Policies Introduction to Policies, Rules, and Conditions

Managing Policies, Rules, and Conditions 10-5 ■ Wire transfer The policy is executed when the user is on a wire transfer page. Bill pay and Wire transfer are used as examples of possible points during a session. They are not available in Oracle Adaptive Access Manager out of the box. Checkpoint Example A fraudster has stolen a users user name and password and wants to perform a wire transfer. To accomplish the goal of performing a wire transfer, the fraudster must pass through multiple security gates. The frauster is caught during Post-Authentication. For example, if the frauster is using an anonomyzing proxy to mask the location, a challenge might occur during Post-Authentication. When the frauster fails to provide the correct answers, fraud is prevented.

10.1.5 Groups

Groups are like items that have been gathered together to simplify configuration workloads. Grouping enables you to view and administer the collection of like items as a single group instead of administering the individual members of a group. The types of groups you can create include User ID, User Name, Location, Device, Action, and Alert.

10.1.6 Actions and Action Groups

Actions are used to control the application flow. An action is an event activated when a rule is triggered. For example: block access, challenge question, ask for PIN or password, and so on. An action can be also activated based on a score for particular checkpoint. The client applications like OAAM Server or the native integrated client influence the resultant out-of-the-box actions. Users may also create custom actions that are used by their applications. Action groups are used as results within rules so that when a rule is triggered all of the actions within the groups are activated. For information on action groups, see Chapter 12, Managing Groups.

10.1.7 Alerts and Alert Groups

Alerts are messages that indicate the occurrence of an event. An event can be that a rule was triggered, a trigger combination was met or an override was used. Alert groups are used as results within rules so that when a rule is triggered all of the alerts within the groups are created. For information on creating an alert, see Chapter 12, Managing Groups.

10.1.8 User Group Linking

In Group Linking, the Run mode can be specified to execute policies for all users or selected user groups. Linking enables the policy to executerun for the set of users within the linked group. The Linked Users option links a policy to a User ID group or several User ID groups. 10-6 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager The All Users option links a policy to all users. If group linking shows All Users, all the available linking is ignored. If a user selects group linking as All Users, the link option would be disabled.

10.1.9 Run Mode

Run mode is either All Users or Linked Users. It determines if a policy is evaluated for all users or for the user groups linked to that policy. If a policy is being evaluated as a nested policy then the run mode is ignored.

10.1.10 Trigger Combinations and Triggers

Trigger combinations are additional results and policy evaluation that are generated if a specific sequence of rules trigger. Trigger combinations can be used to override the outcome of rules. Each trigger combination can specify alerts, actions and either a score or another policy to run. Trigger combinations evaluate sequentially, stopping as soon as a rule return combination is matched. Alerts are added to any actions and alerts triggered by individual rules. Action group replace the actions returned by the individual rules. When a trigger combination triggers another policy, that policy is said to be nested within the policy. A policy can be nested within other policies and also can be evaluated on its own. For information on trigger combinations, see Section 10.13, Working with Trigger Combinations. For an example of setting up a trigger combination, see Section 10.34.7, Use Case: Trigger Combination.

10.1.11 Nested Policies

A nested policy is a secondary policy used to further quantify the risk score in instances where the original result output by the system is inconclusive. Nested policies can be assigned to ensure a higher degree of accuracy for the risk score. A nested policy in a trigger combination is executed only when a specific sequence of rule results is sent from the primary policy. Nested policies therefore reduce false positives and negatives.

10.1.12 Evaluating a Policy within a Rule

Oracle Adaptive Access Manager can evaluate another policy as part of a rule by using the System: Evaluation Policy condition. The result of the evaluated policy is propagated. This is called a condition execution.

10.1.13 Scores and Weight

The score is a number configured by the user that is assigned to a rule when the rule evaluates to true. The user can configure a scoring policy that is used to combine the scores of the rules in a policy and assign a score to the policy. The scores from various policies are combined using a policy set level scoring policy. Weight is the multiplier values used on policies scores to influence the total score. For more information on scores and weights and how they are used in risk assessment, see Chapter 14, Using the Scoring Engine.