Use Case 8: Register High Risk Lockout Use Case 9: High Risk Exclusion

Part IV Part IV Managing Policy Configuration This part contains information about managing policy configurations in Oracle Adaptive Access Manager 11g. It contains the following chapters: ■ Chapter 10, Managing Policies, Rules, and Conditions ■ Chapter 11, OAAM Security and Autolearning Policies ■ Chapter 12, Managing Groups ■ Chapter 13, Managing the Policy Set ■ Chapter 14, Using the Scoring Engine ■ Chapter 15, Creating Checkpoints ■ Chapter 16, Managing System Snapshots 10 Managing Policies, Rules, and Conditions 10-1 10 Managing Policies, Rules, and Conditions Policies are used by organizations to monitor and manage fraud or to evaluate business elements. Policies contain security rules and configurations used to evaluate the level of risk at each checkpoint. This chapter introduces you to the concepts behind policies, rules and conditions and provides information about creating and managing them.

10.1 Introduction to Policies, Rules, and Conditions

This section introduces you to the concept of policies and rules and how they are used in Oracle Adaptive Access Manager.

10.1.1 Policies

A policy is a collection of rules associated with a checkpoint. The outcome of the policy evaluation is a score, actions and alerts. The policy outcomes can be used to enforce decisions by client applications. For information on rules, see Section 10.1.2, Rules. Using Oracle Adaptive Access Manager, you can create policies based on your business requirements. The attributesdatapoints of the activities you are interested in are mapped to conditions and the evaluations to perform are translated into rules. These rules are added to a policy. Checkpoints are set up in the session for when the policy evaluates the activity. For example, a policy can be executed during the Pre-Authentication checkpoint. The Pre-Authentication checkpoint is a point in time before the user enters the password. When the rules are run, data is collected. For information, see Section 10.1.4, Checkpoints. During the normal course of business, the system looks for datapoints the conditions were mapped to. When all the conditions met, the system calculates a score, and depending on the policy that you defined earlier for handling the situation, it may generate alerts in real-time, or trigger actions, or both. For example, outcomes can be challenging or blocking the user or activating an alert. A rule evaluates to true when all the conditions match. The outcome of a rule is a score and optionally actions or alerts, or answers and alerts. The outcome of a policy is decided by applying a scoring policy on the rule scores of the policy. In addition to the score, you can optionally configure trigger combinations which are combinations of rule results of the policy and that can invoke actions andor generate alerts. For more information about trigger combinations, see Section 10.1.10, Trigger Combinations and Triggers.