Configuring a Risk Policy

Adding a Risk Policy

1. Click Policies > Risk-based Policies > Risk Policy.

2. Click the Create Risk Policy icon.

   To create an identical copy of any existing risk policy: Click Policies > Risk-based Policies > Risk Policy. Locate the policy you want to clone and click the Clone Risk Policy icon. All rules and risk levels configured for the existing policy are copied to the new policy. Specify a name for the new policy and assign a cluster and an authentication class.

3. Under Add Risk Policy, specify the following details:

   Field	Description
   Risk Policy Name	Specify a name for the policy.
   Policy Description	Specify the purpose of this policy.
   Assign Policy To	Select Identity Server cluster and then select an authentication class. You can select the class from the list of existing classes or you can create a new class. If you select an existing class, this policy overwrite settings of the selected class. To modify an existing class, go to Identity Server > cluster > Edit > Local > Classes. To create a new class, see Creating a Risk-based Authentication Class:.

   Creating a Risk-based Authentication Class: Perform the following steps:

   1. Select one of the following options:

      Create Risk-based Auth Class: Calculates the risk score after authentication. See Risk Assessment and Risk Mitigation after Authenticating a Login Attempt.

      Create Risk-based Pre-Auth Class: Calculates the risk score before authentication. See Risk Assessment and Risk Mitigation before Authenticating a Login Attempt.

   2. Specify a name for the class.

   3. Select Record User History to record the user’s login details.

      Before enabling this option, ensure that you have enabled recording user history in Policies > Risk Configuration > User History and configured a database. See History.

      NOTE:The Record User History option is available only for Risk-based Auth Class.

   4. Select Use Cumulative Risk Score to add current risk score of the session to this evaluation.

      If you select this option, ensure that you have defined appropriate risk levels in this class to accommodate the cumulative value. See Cumulative scoring.

   5. To send user name, risk score, and risk level of a specific login attempt to an external REST interface, click Score Sharing URLs and specify the URL of the interface. The external REST interface uses this score information to perform additional actions on the user’s identity.

      (Optional) Specify the REST endpoint authentication credential. When the risk score is sent to the REST endpoint, the endpoint sends these credentials as a basic authentication header. If the REST endpoint is protected using basic authentication, this credential is used.

      If Reduce Score is enabled, the reduced risk score is sent to the REST endpoint for a successful additional authentication.

      After enabling Score Sharing URLs, you must enable the identified risk scores for sharing.

      You can enable two Score Sharing URLs. If the REST endpoint is down, a warning message is logged in the log file, catalina.out. If the REST endpoint is down during risk score sharing, the risk is not cached and is not be shared later.

      NOTE:The Score Sharing URLs option is available only for Risk-based Auth Class.

4. Continue with Configuring Policy Rules.

Configuring Policy Rules

You can assign multiple rules to a policy. Select a rule from existing rules or create a new rule. You can also create a rule here: Policies > Risk-based Policies > Rules > New. See Configuring Rules.

The rules are executed in the top to bottom sequence. You can drag and drop to change the priority and sequence of rules. Rules for which the action is defined as Allow Access, Deny Access, or Exit with Risk Level as specified risk level are executed as specified in the rule irrespective of the risk score accumulated for other rules that previously failed.

For each rule you want to add to a policy, perform the following steps:

1. To create a new rule, perform the following actions:

   1. Click Actions > Create Rule.

   2. Specify a rule name and select a rule definition. For details, see Configuring Rules.

   3. Click OK.

   4. Define actions for the rule.

      Condition	Action
      If rule condition is met	Select any of the following options: Proceed to Next Rule: The next rule in the sequence is executed. Allow Access and Exit Policy: No other rules of this policy are executed and the user gets access to the resource. Deny Access and Exit Policy: No other rules of this policy are executed and the user is denied access. Exit with Risk Level as: Select a risk level. You can also create a risk level and then assign it to the rule. No other rules in this policy are executed. The action specified for that risk level is executed. To create a risk level, see See Configuring Risk Levels.
      If rule condition is not met, add risk score	Specify the risk score that will be stored when the rule evaluation fails.

2. To select a rule from the existing list, perform the following actions:

   1. Under Policy Rules, click Actions > Add Existing Rule.

   2. In Risk Rule, select the rule you want to add from the list.

   3. Define actions for the rule. For details, see Step 1.d.

      NOTE:To validate the rule configuration and view the result, click Actions > Toggle Validate. See How to Use the Validate Tool to Emulate Total Risk Score and Risk Levels.

3. Continue with Configuring Risk Levels.

Configuring Risk Levels

1. Under Risk Levels, click Actions > Add Risk Level.

2. Specify the following details:

   Field	Description
   Risk Level	Select a risk level to associate with the risk score. If you select Other, specify a name to identify the custom risk level.
   Risk Score	Specify a risk score to be associated with the risk level. The risk score indicates a value that is stored in the database after rule evaluation fails.
   Action	Select an action for this risk score. If you select Additional Authentication under Action, you can select multiple classes and methods to configure additional authentication. Use a method for additional authentication when branding, overwriting of users, or a change of userstore is required. If the userstore of the additional authentication is same as the risk-based authentication class and no additional branding is needed, then use a class. The following are examples when you can configure multiple classes and methods: When you are configuring a risk-policy for assessing the risk before authenticating a login attempt. You want to achieve the following actions: Enforce X.509 authentication if the user is internal Enforce form-based authentication and OTP if the user is external You can configure two methods or classes X.509 and OTP combination. When you are configuring a risk-policy for assessing the risk after authenticating a login attempt. You can configure the combination of OTP and biometric as additional authentication methods or classes.
   Reduce Score	After a successful additional authentication, you can configure to reduce the associated risk score. Specify the value that you want to reduce from the risk score. See Risk score reduction after a successful additional authentication.
   Share Score	Select this option to send the risk score of this risk level to the URL specified in Score Sharing URLs in the associated authentication class. You can share risk scores only for the risk levels configured for Risk-based Auth Class. This option is available only if at least one Share Score URLs is configured for the authentication class.

3. Continue with Configuring a Method for an Authentication Class.