Educate & Certify Queries

 

RADIUS or TACACS

Q: In studying for my Security+ Exam, I'm confused about the difference(s) in RADIUS and TACACS?

This question comes up a lot, in study and on the actual exam. Both provide Authentication, Authorization, and Accounting (AAA) services for enterprise networks. The answer is quite simple actually and can be reduced to 5 simple points differentiation:

1. RADIUS is an Internet standard governed by RFC; TACACS is Cisco proprietary
2.  RADIUS uses less overhead than TACACS (the next three bullets illustrate that)
3. RADIUS is UDP based traffic while TACACS is TCP based
4. RADIUS only encrypts the authentication traffic passwords; TACACS encrypts the entire session including authentication, authorization, and accounting data.
5. RADIUS combines authentication and authorization; TACACS separates authentication, authorization, and accounting

Some security professionals consider RADIUS to be less secure than TACACS because of the limited encryption of authentication traffic. Although, RADIUS has protection against replay attacks by using MD5 hashing, all other data is in the clear presenting potential leakage of sensitive data transmitted in authorization and accounting packets. Regardless, most networks use RADIUS. More information can be found:

• CISCO's Comparison - http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml
• RFC 2865 RADIUS - hhttp://www.ietf.org/rfc/rfc2865.txt?number=2865

---

The Resurgence of Certification

Q:  It appears that certification is making a comeback. Why now?

Did it ever subside?  I argue that it didn’t.  For about a decade certification was “the cake”; then, for a few years it was the “icing on the cake”.  Then it turned south when the mere word certification began to carry a negative connotation as exam cram training and paper credentialing became prevalent all for the sake of the mighty dollar.  Today, there has been resurgence in certification.  I like to think it’s because of industry self correction through mechanisms such as performance based testing, experience prerequisites, and endorsement requirements.  Certification is now right where it should be, the validation of the one’s knowledge, skill, and abilities.

Both professional and technical certifications have experienced resurgence as evidenced by the number of industries now requiring them of their personnel.  Take the U.S. Department of Defense…  A few years ago, they mandated that all information assurance professionals hold an industry leading information security certification (see U.S. DoDD 8570.1).  That’s over 100,000 government and contract staff!  The contractor community is now scrambling to certify their current staff and acquire new certified staff to compete for DoD contracts.  I will confess that the ball on this mandate started rolling shortly after the tragedy of September 11th.  Nevertheless, the government thought the best way to secure the country was to demand qualified professional are in positions of security importance, and that the way to do that was to make sure staff had baseline knowledge evidence through holding an industry certification.  Moreover, open the jobs section of the newspaper or peruse your favorite jobs website to witness industry’s desire to quickly and reliably identify qualified employment candidates.

The comeback is timely and needed, and is healthy for the IT industry and beyond.