Password policies, MFA, and AAA

Password policies and alternatives

Passwords are still a primary authentication mechanism, but they become a major vulnerability when they’re weak or poorly managed.

• Weak passwords: Easily guessable passwords (e.g., “qwerty”, “asdf” or “password”) are prime targets for attackers.
• Password guessing: Attackers may attempt to guess common passwords or default credentials.
• Dictionary attacks: Using software to try all words from a dictionary as passwords.
• Brute-force attacks: Systematically trying every possible combination of characters (letters, numbers, symbols) until the correct password is found. This is computationally intensive but can succeed against short or simple passwords.

Password policies for mitigation

To reduce password-related risk, organizations implement password policies such as:

• Complexity requirements: Require long passwords that combine uppercase and lowercase letters, numbers, and special characters.
• Regular changes: Require periodic password changes to limit the time an attacker has to crack or reuse a password.
• Account lockout: Temporarily lock accounts after a certain number of failed login attempts to deter online guessing (brute-force) attacks.

Password alternatives and enhancements

Single-factor passwords have limits. Stronger authentication methods reduce the chance that a stolen or guessed password leads to compromise.

Multifactor authentication (MFA)

Definitions

Multifactor authentication (MFA)

A security method that requires two or more distinct verification factors before access is granted. These factors fall into three categories:

• Something you know: A password, PIN, or security question.
• Something you have: A physical token, a smart card, or a mobile device receiving a one-time code.
• Something you are: A biometric attribute like a fingerprint reader, facial scan, or eye scan.

By combining factors from different categories, MFA makes unauthorized access much harder because an attacker must compromise multiple independent mechanisms.

Digital certificates

Definitions

Digital certificate

An electronic document that proves ownership of a public key. It helps prove the identity of a person, device, or organization.

Digital certificates are trusted and encrypted. They are also a critical component of public key infrastructure (PKI).

Definitions

Public key infrastructure (PKI)

A framework of technologies, policies, and processes that ensures “CIA” (confidentiality, integrity, and availability) in a network.

Digital certificates work in three main ways:

• Issuance: Certificates are issued and digitally signed by a trusted third party called a certificate authority (CA). If a system trusts the CA, it can trust certificates signed by that CA.
• Proof of possession: Certificates use cryptography (public and private keys) to ensure only the legitimate owner can use them for authentication.
• Time-sensitive and revocable: Certificates expire and can be revoked by the CA if privileges are withdrawn or the certificate is compromised. Revocations are typically managed and published in certificate revocation lists (CRLs).

This is also why NTP is important in your network. Devices using digital certificates must all have their time synchronized in order to verify the time period that the certificate is valid for. Any discrepancies in time can cause the certificate authentication process to fail.

Biometrics

Biometrics use unique physical or behavioral characteristics to authenticate an individual.

• “Something you are”: Examples include fingerprint scans, facial recognition, eye scans, and voice recognition.
• Strengths: Biometrics are generally unique to an individual and difficult to steal or duplicate.
• Weaknesses: Some biometric systems can be fooled (for example, facial recognition with photos or masks). Injuries or aging can also change biometric patterns. To reduce these risks, biometrics can be combined with other factors (MFA) or multiple biometric checks can be used.

Authentication, authorization, and accounting (AAA)

Definitions

Authentication, authorization, and accounting (AAA)

A framework for controlling access to network resources, enforcing policies, and auditing usage. It is pronounced “triple A.”

AAA is especially important for managing access to network devices and end-user services. It is usually managed centrally by a AAA server, for example Cisco Identity Services Engine (ISE).

• Authentication: “Who is the user?” Authentication verifies the identity of a user or device. Typically, the user enters a username and password. The AAA server compares the submitted credentials to the credentials stored in its database. If they match, access is granted; if they don’t, authentication fails and access is denied.

AAA authentication can be combined with multifactor authentication (MFA) in order to bolster security posture.

• Authorization: “What are they allowed to do?” Authorization defines what an authenticated user or device is permitted to do after identity is verified. It assigns privileges and capabilities. For example, on a Cisco router, a user might be authorized for “user mode” (limited commands) but not “privileged mode” (full configuration access). AAA can provide granular authorization, including control over which commands or resources a user can access.
• Accounting: “What did they do during their login session?” Accounting tracks and records user activity. This can include login and logout times, commands executed, resources accessed, and network usage. Accounting data supports auditing, troubleshooting, security forensics, and capacity planning. On network devices, this often appears as log messages showing configuration changes or system events.

AAA protocols: RADIUS vs. TACACS+

Two primary protocols are commonly used to deliver AAA services:

• RADIUS (Remote Authentication Dial-In User Service):
  • An industry standard AAA protocol.
  • Combines authentication and authorization into a single process.
  • Uses UDP ports 1812 (authentication/authorization) and 1813 (accounting).
  • Encrypts only the password in the access-request packet, leaving other information unencrypted.
  • Primarily used for end-user authentication (e.g., remote access VPNs, wireless access).
• TACACS+ (Terminal Access Controller Access-Control System Plus):
  • A Cisco proprietary protocol.
  • Separates authentication, authorization, and accounting into distinct processes, offering greater flexibility.
  • Uses TCP port 49.
  • Encrypts the entire packet body, providing more secure communication.
  • Offers granular command authorization, allowing administrators to specify exactly which CLI commands a user can execute.
  • Primarily used for network device administration (e.g., managing routers, switches, firewalls).