TACACS+ (Terminal Access Controller Access-Control System Plus) is a centralized protocol used to manage administrative access to network devices such as routers, switches, and firewalls. It separates three functions: authentication verifies who the administrator is, authorization decides what commands or actions they may perform, and accounting records what they did. In practice, device logins are checked against a TACACS+ server instead of using only local credentials stored on each device.
This matters because TACACS+ sits on the trust path for network control. If an attacker compromises the TACACS+ service, management host, or connected credentials, they may gain privileged access across many devices or alter audit trails. Defenders use segmentation, strict access controls, encrypted transport, redundant servers, and consistent logging to reduce that risk. In real attacks, targeting TACACS+ infrastructure can help an intruder expand from one foothold into broad administrative control while making their activity harder to trace.