as the user ID, authorized services, and accounting are available in clear text and can be viewed by an attacker. TACACS+ encrypts the entire body of the packet. When implementing RADIUS, you need to use additional security measures to prevent data from being read by an attacker.

RADIUS and TACACS+ both provide authentication, authorization, and accounting. RADIUS is sometimes not considered a pure AAA architecture because authentication and authorization were standardized in one RFC and accounting was standardized in a separate RFC. RADIUS combines the authentication and authorization capabilities, and separation of the two cannot occur. TACACS+ separates authentication, authorization, and accounting. The advantage is that TACACS+ provides flexibility for network administrators by implementing AAA components in stages as opposed to all at once.

Table 12-1 summarizes differences between TACACS+ and RADIUS.

KBA is an identification or Web authentication mechanism used in real time as a question-and-answer process. These questions and answers are obtained from public records or private data warehousing firms such as credit bureaus. The questions consist of information such as "What is the license plate number of your 1998 green Toyota Camry?" or "What is the house number where you lived in 1979?" These questions are used to prove that you are who you say you are. They can also be used as an authentication tool before a user establishes his or her challenge-response questions.

These types of questions are set up by the user. Examples of questions are, "What is your favorite book?" or "What is the name of your second grade teacher?" KBA is beneficial for Web authentication because it does not require an additional item such as an authenticator or certificate. It is commonly used in situations where the user does not have access to other credentials, such as establishing an account for the first time or gaining access to an account after the user forgets his or her password.

Many companies are contemplating the use of VPN versus authentication to applications via the Web. The Miller Corporation is no different. Miller Corporation is a small organization with approximately five sales representatives located throughout the United States. There are no remote offices available for the sales reps. Four of the five sales reps work from home or on the road exclusively. One of the sales reps has a work area in the corporate office but the majority of her time is spent on the road.

Jeff, the network administrator, configured remote access so that each user had a unique user ID/password combination for dial-in access to the network and unique user IDs and passwords for each application on the network. Passwords expired every 90 days. The sales representatives began reporting that this method was cumbersome and wanted to know if another solution was available.

Jeff decided to look into VPN access for the sales representatives. Jeff found that a VPN was the best option compared to Web authentication and dial-in access because of the security that remote access virtual private networking provided. A remote access VPN would provide a secure connection between the sales reps' computers and the corporate network. A remote access VPN would allow this secure communication over a wireless connection. The other solutions were not effective with this type of connection.

Jeff could manage remote access VPN configurations at a centralized location, rather than managing Web authentication for each application. Implementing the remote access VPN would also increase the productivity of the sales reps because they would no longer need to log on to multiple resources nor keep track of several passwords.

If Miller Corporation hired additional sales representatives, the VPN would scale better than any of the other options. Jeff could also seamlessly add a second level of authentication with the use of VPN, if needed. Jeff felt that a VPN solution was best for the sales representatives, and it would allow other employees to work remotely.

A major city government needed to ensure its departments were complying with appropriate remote access security policies and regulatory requirements. It also needed to better account for remote access usage of the citywide network by each department for budgeting purposes. The city's chief information security officer (CISO) requested security metrics and usage data from each department. This data indicated system-wide remote access security lapses and weaknesses, and it was apparent that the departments were unable to provide accurate usage figures without going to great effort.

The CISO decided to employ security and auditing through the AAA framework. AAA provides the flexibility and scalability that is needed for the city to meet policy and regulatory requirements. While implementing the framework, access controls were added to every component of the city's network infrastructure to meet authorization requirements. With the accounting component, administrators could more accurately report the resources each user consumed while using the network, and they could use the data for trend analysis and capacity planning. Implementing the authentication, authorization, and accounting components addressed current needs and future concerns.

An AAA framework is important for any organization that needs to standardize its practices based on security. It gives an organization a starting point and assists in future growth. It helps administrators understand what needs to be accomplished and why.

Kelly, a network administrator for a gas distribution company, needs to implement a secure dial-in infrastructure for a group of financial employees. She wants to ensure authentication, authorization, and accounting capabilities are provided. Kelly has finalized her decision to TACACS+ or RADIUS, but is not sure which of the two is best for the environment.

Kelly is concerned that TACACS+ is not an IETF standard. She feels comfortable with the notion that RADIUS has been standardized and therefore all vendors who support RADIUS will support this standardization. Kelly appreciates the scalability of a centralized authentication service that is offered with both systems. If the implementation proves successful, the technology may be rolled out to additional employees. However, she is concerned about using RADIUS in a large infrastructure because it uses UDP. Implementing TACACS+ will resolve this issue because TCP is used, but there is a lot of network overhead associated with TCP. If each request results in an acknowledgment, network traffic will increase.

Kelly's main concern is encryption, however. Encrypting only the user's password is a risk that Kelly does not want to take. The users employing this service are in the finance department, and Kelly feels that every data packet should be encrypted in its entirety for security reasons. Weighing all of the pros and cons of each solution, Kelly feels that the security of the company's data is the most important concern. Therefore, Kelly decided to move forward with implementing TACACS+.