Skip Headers
Oracle® Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager
11g Release 2 (11.1.2.0)

Part Number E27207-20
Go to Documentation Home
Home
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

13 Managing the Policy Set

This chapter explains the management and use of the policy set in Oracle Adaptive Access Manager.

This chapter contains these topics:

13.1 Introduction and Concepts

This section introduces you to the concept of policy set and how it is used in Oracle Adaptive Access Manager. It includes the following sections:

13.1.1 Policy Set

The policy set is a level of evaluation logic above the individual policies. The policy set logic is a collection of functionality that executes after all the policies have executed for a checkpoint. This functionality includes the calculation of the final risk score and any overrides.

The policy set can be used to create action or score based overrides. The overrides allow an administrator to account for special circumstances where the actions or score generated by the policies may have an undesired effect. For example, to prevent a call center from being swamped by calls if a rule is configured too conservatively, an administrator can create an action override to convert a "Block" action if there are an extremely high number of blocks in a short period of time.

The policy set has a few key features:

  • The scoring engine used to combine the scores generated by the individual policies into the final risk score is configured here.

  • It can be used to create an action or a score override.

Example: Policy Set Scoring Engine

Jeff is a Security Administrator who wants the final risk score at each checkpoint to be based on the highest individual policy risk score. To meet this requirement he selects Maximum as the scoring engine at the Policy Set level.

  1. Log in to the OAAM Administration Console as an administrator.

  2. Double-click the Policy Set node. The Policy Set page is displayed.

  3. Click the Summary tab.

  4. Select Maximum from the Scoring Engine list.

    The Maximum Scoring Engine takes the highest policy score and uses it as the checkpoint score. This scoring engine ignores the policy weights.

  5. Click Apply.

    A confirmation dialog appears with the message, "Policy Set details updated successfully."

  6. Click OK.

13.1.2 Action and Score Overrides

Action and score overrides can be used to change the outcomes of a checkpoint.

When you create an Action Override, you specify an action to replace the action triggered by individual rule. For example, an action override, which is based on "time" and "action," can be used to limit the number of blocks or to control the number of registrations with a specified time frame.

When you create a Score Override, you specify an action group, or an alert group, or both to be triggered when the final risk score for a checkpoint falls within the specified range. For example, if you set the score range to 500 - 1000 and specify an alert group, the alerts are generated if the checkpoint risk score falls between 500 and 1000.

13.1.3 Before You Begin

Oracle Adaptive Access Manager is shipped with action overrides disabled (default). If you want this feature enabled, set the following property to "true."

vcrypt.tracker.rules.allowControlledActions

13.2 Navigating to the Policy Set Details Page

Only one policy set is available.

To access the Policy Set Details page:

  1. Expand the Navigation tree.

  2. From the Navigation tree, select Policy Set.

Policy Set Details is displayed.

Alternatively, you can open the Policy Set Details page by:

13.3 Viewing Policy Set Details

The Policy Set Details page enables you to view and edit the details of a policy set.

It provides the following four tabs:

13.4 Adding or Editing a Score Override

To add or edit a score override:

  1. Open the Policy Set Details page.

  2. Click the Score Overrides tab.

    A list of existing score override appears.

  3. To add a score override, click Add.

    To edit a score override, select the override and click Edit.

    The Add Score Override or Edit Score Override dialog appears.

  4. Select the checkpoint you want this override to be applied to.

  5. Enter the minimum and maximum scores.

    The override triggers if the score falls between the minimum and maximum scores.

  6. Select the action that you want triggered in an override.

  7. Select the alert to which you want triggered in an override.

  8. Click Apply.

13.5 Adding or Editing an Action Override

To add or edit an action override:

Note:

If a user/device/IP is already presented with the action in the given duration, it continues with the same action and override is not supplied.

  1. Open the Policy Set Details page.

  2. Click in the Action Overrides tab.

    A list of existing action overrides appears.

  3. To add an action override, click Add.

    To edit an action override, select the override and click Edit.

    The Add Action Override or Edit Action Override dialog appears.

  4. Select the checkpoint you want this override to be applied to.

  5. In the From Action field, select the action that you want replaced.

    For example, you might select Block so that you can convert the block to a challenge question.

    Specifying the To Action is optional. The From Action and To Action can be same.

  6. In the To Action field, select the action you want to use for the replacement.

    For example, you might select Challenge to convert a block to a challenge.

  7. From the Alert Group list, select the alert you want generated when this event occurs.

    Alerts are indicators (messages) to personnel (CSR, Investigators, and so on). An alert group contains graded messages that can be triggered by a rule.

    Alert groups are used as results within rules so that when a rule is triggered all of the alerts within the groups are activated.

  8. For Duration, enter the number of minutes within which you want the To Action to be triggered.

    For example, you might enter the number "30" so that if within 30 minutes there are more than 100 block, the system stops blocking people and starts challenging those people who would have been blocked.

  9. For Count, enter the number of events generated by the From Action.

    For example, you might enter "100" to indicate more than ten blocks.

    The count of the actions are incremented only if the action is from a different user, IP, and device.

    The count is updated only when the user, IP, and device are all unique. For example, if these are not unique and if a device is blocked, the device continues to be block in the specified duration instead of being challenged.

  10. Click Apply.

13.6 Editing a Policy Set

To edit a policy set:

  1. Open the Policy Set Details page.

  2. To edit the policy set's general information, make the changes you want in the Summary tab and then click Apply.

    You can change the Policy Set's scoring engine and description.

    For information on Scoring Engines, see Section 10.2.8, "What is a Scoring Engine?" OAAM Admin uses the scoring engine to calculate the numeric score applied when calculating risk level.

    If the changes are successful, a confirmation that the policy set details have updated successfully appears.

  3. To add or edit the score overrides, follow the instructions in Section 13.4, "Adding or Editing a Score Override."

  4. To edit the action overrides, follow the instructions in Section 13.5, "Adding or Editing an Action Override."

13.7 Use Cases

This section describes example use cases for using policy set.

13.7.1 Use Case: Policy Set - Overrides

William is a Security Administrator and he must set the score and action overrides such that when the score is between 500 and 700 for Pre-Authentication, a special alert is triggered for immediate attention by the fraud investigators and the users are "blocked instead of being "challenged."

  1. Edit Score Override

    When you create a Score Override, you specify an action group, or an alert group, or an action and an alert group you want to be triggered when a score falls within a specific range. For example, if you have set a minimum score of 500, you can specify an action or alert group that you want to be triggered when the score reaches 501.

    1. Checkpoint: Pre-Authentication

    2. Minimum score: 500

      500 is the minimum score allowed before the score override is triggered.

    3. Maximum score: 700

      700 is the maximum score allowed before the score override is triggered.

    4. Alert Group: new alert

      Alerts are indicators (messages) to personnel (CSR, Investigators, and so on). An alert group contains graded messages that can be triggered by a rule.

      Alert groups are used as results within rules so that when a rule is triggered all of the alerts within the groups are activated.

    5. Action Group: Block

      Oracle Adaptive Access Manager does not allow the user to access the system if he is blocked.

  2. Edit Action Override

    When you create an Action Override, you specify an action to replace the action triggered by individual rule. For example, an action override, which is based on "time" and "action," can be used to limit the number of blocks or to control the number of registrations with a specified time frame.

    1. Checkpoint: Pre-Authentication

    2. From Action: Challenge

    3. To Action: Block

    4. Alert Group: new alert

13.7.2 Policy Set - Overrides (Order of Evaluation)

William is a Security Administrator and he must set the score and action overrides such that when the score is between 500 and 700 for Pre-Authentication, a special alert is triggered for immediate attention by the fraud investigators and the users are "blocked instead of being "challenged." But there are about 10 training folks and they are given temp allows for the next 1 week. How do the action and score overrides affect these users?

  1. Edit Score Override

    When you create a Score Override, you specify an action or alert group, or an action and an alert group you want to be triggered when a score falls within a specific range. For example, if you have set a minimum score of 500, you can specify an action or alert group that you want to be triggered when the score reaches 501.

    1. Checkpoint: Pre-Authentication

    2. Minimum score: 500

      500 is the minimum score allowed before the score override is triggered.

    3. Maximum score: 700

      700 is the maximum score allowed before the score override is triggered.

    4. Alert Group: new alert

      Alerts are indicators (messages) to personnel (CSR, Investigators, and so on). An alert group contains graded messages that can be triggered by a rule.

      Alert groups are used as results within rules so that when a rule is triggered all of the alerts within the groups are activated.

    5. Action Group: Block

      Oracle Adaptive Access Manager does not allow the user to access the system if he is blocked.

  2. Edit Action Override

    When you create an Action Override, you specify an action to replace the action triggered by individual rule. For example, an action override, which is based on "time" and "action," can be used to limit the number of blocks or to control the number of registrations with a specified time frame.

    1. Checkpoint: Pre-Authentication

    2. From Action: Challenge

    3. To Action: Block

    4. Alert Group: new alert

  3. Create Training Folks group.

  4. Select group in Exclude group of Pre-conditions of all Challenge rules.

13.8 Best Practices for the Policy Set

This section outlines some best practices for using policy sets.