IT‑IS‑Networking
Technology › Security Architecture

Device Administration & Identity

Who may type a command on production infrastructure, and what is recorded when they do — seventeen years across three platform generations, ending in multi-factor and duty-separated accounts.

Also known as TACACS+, AAA, Cisco ACS, Cisco ISE, RADIUS, Command Accounting, Privileged Access

Left to right is time. Each row is one of the 5 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Administrative access is the control that sits above every other control, because whoever holds it can change the rest. Seventeen years of owning it across an estate of 1,100-plus network devices produced three positions worth stating.

Make it a condition of entry. Central administration was set as a procurement requirement in 2006: equipment that could not be administered and logged centrally did not get onto the network. A requirement written into an evaluation is free; the same requirement after deployment is a replacement program.

Authentication is half the control. A platform can prove who logged in and still not record what they did afterwards, which is the half an auditor or an incident responder actually needs. Command accounting is the part that answers the question asked after something has gone wrong.

Design for the failure you have already had. Centralizing authentication creates a single point of failure for reaching everything else, and that is not a theoretical objection once a database has corrupted once and a certificate has expired once. The replacement platform was designed around those two events rather than around an assumption of availability.

It closed with multi-factor authentication on device administration against Active Directory, integration with network access control so identity and enforcement ran from one source, and an account naming standard separating internal from externally facing accounts and network duties from security duties.

Applied in

  • Port-Level Authentication: The 2006 Position2006–2023An argument made in 2006 that securing ports by MAC address was not the answer — held across four platform generations, and in production fifteen years later by a route other than the one proposed.
  • Administrative Identity for the Network Estate2006–2022Sixteen years and three platform generations of who may type a command on a city switch and what is recorded when they do — begun as a procurement condition in 2006, closed with multi-factor and a duty-separated account standard.

See also

Also searched as

  • zero trust
  • ZTNA
  • microsegmentation
  • least privilege network
  • IAM
  • PAM
  • privileged access management
  • MFA
  • identity governance
  • TACACS
  • RADIUS
  • 802.1X

Compliance-driven isolation and per-tenant policy, designed under regulatory constraint before the vocabulary existed.