CISMP-V9 BCS Foundation Certificate in Information Security Management Principles V9.0

The AAA Triad in Information Security stands for Authentication, Authorization (also known as

Authorisation), and Accounting. These three components are fundamental to ensuring that access to

systems is controlled and monitored:

Authentication is the process of verifying the identity of a user or entity. It ensures that individuals

are who they claim to be. This can involve methods such as passwords, biometrics, or tokens.

Authorization determines what an authenticated user is allowed to do. It involves granting or

denying rights to access resources and perform actions within a system based on the user’s identity.

Accounting keeps track of user activities. This includes logging when users log in and out, what

actions they perform, and what resources they access. It’s essential for auditing purposes and can

also be used for billing or analyzing resource usage.

These principles are designed to protect information by managing potential risks and controlling

access to data. They are part of a broader framework that includes physical, technical, and

procedural controls to safeguard information assets.

Security controls are measures taken to safeguard an information system from attacks or to mitigate

the impact of a breach. They are commonly classified into three main categories: preventive,

detective, and corrective. Preventive controls aim to prevent incidents before they occur, detective

controls are designed to discover and detect security events, and corrective controls are intended to

restore systems to normal operation after an incident. The term “nominative” is not recognized as a

standard classification of security controls within the principles of information security

management.