Start here — Studying AAA (CyBOK KA 14)
How to use this folder. The BOKSA article gives you the map; this folder contains the actual study material. Work through the numbered documents in order — each one covers a part of the topic and points you to one or two core resources (reading, video or audio). Total self-study time for the whole topic: roughly half a day.
What you are studying
Every secure system answers three questions in order: who are you (authentication), what may you do (authorisation), what did you do (accountability). The documents in this folder:
- Identification, authentication factors and MFA — how systems prove who you are.
- Authentication in distributed systems — OAuth 2.0/OpenID Connect, SAML and Kerberos: how "Log in with..." actually works.
- Authorisation: models and enforcement — least privilege, RBAC/ABAC, and why "broken access control" is the number-one web risk.
- Accountability and logging — making actions traceable, and protecting the evidence.
The authoritative sources for the whole topic
- CyBOK KA 14 — Authentication, Authorisation & Accountability (Gollmann, v1.0.2) — the reference text. Dense; use it to look things up, not to read cover-to-cover.
- CyBOK AAA webinar (video) and CyBOK AAA podcast (audio) — the same ground in other media, straight from the CyBOK team.
- NIST SP 800-63 Digital Identity Guidelines, Revision 4 (2025) — the standard you cite when advising on password, MFA and identity policy.
All links in this folder were checked and working on 6 July 2026.