Video summary

What is Identification, Authentication, Authorization, Auditing, Accountability| IAAA| Cybersecurity

Main summary

Key takeaways

Technology

IAAA / Access Control Concepts in Cybersecurity

The video explains Identification, Authentication, Authorization, Auditing, and Accountability (IAAA) as the core “access control” steps that secure how users access resources and how actions are tracked and attributed.

1) Identification (who the subject is)

  • Identification is the process of stating who/what the subject is.
  • Example: when logging into a web portal, you enter a username/email/account number (subject identity).
  • The subject can be:
    • a person (user), or
    • a system/application/process/device.
  • Usually identities are unique, except cases like a generic admin account.
  • Identification alone is public information (e.g., email/name), so you can’t access without proving identity.

2) Authentication (verifying the identity)

  • Authentication verifies that the subject is actually who they claim to be.
  • Common method examples: password/passphrase, PIN, etc.

  • Authentication “types” (factor categories) include:

    1. Something you know (password, PIN, passphrase)
    2. Something you have (access card, token)
    3. Something you are (biometrics: fingerprint/retina/iris)
    4. Something you do / where you are (location/network, e.g., only in office network)

  • Single-factor authentication (SFA): only one factor is used.

  • Multi-factor authentication (MFA): two or more different factor types are required (e.g., password + token).
    • Important rule: you can’t count password + PIN as MFA if both are from the same “type.”

Order given: Identification → Authentication.

3) Authorization (what the subject can do)

  • After authentication, the system determines permissions/rights.
  • Example: accessing a payslip—a user can view only their own payslip, not others’.

  • Real-world analogy: during a flight, passengers can’t enter restricted areas like the cockpit because they’re not authorized.

  • Authorization happens based on access control models, such as:

    • MAC (Mandatory Access Control)
    • RBAC (Role-Based Access Control)
    • Rule-Based Access Control
    • DAC (Discretionary Access Control)

Order given: Authentication → Authorization.

4) Auditing (recording and monitoring actions)

  • Auditing is monitoring and recording what actions were performed by identities and what login-related events occurred.

  • It’s described as programmatic event tracking via logs.

  • Auditing logs include:

    • subject/object-related events, and often
    • logs from the operating system and applications/services.

  • Purpose of auditing:

    • detect malicious activity and unauthorized access
    • validate organizational compliance with security policies
    • provide evidence for holding subjects accountable

  • The video contrasts:

    • Auditing = collecting/recording logs
    • Accountability = reviewing those logs

5) Accountability (holding the subject responsible)

  • Accountability is defined (citing NIST) as the principle that an individual is entrusted with safeguarding/control of information and is answerable for loss or misuse.

  • In simpler terms: accountability means the organization can hold a user/process/application responsible for actions on an object (e.g., database/file/system).

  • Why accountability is required:

    • reinforces ownership of information assets and actions
    • supports enforcement of security policies
    • depends on identity proof and activity tracking

  • Accountability involves reviewing audit log files to verify compliance and detect misuse.

Non-repudiation (key outcome)

  • The video states that non-repudiation is achieved through the IAAA steps.
  • Non-repudiation means the subject cannot deny their actions because there is evidence (logs/records).

Main speakers/sources

  • Speaker: The creator “cyber clutter” (narrator/host speaking throughout)
  • External source referenced: NIST (for the definition of accountability)

Original video