A technician is reviewing log files to track the number of times that a specific user has logged on to the networks. Which of the following security concepts is being used?

The scenario describes the process of tracking and logging user actions, specifically logon events, by reviewing log files. This is the definition of Accounting within the AAA (Authentication, Authorization, and Accounting) security framework. Accounting is responsible for collecting data on user activity, such as logon times, resources accessed, and duration of sessions. This information is then used for auditing, security analysis, and resource management. The technician's action of reviewing logs to track user logons is a direct application of the accounting principle.

B. Authorization: This concept involves granting or denying permissions to resources after a user has been authenticated. It does not involve tracking or logging past events.
C. Authentication: This is the process of verifying a user's identity (e.g., with a password or biometric scan) at the moment they attempt to log on, not the subsequent tracking of those events.
D. Non-repudiation: This is a security service that provides proof of the integrity and origin of data, ensuring a user cannot deny having performed an action. While accounting logs can support non-repudiation, the act of tracking itself is accounting. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5

"Security and Privacy Controls for Information Systems and Organizations":

Reference: Appendix D

Glossary

page D-1.

Content: Defines Accountability as "The property of a system or system resource that ensures that the actions of a system entity may be traced uniquely to that entity." The control family AU (Audit and Accountability) directly addresses the mechanisms

like event logging (AU-2)

required to achieve this.

2. Internet Engineering Task Force (IETF) RFC 2866

"RADIUS Accounting":

Reference: Section 1

"Introduction

" Paragraph 1.

Content: This foundational document states

"This document describes a protocol for carrying accounting information between a Network Access Server and a shared Accounting Server." It specifies tracking attributes like session start and stop times

which directly corresponds to tracking user logons.

3. MIT OpenCourseWare

Course 6.857: Computer and Network Security

Fall 2017:

Reference: Lecture 15 Notes

"Network Security

" Section on AAA.

Content: The courseware explicitly defines the components of AAA. Accounting is defined as the question "what did you do?" and is associated with logging and auditing user actions

which is precisely what the technician in the scenario is doing.