| The use of authentication, authorization, and accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. Privilege levels, as well as, which commands each administrator is authorized to use based on the privilege level or account group membership, must be controlled and assigned accordingly. By using the IDPS in conjunction with an authentication server, the administrators can easily add, modify, or delete accounts as well as add or remove command authorizations and privilege levels. The use of an authentication server provides the capability to assign network administrators and engineers to tiered groups that contain their associated or required privilege level. By configuring the IDPS to collaborate with an authentication server, it can enforce the appropriate authorization for each administrator. Additionally, separation of services provides added assurance to the network if the access control server is compromised. This requirement does not apply to local emergency accounts which should be used sparingly. If management of authorizations and privileges is not centralized, it will be difficult to track and manage user authorizations and privileges and there is an increased risk of misconfiguration.
|
