But CIA are three attributes of data. We have, along with them, others. We need the characteristic of authentication. Now, in Identity and Access Management, this is the first of what is called the Triple A Services. The action of authentication requires the establishment of an identifier, a submission process through which that identifier is offered a repository of identities, of course, and a process separate from this to populate it, and a physical or electronic modality to verify this identity.

Now, authentication itself is the action of verifying a presented or claimed identity, the e-persona, as I've mentioned in earlier modules. Now, this would be the equivalent of a user offering a username or a user ID, a system component or workstation MAC address, IP address, or SID number, or a badge in a physical form with a photo and a magstripe that can be used for accessing places and spaces, as well as visual recognition of the person whose image is on it.

The second of the Triple A Services is authorization. It must follow authentication, because authorization is made up of two separate but interdependent processes, first of which is a process to establish the subject identity that requires an independent verification of this claimed identity and its registration in the target system user repository. There also must be a process for provisioning a set of resources, such as applications, data, and services, that will meet the independently verified and constructed profile that confirms and reflects the established need to know that served to create it in the first place. Authorization must therefore follow authentication. And once the authentication has been successfully established, authorization connects that subject to the defined resource scope and enables the subject to make use of them within a defined privilege and rights set.

Accountability is the third of the Triple A Services, and this is made up of two separate but tightly related actions, the first of which, and this covers all actions taken by a process or a person, is the accounting. And this is the automated recording of usage and subject-object interactions throughout the system. This is typically performed through the vehicle of the access control system and written to a system log, which itself is kept highly secure. The related and second action would be the auditing, something that the human elements will perform, in reviewing the records to establish compliance and correctness, or to identify anomalies and violating behaviors. And through accounting, the recording of these, and auditing our action to review them, we establish accountability to that subject or the process for the actions that it clearly has taken. And the log that we will review will visualize these actions in order to confirm compliance with policy and its assigned privileges, and give us the availability of options to correct this should it prove to be incorrect.