Triple A Services


Domain 3:2 - Design Considerations
The CIA Triad

The course is part of this learning path

Start course

This is the second course in Domain 3 of the CSSLP certification and covers the essential ideas, concepts, and principles that you need to take into account when building secure software.

Learning Objectives

  • Understand security design principles as different from actual software design principles
  • Understand the relationship between the interconnectivity and the security management interfaces
  • Learn how to balance potentially competing or seemingly conflicting requirements to obtain the right security level

Intended Audience

This course is intended for anyone looking to develop secure software as well as those studying for the CSSLP certification.


Any experience relating to information security would be advantageous, but not essential. All topics discussed are thoroughly explained and presented in a way allowing the information to be absorbed by everyone, regardless of experience within the security field.


But CIA are three attributes of data. We have, along with them, others. We need the characteristic of authentication. Now, in Identity and Access Management, this is the first of what is called the Triple A Services. The action of authentication requires the establishment of an identifier, a submission process through which that identifier is offered a repository of identities, of course, and a process separate from this to populate it, and a physical or electronic modality to verify this identity.

Now, authentication itself is the action of verifying a presented or claimed identity, the e-persona, as I've mentioned in earlier modules. Now, this would be the equivalent of a user offering a username or a user ID, a system component or workstation MAC address, IP address, or SID number, or a badge in a physical form with a photo and a magstripe that can be used for accessing places and spaces, as well as visual recognition of the person whose image is on it.

The second of the Triple A Services is authorization. It must follow authentication, because authorization is made up of two separate but interdependent processes, first of which is a process to establish the subject identity that requires an independent verification of this claimed identity and its registration in the target system user repository. There also must be a process for provisioning a set of resources, such as applications, data, and services, that will meet the independently verified and constructed profile that confirms and reflects the established need to know that served to create it in the first place. Authorization must therefore follow authentication. And once the authentication has been successfully established, authorization connects that subject to the defined resource scope and enables the subject to make use of them within a defined privilege and rights set.

Accountability is the third of the Triple A Services, and this is made up of two separate but tightly related actions, the first of which, and this covers all actions taken by a process or a person, is the accounting. And this is the automated recording of usage and subject-object interactions throughout the system. This is typically performed through the vehicle of the access control system and written to a system log, which itself is kept highly secure. The related and second action would be the auditing, something that the human elements will perform, in reviewing the records to establish compliance and correctness, or to identify anomalies and violating behaviors. And through accounting, the recording of these, and auditing our action to review them, we establish accountability to that subject or the process for the actions that it clearly has taken. And the log that we will review will visualize these actions in order to confirm compliance with policy and its assigned privileges, and give us the availability of options to correct this should it prove to be incorrect.

About the Author
Learning Paths

Mr. Leo has been in Information System for 38 years, and an Information Security professional for over 36 years.  He has worked internationally as a Systems Analyst/Engineer, and as a Security and Privacy Consultant.  His past employers include IBM, St. Luke’s Episcopal Hospital, Computer Sciences Corporation, and Rockwell International.  A NASA contractor for 22 years, from 1998 to 2002 he was Director of Security Engineering and Chief Security Architect for Mission Control at the Johnson Space Center.  From 2002 to 2006 Mr. Leo was the Director of Information Systems, and Chief Information Security Officer for the Managed Care Division of the University of Texas Medical Branch in Galveston, Texas.


Upon attaining his CISSP license in 1997, Mr. Leo joined ISC2 (a professional role) as Chairman of the Curriculum Development Committee, and served in this role until 2004.   During this time, he formulated and directed the effort that produced what became and remains the standard curriculum used to train CISSP candidates worldwide.  He has maintained his professional standards as a professional educator and has since trained and certified nearly 8500 CISSP candidates since 1998, and nearly 2500 in HIPAA compliance certification since 2004.  Mr. leo is an ISC2 Certified Instructor.

Covered Topics