Select the Alert Group.

Managing Policies, Rules, and Conditions 10-51

10.34.10 Use Case: Edit Existing Security Policy

Jeff, a Security Administrator wants to change the maximum number of attempts at a challenge question. He must edit a rule parameter to do this. Best practice is to set the maximum number of failed KBA challenges to one less than the total number of challenge questions each user registers. For example, if all users register for four questions the maximum failures allowed should be three. To edit an existing Security Policy, follow these steps:

1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Policies. The Policies Search page is

displayed.

3. In the Search Results table, click Fraud Blocking.

4. In the Rules tab of the Policy Details page, click Maximum Number of Failed

Challenges .

5. In the Conditions tab of the Rule Details page, select User: Challenge Maximum

Failures on the top panel. This condition checks to see if the user failed to answer the challenge question for specified number of times.

6. On the bottom panel, change the value of Number of Failures More than or equal

to so that it is one less than the total number of challenge questions each user registers.

10.34.11 Use Case: Policy Set Scoring Engine

Jeff is a Security Administrator who wants the final risk score at each checkpoint to be based on the highest individual policy risk score. To meet this requirement he selects Maximum as the scoring engine at the Policy Set level. 1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Policy Set. The Policy Set page is displayed.

3. Click the Summary tab.

4. Select Maximum from the Scoring Engine list.

The Maximum Scoring Engine takes the highest policy score and uses it as the checkpoint score. This scoring engine ignores the policy weights.

5. Click Apply.

A confirmation dialog appears with the message, Policy Set details updated successfully.

6. Click OK.

10.34.12 Use Case: Copy Policy

The security team has decided some of the risk evaluations would work better before a user logs in. Jack, a Security Administrator must move a policy from the post-authentication checkpoint to the pre-authentication checkpoint to meet this new requirement. He looks through the rules in this policy to make sure they are all functional with the data available in pre-authentication. 1. Log in to OAAM Admin as an administrator. 10-52 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

2. In the Navigation tree, select Policies. The Policies Search page is displayed.

3. For the Checkpoint filter, select Post-Authentication and click Search.

4. Look through the policy descriptions in the Search Results table for ones that do

not occur after the password has been entered and ones that do not use conditions based on challenges. The Fraud Cant Challenge seems to be one that fits the criteria. The description for Fraud Cant Challenge is Applied to users with no challenge questions active .

5. Open the Fraud Cant Challenge policy to view its rules.

The rules involve devices, IPs, locations as inputs and there are no actions to challenge the user. Therefore, the policy can be used in the pre-authentication checkpoint.

6. In the Policy Details page, click Copy Policy.

7. In the Copy Policy dialog, select Pre-Authentication as the checkpoint.

8. Enter a name and description for the policy.

9. Select Active or Disabled as the policy status.

If you want the policy to be enabled as soon as it is created, select Active for Policy Status . If you want to policy to be disabled, select Disabled. A policy that is disabled is not enforced at the checkpoint.

10. Click Copy.

A copy of the policy is added to the Pre-Authentication checkpoint.

10.34.13 Use Case: Conditions: IP: Login Surge

William is a Security Administrator and he must configure a policy and rule to track the number of logins from the same IP and if there are more than 10 logins in 1 hour from an IP, a high alert should be triggered. 1. Log in to OAAM Admin as an administrator.

2. Create a Monitor IP group

a. In the Navigation tree, double-click Groups.

b. In the Groups Search page, click the New Group button.

The Create Group screen appears. c. Enter the group name, Monitor IPs, and select IP as the Group type and click Create .

d. In the Monitor IPs group page, click the IP tab.

e. In the IP tab, click the Add button.

f. In the Add IPs screen, select the Search and select from the existing IPs

option, enter criteria, then click Search. g. From the Search Results table, select one of the IPs that you want to monitor and click Add. A confirmation dialog appears.