Conditions Introduction to Policies, Rules, and Conditions

10-6 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager The All Users option links a policy to all users. If group linking shows All Users, all the available linking is ignored. If a user selects group linking as All Users, the link option would be disabled.

10.1.9 Run Mode

Run mode is either All Users or Linked Users. It determines if a policy is evaluated for all users or for the user groups linked to that policy. If a policy is being evaluated as a nested policy then the run mode is ignored.

10.1.10 Trigger Combinations and Triggers

Trigger combinations are additional results and policy evaluation that are generated if a specific sequence of rules trigger. Trigger combinations can be used to override the outcome of rules. Each trigger combination can specify alerts, actions and either a score or another policy to run. Trigger combinations evaluate sequentially, stopping as soon as a rule return combination is matched. Alerts are added to any actions and alerts triggered by individual rules. Action group replace the actions returned by the individual rules. When a trigger combination triggers another policy, that policy is said to be nested within the policy. A policy can be nested within other policies and also can be evaluated on its own. For information on trigger combinations, see Section 10.13, Working with Trigger Combinations. For an example of setting up a trigger combination, see Section 10.34.7, Use Case: Trigger Combination.

10.1.11 Nested Policies

A nested policy is a secondary policy used to further quantify the risk score in instances where the original result output by the system is inconclusive. Nested policies can be assigned to ensure a higher degree of accuracy for the risk score. A nested policy in a trigger combination is executed only when a specific sequence of rule results is sent from the primary policy. Nested policies therefore reduce false positives and negatives.

10.1.12 Evaluating a Policy within a Rule

Oracle Adaptive Access Manager can evaluate another policy as part of a rule by using the System: Evaluation Policy condition. The result of the evaluated policy is propagated. This is called a condition execution.

10.1.13 Scores and Weight

The score is a number configured by the user that is assigned to a rule when the rule evaluates to true. The user can configure a scoring policy that is used to combine the scores of the rules in a policy and assign a score to the policy. The scores from various policies are combined using a policy set level scoring policy. Weight is the multiplier values used on policies scores to influence the total score. For more information on scores and weights and how they are used in risk assessment, see Chapter 14, Using the Scoring Engine. Managing Policies, Rules, and Conditions 10-7

10.1.14 Scoring Engine

A scoring engine is provided at the policy level and at the checkpoint level. The policy scoring engine is applied to rule scores to determine the risk for each policy. The policy set scoring engine is applied to the scores of the policies under a checkpoint to determines the score for the checkpoint. The default scoring engine at the checkpoint level is Maximum. For more information on the scoring engine, see Chapter 14, Using the Scoring Engine.

10.1.15 Import Policies

The policy is added to the system or it overwritesupdates an existing policy depending on whether the same policy name exists. If the name already exists, the policy is updated. If the name does not exist, the imported policy is added to the system. The policy and all of the groups attached to the policy are imported.

10.1.16 Policy Type

The concept of policy type has been removed from the product. Only security policies are available in 11g. Although policy types for the 10g policies are retained in the OAAM database, OAAM 11g ignores the policy types of Business, Third-party, and Workflow in the database and treats all policy types as Security policies for all purposes. Since there are no policy types, the policy type scoring engine is ignored and the scoring engine at the checkpoint level is applied for all policies.

10.1.17 Failure Counters

When a user fails a challenge, a counter is updated to indicate that user has had a failure. The failure counter looks across sessions. When a user has a maximum of three failures, he is locked from this type of challenge. For example, he could be OTP locked.

10.2 Planning Policies

Read the following section to help you in planning your policy. Rule Conditions Oracle Adaptive Access Manager has a library of conditions used to configure rules. To use these conditions, import them into your system by following the instructions in Section 10.26, Importing Conditions. Planning New Policies If you have created policies, use this chapter effectively in any order that is convenient for you. If you want to start creating policies for your system, follow this outline: 1. As you begin formulating a policy, gather intelligence from various sources to identify needs and develop requirements to address them.