Benefits of Oracle Adaptive Access Manager

Introduction to Oracle Adaptive Access Manager 1-3

1.2 Oracle Adaptive Access Manager Features

Adaptive access systems can provide the highest levels of security with context-sensitive online authentication and authorization. Thus, situations are evaluated and proactively acted upon based on various types of data. This section outlines key componentsfeatures used for authentication and fraud monitoring and detection. Application Access Security Oracle Adaptive Access Manager provides a number of rich features that strengthen existing web application login flows. Regardless of the type of authentication in place, Oracle Adaptive Access Manager can improve the level of security in a usable manner. Insider fraud, session hijacking, stolen credentials and other threats cannot be eliminated by strong, credential based authentication alone. Adding a risk-based challenge layer behind existing authentication can increase the level of security with minimal impact to the user experience – a critical factor for large deployments where desk calls can impact the bottom line. Oracle Adaptive Access Managers suite of virtual authentication devices combats phishing personalized images and phrases known only to the server and the end user. Furthermore, through the use of KeyPad and PinPad, security of the users credentials during entry can be assured by not capturing or transmitting the actual credential of the end user. This protects the credential from theft by malware and other similar threats. The virtual authentication devices are server driven; all features are provided without any client-side software or logic that can be compromised by key-loggers and other common malware. Additionally, Oracle Adaptive Access Manager performs device fingerprinting and behavioral profiling on every access to determine the likelihood that the authentication is being attempted by the valid user. Device Fingerprinting Oracle Adaptive Access Manager contains proprietary clientless technologies for fingerprinting and interrogating devices used during access requests and transactions. Device fingerprinting is a mechanism to recognize the devices a customer uses whether it is a desktop computer, laptop computer or other web-enabled device. Each time the user accesses the system, information about the device is collected. OAAM generates a unique single-use fingerprint and marks a device for each user session. It is replaced upon each subsequent fingerprinting process with another unique fingerprint. The fingerprinting process can be run any number of times during a user session to allow detection of changes mid-session that can indicate session hijacking. OAAM monitors a comprehensive list of device attributes. If any attributes are not available the device can still be fingerprinted. The single-use capabilities combined with server-side logic defends against the fingerprint being stolen and reused on another machine to commit fraud. Answer Logic Answer Logic increases the usability of Knowledge Based Authentication KBA questions by accepting answers that are fundamentally correct but may contain a small typo, abbreviation or misspelling. For example, if abbreviation is enabled in Answer Logic a user is challenged with the question What street did you live on in high school?They may answer 1st St. which is fundamentally correct even though when they registered the answer six months ago they entered First Street. By allowing a configurable variation in the form of correct answers, Answer Logic 1-4 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager dramatically increases the usability of registered challenge questions making the balance between security and usability firmly in the control of the enterprise. OTP Anywhere OTP Anywhere allows end users to authenticate themselves by entering a server generated one-time-password OTP which they can receive via SMS, email, instant message or voice channels. When the OTP is sent via SMS, the users cell phone serves as a physical second factor that the user has in their possession. As well, the authentication is being sent out-of-band to increase the level of assurance that only the valid user has access to the one-time password. When authentication methods such as Answer Logic and OTP Anywhere are applied based on the level of risk it can dramatically increase web application access security in a cost-effective and usable manner. Dashboard The Oracle Adaptive Access Manager Dashboard is a unified display of integrated information from multiple components in a user interface that organizes and presents data in a way that is easy to read. The Oracle Adaptive Access Manager dashboard present monitor data versions of key metrics. Administrators can easily see up-to-the-minute data on application activity from a security perspective. The reports that are presented help users visualize and track general trends. Case Management Oracle Adaptive Access Manager provides a framework and set of tools for investigators and customer service representatives. The Case Management feature of Oracle Adaptive Access Manager is used in two ways. ■ Users of the enterprise using Oracle Adaptive Access Manager can call the enterprise asking for assistance with customer-facing features of Oracle Adaptive Access Manager such as images, phrases, or challenge questions, or any issues with their account. The CSR uses Case Management to create a case which records all the actions performed by the CSR to assist the user as well as various account activities of the user. ■ The Case Management feature is also used by Fraud Investigators to investigate potentially fraudulent activity performed on user accounts. Knowledge-Based Authentication Oracle Adaptive Access Manager provides out-of-the-box secondary authentication in the form of knowledge-based authentication KBA questions. The KBA infrastructure handles registration, answers, and the challenge of questions. Since KBA is a secondary authentication method, it is presented after successful primary authentication. KBA is used to authenticate an individual based on knowledge of personal information, substantiated by a real-time interactive question and answer process. Oracle Adaptive Access Managers Rules Engine and organizational policies are responsible for determining if it is appropriate to use challenge questions to authenticate the customer. Policy Management Policies and rules can be used by organizations to monitor and manage fraud or to evaluate business elements. The policy and rules are designed to handle patterns or practices, or specific activities that you may run across in the day-to-day operation of