Checkpoints Introduction to Policies, Rules, and Conditions

Managing Policies, Rules, and Conditions 10-7

10.1.14 Scoring Engine

A scoring engine is provided at the policy level and at the checkpoint level. The policy scoring engine is applied to rule scores to determine the risk for each policy. The policy set scoring engine is applied to the scores of the policies under a checkpoint to determines the score for the checkpoint. The default scoring engine at the checkpoint level is Maximum. For more information on the scoring engine, see Chapter 14, Using the Scoring Engine.

10.1.15 Import Policies

The policy is added to the system or it overwritesupdates an existing policy depending on whether the same policy name exists. If the name already exists, the policy is updated. If the name does not exist, the imported policy is added to the system. The policy and all of the groups attached to the policy are imported.

10.1.16 Policy Type

The concept of policy type has been removed from the product. Only security policies are available in 11g. Although policy types for the 10g policies are retained in the OAAM database, OAAM 11g ignores the policy types of Business, Third-party, and Workflow in the database and treats all policy types as Security policies for all purposes. Since there are no policy types, the policy type scoring engine is ignored and the scoring engine at the checkpoint level is applied for all policies.

10.1.17 Failure Counters

When a user fails a challenge, a counter is updated to indicate that user has had a failure. The failure counter looks across sessions. When a user has a maximum of three failures, he is locked from this type of challenge. For example, he could be OTP locked.

10.2 Planning Policies

Read the following section to help you in planning your policy. Rule Conditions Oracle Adaptive Access Manager has a library of conditions used to configure rules. To use these conditions, import them into your system by following the instructions in Section 10.26, Importing Conditions. Planning New Policies If you have created policies, use this chapter effectively in any order that is convenient for you. If you want to start creating policies for your system, follow this outline: 1. As you begin formulating a policy, gather intelligence from various sources to identify needs and develop requirements to address them. 10-8 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager For example, you can run reports to identify security trends that need to be addressed. 2. Given the results, develop requirements to address needs. ■ Use cases ■ Rule conditions ■ Expected outcomes action, alerts, and scores ■ Applications involved ■ User groups involved 3. Decide which type of scoring engine to apply. For information on scoring engines, see Chapter 14, Using the Scoring Engine. 4. Plan policies based on requirements. ■ Datapoints to profile ■ Rules for use cases ■ Thresholds defined by rules ■ Outcomes needed - scores, actions, and alerts ■ Exclusion groups For information on rule modeling, see Appendix E, The Discovery and OAAM Policy Development Processes. 5. Build alert and action groups so that they are available when you build the policy. For information, see Section 12.10, Creating a Group. 6. Create the policy. For information, see Section 10.8, Creating Policies.

10.3 Overview of Creating a Policy

This section presents an overview of creating a policy. To create a policy, the general steps are: 1. Search for the policy to see if the policy exists. 2. View policy details to see if the rule you need is available in the policy. 3. Create a policy with the appropriate name for example, Block-From-BlackList, type and assign the relevant checkpoint, scoring and weight. For more information on assigning scores and weight, see Chapter 14, Using the Scoring Engine. 4. Add the required rules with the conditions to the policy and use trigger combinations to determine the order of rule to be triggered. The new rules evaluate and handle patterns or practices, or specific activities that you may run across in the day-to-day operation of your business. There are two ways to add rules to a policy: ■ Create rules to add to the policy, or ■ Copy rules to the policy Managing Policies, Rules, and Conditions 10-9 5. Link the policy to the user group as appropriate. The policy and rules execute for the user group. Figure 10–3 Overview of Creating a Policy To create a new rule to add to a policy: 1. Specify the preconditions 2. Add conditions 3. Reorder conditionsmodify parameters 4. Specify result values Figure 10–4 Overview of Adding a New Rule

10.4 Navigating to the Policies Search Page

To open the Policies Search page, in the Navigation tree, double-click Policies. The Policies Search page is displayed. Alternatively, you can open the Policies Search page by: ■ Right-clicking Policies in the Navigation tree and selecting List Policies from the context menu. ■ Selecting Policies in the Navigation tree and then choosing List Policies from the Actions menu. ■ Clicking the List Policies button in the Navigation tree toolbar. The Policies Search page is the starting place for managing your policies. It is also the home page for the Security Administrator. From the Policies Search page, you can: ■ Search for a policy ■ View a list of policies ■ Create a new policy ■ Import a policy ■ Export policies ■ Export policies and create a delete script ■ Delete policies ■ Navigate to the Policy Details page