Risk policy field descriptions

Name

Yes

A unique name for the risk policy.

PingOne Connection

Yes

The PingOne connection that you created in steps 2a-2c of Adding a PingOne connection.

PingOne Risk Policy ID

No

The ID of the PingOne risk policy that you want to use to perform risk evaluation.

A null value tells PingOne Protect to use a default policy.

Risk Check Interval (MS)

No

The rate at which PingAccess requests an evaluation from PingOne Protect for the same end-user.

This field accepts values from zero to a full day. The default value is 20000 ms (20 seconds).

User ID Attribute

Yes

Tells PingOne Protect what kind of user attribute to define as an end user’s user ID.

High Risk Policy Evaluator

Yes

A policy that tells PingAccess what action to take if the returned risk score from an end user’s request is HIGH.

In the High Risk Policy Evaluator list, select one of the following options:

Medium Risk Policy Evaluator

Yes

A policy that tells PingAccess what action to take if the returned risk score from an end-user’s request is MEDIUM.

In the Medium Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry.

Low Risk Policy Evaluator

Yes

A policy that tells PingAccess what action to take if the returned risk score from an end user’s request is LOW.

In the Low Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry.

Failed Risk Policy Evaluator

Yes

A policy that tells PingAccess what action to take if the returned risk score is an invalid value or if the risk evaluation service is unavailable.

In the Failed Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry.

Device Profiling Method

Yes

Specify if and how you want to collect an end-user’s device profile. The default value is OFF.

In the Device Profiling Method list, select one of the following options:

Device Profile Interval (S)

No

Define, in seconds, how frequently PingAccess should interrupt end-user requests to gather device profile data when the Device Profiling Method is set to Captured by PingAccess.

This parameter accepts an integer value between 1-86400 seconds. The default value is 300 seconds.

Device Profile Timeout (MS)

No

Define, in milliseconds, how long the device profiling collection script will attempt to collect an end-user’s device profile when the Device Profiling Method is set to Captured by PingAccess.

If this timeout is exceeded, the script can’t send device profile cookies to PingAccess, so PingAccess will follow the Invalid Profile Risk Policy.

The default value is 5000 ms (5 seconds). A minimum value of 1000 ms (1 second) is required.

Device Profile Cookie Prefix

No

Define the cookie prefix that’s used to send device profile data to PingAccess. The cookie prefix must be a valid token as described by .ietf.org/doc/html/rfc6265//[RFC 6265].

The default value is p1_device_prof.

Send Device Profile

No

Select this check box if you want PingAccess to include device profile cookies in requests made to the protected application. This check box is cleared by default.

Invalid Profile Risk Policy

Yes

A policy that tells PingAccess what action to take in response to an end-user’s request if the device profile information sent to PingAccess is invalid. For example, device profile information could be invalid because it’s missing or because it isn’t being collected as expected.

In the Invalid Profile Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry.

IP Change Enforcement

Yes

Specify the enforcement strategy that you want to use when PingAccess detects an IP address change from the end user. The default value is NONE.

In the IP Change Enforcement list, select one of the following options: