Theory: Accounting & Zero Trust
The third A in AAA is Accounting: keeping a record of what each identity actually did. Authentication and authorization decide what should happen; accounting is how the organization can later show what did happen. The lesson ends with Zero Trust, a mindset that applies all three As continuously rather than once at login.
Accounting: What and Why
Accounting: recording user activity: who did what, when, and where.
MediCare Plus examples of what gets recorded:
- login and logout times;
- who viewed which patient record;
- denied access attempts (someone tried to open a record they are not authorized for);
- who edited or deleted data.
Accounting serves four purposes:
| Purpose | What it gives the organization | MediCare Plus example |
|---|
| Accountability | Know who is responsible if something goes wrong | A wrong medication change can be traced to a specific account |
| Detection | The starting point for spotting unusual behaviour | Many denied attempts or a login at 3 a.m. from outside the hospital stands out |
| Compliance | Evidence required by laws such as Thailand’s PDPA | Showing an auditor who accessed personal health data |
| Forensics | The key evidence during an incident investigation | Reconstructing exactly what an intruder did, step by step |
Accounting only works if each log entry is tied to one real person. This is why shared or generic accounts (Week 4) are so damaging: a log that says “nurse1 changed the order” proves nothing about which nurse did it.
Keeping Records Trustworthy
A log is only useful if people can believe it and if it still exists when needed.
Protect log integrity
Logs must not be editable by the same people they watch. Otherwise an attacker (or a dishonest administrator) can erase their own tracks.
Ways to achieve this include sending logs to a separate system that administrators of the monitored system cannot modify, and making log storage append-only. This is Separation of Duties (5.2) applied to records: the person being watched is not the person who controls the record.
Set a retention period
Keep logs long enough to be useful for investigation: not forever, and not too short either.
- Too short: incidents are often discovered weeks or months later; if the logs have already been deleted, the evidence is gone.
- Forever: logs themselves contain personal data (who viewed which patient), cost money to store, and keeping personal data longer than necessary creates its own privacy risk.
MediCare Plus example: in a dispute over a medication error, the access log is the only proof of who viewed the chart, and when. If the log could be edited, or had been deleted after 7 days, the hospital could prove nothing.
Accounting is not only about catching attacks as they happen. Much of its value comes after the fact: answering questions in an audit, a lawsuit or an investigation weeks later. That is why integrity and retention matter as much as collection.
Zero Trust: Never Trust, Always Verify
Traditional thinking treated the network like a castle: once you were inside (logged in, on the hospital network), you were trusted. Zero Trust rejects that idea.
Zero Trust: “never trust, always verify.” It applies Authentication + Authorization + Accounting continuously, not just once at login.
Its three ideas:
| # | Principle | Meaning | MediCare Plus example |
|---|
| 1 | Re-verify continuously | Don’t assume one login is good for the whole session | Opening a Restricted record or making a large change asks for re-authentication; an unusual change in device or location triggers a fresh check |
| 2 | Location isn’t safety | Being inside the hospital network does not mean automatic trust | A ward workstation request is checked just as carefully as one from home |
| 3 | Log and monitor constantly | Zero Trust depends on Accounting | Every request is logged, so unusual patterns can be spotted |
Diagram loads as you scroll.
Common mistake: “Zero Trust means trusting nobody, so nobody can access anything.” Zero Trust does not block legitimate users; it means trust is never assumed. Every request must be verified, and access is still granted when the checks pass.
How the Week Fits Together
| Building block | Fails when… | Example consequence |
|---|
| Identity | Accounts are not deprovisioned | A former contractor can still log in |
| Authentication | Only a password is used | A stolen password is enough to get in |
| Authorization | Roles are too broad | A user who needs Read has Write |
| Accounting | Logs are missing, editable or not reviewed | Misuse is found late, or cannot be proven |
| Zero Trust | Trust is given once and never checked again | A login from an unusual place at night is not questioned |
Worked Examples
Exercise 1
For each MediCare Plus situation, name which of the four purposes of accounting (Accountability, Detection, Compliance, Forensics) it mainly serves.
- A PDPA auditor asks the hospital to show who accessed a patient’s record last year.
- A security alert fires because one account was denied access to 50 records in ten minutes.
- After a ransomware attack, investigators use logs to reconstruct how the attacker moved between systems.
- A wrong drug dose is entered; the log shows which named pharmacist approved it.
Show solution ↓Hide solution ↑
Solution
- Compliance: proving to a regulator that personal data access is controlled and recorded, as required by law.
- Detection: unusual behaviour (many denied attempts) is the starting point for spotting misuse.
- Forensics: logs are the key evidence for reconstructing an incident.
- Accountability: knowing who is responsible when something goes wrong.
Exercise 2
At MediCare Plus, the system administrator can edit and delete the EHR’s access logs. Explain why this is a problem and propose a fix, naming the design principle involved.
Show solution ↓Hide solution ↑
Solution
Problem: logs must not be editable by the people they watch. The administrator is one of the most powerful users of the EHR; if they misuse their access (or their account is taken over), they can delete the evidence, so neither detection nor accountability works for exactly the account that most needs watching.
Fix: send EHR logs to a separate, append-only log store that the EHR administrator cannot modify, managed and reviewed by someone else (e.g. the security officer).
Principle: Separation of Duties: the person whose actions are recorded is not the person who controls the record.
Exercise 3
A MediCare Plus manager proposes keeping access logs for 7 days to save storage. Another proposes keeping them forever “just in case.” Evaluate both.
Show solution ↓Hide solution ↑
Solution
7 days is too short. Incidents and disputes are often discovered weeks or months later (for example, a pharmacist notices a strange order, or a patient complains about a privacy breach). By then, 7-day logs are gone and the hospital can prove nothing: forensics, compliance and accountability all fail.
Forever is too long. Logs contain personal data (who viewed which patient), storage has a cost, and keeping personal data longer than needed creates its own privacy and compliance risk.
Recommendation: set a defined retention period long enough to cover realistic investigations and legal/regulatory requirements, then securely delete. Neither extreme: keep logs long enough to be useful, but not forever.
Exercise 4
A doctor logs in at 08:00 on a ward workstation inside the hospital. At 14:00 the same session is used, from a different workstation, to export 2,000 patient records. Under the old “trusted once inside” approach nothing happens. Explain how each Zero Trust principle would change this.
Show solution ↓Hide solution ↑
Solution
- Re-verify continuously: the 08:00 login should not be treated as good for the whole day. A bulk export of 2,000 records is a high-risk action, so the system asks the doctor to authenticate again (e.g. MFA) before allowing it.
- Location isn’t safety: being on a hospital workstation inside the network does not make the request trustworthy by itself; it is evaluated like any other request (and authorization checks whether a doctor’s role normally exports bulk records at all).
- Log and monitor constantly: the export is logged and flagged as unusual, so security staff can review it even if it was allowed.
Final answer: Zero Trust turns one check at login into a check on every sensitive request, so the session alone is not enough to export the data.
Exercise 5
Explain the statement: “Zero Trust depends on Accounting.”
Show solution ↓Hide solution ↑
Solution
Zero Trust decides each request based on what is normal for that user, device and context, and it must be able to review decisions afterwards. Both come from accounting:
- Without records of past activity, there is no baseline to tell that a 3 a.m. login from abroad is unusual.
- Without logs of each request, continuous verification leaves no evidence, so nobody can investigate a request that should not have been allowed.
Accounting supplies the history and evidence that continuous verification relies on; without it, “always verify” has nothing to verify against.