OAAM Challenge Oracle Fusion Middleware Online Documentation Library

OAAM Security and Autolearning Policies 11-27

11.5.6 Customer Care Policies

Customer care policies are presented in this section.

11.5.6.1 OAAM Customer Care Ask Question

This policy determines if the user has active questions, more questions left for the challenge, and how many challenges have failed.

11.5.6.1.1 OAAM Customer Care Ask Question Policy Summary

11.5.6.1.2 OAAM Customer Care Ask Question Flow Diagram

11.5.6.1.3 OAAM Customer Care Ask Question: Details of Rules

Challenge the user with email if he is registered for email and he did not fail the email challenge the maximum number of times yet. Check for High Risk Score = Any Questions Active = Any Challenge Email Available = TRUE Challenge SMS Available = Any Max failed Question Attempts = Any Max failed Email Attempts = FALSE Max failed SMS Attempts = Any Policy = NONE Action = OAAM Challenge Email Alert = NONE Score = 0 Block the user if he has not registered for questions or OTP and the risk score is High. This block can be overridden using the Temp Allow functionality. Check for High Risk Score = TRUE Questions Active = FALSE Challenge Email Available = FALSE Challenge SMS Available = FALSE Max failed Question Attempts = Any Max failed Email Attempts = Any Max failed SMS Attempts = Any Policy = NONE Action = OAAM BLOCK Alert = NONE Score = 0 Challenge Block the user if he failed to answer all types of challenge mechanisms. Note: This block cannot be overridden through the Temp Allow functionality. All rules with result = ANY Policy = NONE Action = OAAM Challenge BLOCK Alert = NONE Score = 0 Table 11–23 OAAM Customer Care Ask Question Policy Summary Details Purpose Determines if the user has active questions, more questions remaining for challenges, and how many challenges have failed. Scoring Engine Weighted Maximum Weight 100 Group Linking All Users Table 11–22 Cont. OAAM Challenge Trigger Combinations Description Combination Detail Result 11-28 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

11.5.6.1.4 OAAM Customer Care Ask Question: Trigger Combinations

None

11.6 Use Cases

The following sections provide security policy use case scenarios.

11.6.1 Use Case: WebZIP Browser

All users using a WebZIP browser must be blocked from attempting a login. 1. user1 uses WebZip and tries to log in to the application. 2. user1 is blocked. 3. The administrator logs in to OAAM Admin. 4. The administrator views the session for user1.

5. The administrator sees that Rule: WEBZIP used was triggered.

Table 11–24 OAAM Customer Care Ask Question Rule Details Rule Rule Condition and Parameters Results No Questions USER: Question Status Triggers when users do not have questions registered. Two possible scenarios are un-registered users and users with questions reset by customer care. Question status of the user User Question Status=Not Set Is=True Action = OAAM No User Questions Alert = NONE Score = 0 Weight=100 Maximum Answers Failed USER: Challenge Channel Failure Triggers when user failed maximum allowed answers with current question. Count is combination of customer care and online challenge. If a user has a failure counter value over a specified value from specific channel Challenge Channel=select Current Question Count only? = true Failures greater than or equal to = 3 Action = OAAM Next Question Alert = NONE Score = 0 Weight=100 Question Blocked User: Challenge Question Failure Checks how many questions have failures Failure more than or equal to=1 Action = OAAM Reset Question Alert = NONE Score = 0 Weight=100 Maximum Questions Failed User: Question Failure Triggers when user fails the maximum allowed questions. Failure more than or equal to=3 Action = NONE Alert = NONE Score = 0 Weight=100 OAAM Security and Autolearning Policies 11-29

11.6.2 Use Case: IP Risky User OTP Challenge

User test user is a registered user. He is traveling on business to a different country and does not have access to email or phone. The IP he logs in from is considered a risky IP and hence, he is challenged by SMS. Since he cannot access his OTP, he fails to answer the OTP challenge by SMS. He is now challenged via KBA and unfortunately, he forgot the answers to his challenge questions. He guesses and answers the questions incorrectly. He is now locked out of the system. He calls the CSR and proves his identity. The CSR unlocks the user so he can log in again.

1. OTP is set up for SMS and Email.

2. The auto-learning policy OAAM does user have profile is disabled.

3. The user is registered as testuser.

4. His IP is in the Risky IP group.

5. testuser tries to log in to the application.

6. testuser is challenged via SMS.

7. testuser answers incorrectly 3 times.

8. testuser is challenged via KBA.

9. testuser answers challenge question incorrectly 3 times.

10. testuser is locked out.

11. CSR must create a case and then unlock challenge questions for the user.

12. testuser is able to log in to the application successfully.

11.6.3 Use Case: Anonymizer IP - From the Group

User anonymizer logs in using an IP which is considered an anonymizer in the Quova geolocation database. The user is blocked and a case is automatically created with the proper information. The investigator works on the case, adds a disposition, and closes the case. Administrator 1. The administrator logs in to OAAM Admin. 2. He creates a new action instance using the action template Create customer care case. 3. He selects the post -authentication checkpoint, the Block action, a score of 1000, and case type 2. User 1. New user anonymizer tries to log in to the application. 2. The user is blocked. A fraud case is automatically created. Investigator 1. The investigator logs in to OAAM Admin as an Investigator. 2. He opens the case and adds notes. 3. He closes the case with a disposition. 11-30 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

11.6.4 Use Case: Pattern Based Evaluation

User test user2 is a registered user. He resides in the United States and hence, all his logins are typically from the United States. He is traveling on business to China and performs a few logins from there. Since OAAM identifies that this is not the normal behavior, it challenges the user. Rules: ■ The rule only triggers when the device used appears to have traveled faster than 600 MPH in the last 20 hours. A trigger results in a challenge action and appropriate and informative alerts sufficient enough to determine why the challenge was generated. ■ The following rule only triggers a challenge action when both conditions are false: Has this user used this country more than 2 times ever? AND Has this user used this country more than 10 in the last month? ■ If a user is challenged post-authentication, and he has KBA active, and he does not have OTP active and the risk is above 600, then he should be asked a KBA question. 12 Managing Groups 12-1 12 Managing Groups Groups are like items that have been collected to simplify configuration workloads. This chapter introduces you to the concept of groups and the different types of groups used in Oracle Adaptive Access Manager, and provides information on creating groups and editing group memberships, and group details. It also provides details on importing and exporting groups.

12.1 About Groups

As the security administrator, you must configure rules for actions and alerts, and rule conditions for users, locations and IPs, and so on. For example, to create a rule Restricted IPS, you must add a condition to find out if the user IP used for login is in the list of restricted IPs configured. The restricted IPs are grouped together as RestrictedIPSGroup of type IP and the rule condition uses this group.

12.2 Group Types

The following types of groups are available: Table 12–1 Group Types Type Description ASN This group holds ASNs. Autonomous System numbers ASNs are globally unique identifiers for Autonomous Systems. An Autonomous System AS is a group of IP networks having a single clearly defined routing policy, run by one or more network operators. Actions This group holds the different out-of-the-box actions. An action is an event activated when a rule is triggered. For example, block access, challenge question, ask for PIN or password, and so on. This is an enum group type. Alerts This group contains four kinds of alerts with four levels of severity. An alert is a message generated when a rule is triggered. For example, login attempt from a new country for this user. Kinds of alerts are Fraud, Customer Care, Information, and Investigation. Alert levels are Low, Medium, High, and Info. Alerts are a special enum group type. Authentication Status This group contains the status of the user when logging in. This is an enum group type.