Centralize Network Authentication, Authorization, and Auditing (AAA)
Description
Centralize network AAA.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Zero trust network access platform replacing VPNs with application-level microsegmentation and identity-based access
Zscaler · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Inconsistent Authentication Across Network Devices
ConfidentialityWithout centralized AAA, each network device maintains its own local authentication database with inconsistent password policies, no MFA capability, and credentials that persist after employee termination, enabling unauthorized access.
Terminated Employee Retaining Network Device Access
IntegrityWhen employees leave the organization, their access to network devices persists because local accounts on routers, switches, and firewalls are not linked to centralized identity management and must be individually removed from each device.
No Audit Trail for Network Device Administrative Actions
IntegrityWithout centralized accounting, administrative actions on network devices are not consistently logged or attributed to specific users, making it impossible to determine who made configuration changes or investigate suspicious activity.
Vulnerabilities (When Safeguard Absent)
Decentralized Network Device Authentication
Network devices rely on local user accounts rather than centralized authentication (RADIUS, TACACS+, Active Directory), creating hundreds of unmanaged local credentials with no centralized password policy, rotation, or lifecycle management.
No Centralized Authorization or Accounting for Network Management
Network device access lacks centralized authorization policies defining who can execute which commands, and no centralized accounting records administrative actions, preventing role-based access control and audit trail generation.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |