Managing risk policies
Create risk policies defining how PingAccess should respond to PingOne Protect’s risk evaluations.
About this task
Currently, you can only create risk policies for the risk evaluation service provided by PingOne Protect. For a more detailed explanation of this integration, see PingOne Protect integration.
A risk policy tells PingAccess what action to take in response to the risk evaluations it receives from PingOne Protect. Apply a risk policy to a specific web application or resource to set up continuous authorization on your web applications with PingOne Protect.
To create or manage risk policies through the PingAccess administrative console, see:
-
Adding a risk policy
-
Editing a risk policy
-
Deleting a risk policy
Adding a risk policy
Before you begin
Make sure that:
-
You have set up a PingOne connection in PingAccess.
-
You have your PingOne credential easily accessible to copy and paste.
For more information, see Adding a PingOne connection.
About this task
To add a risk policy:
Steps
-
In the PingAccess administrative console, go to Access → Risk Policies and click +Add Risk Policy.
-
Complete the fields.
For more information, see Risk policy field descriptions.
You can only configure a PingOne risk policy in PingOne Protect.
If you haven’t enabled device profiling in a PingAccess risk policy configuration, then you shouldn’t include New Device or other device-related PingOne predictor types in the associated PingOne risk policy.
Some of these device-related predictor types are included in the default PingOne risk policy. If you haven’t enabled device profiling, make sure to remove the following predictor types from your configuration or adjust the weights or scores associated with them:
-
Anonymous network detection
-
Geovelocity anomaly
-
IP reputation
-
IP velocity
-
New device
-
User location anomaly
For more information, see Risk policies in the PingOne Cloud Platform documentation.
-
-
Click Save.
Next steps
After you’ve created a PingAccess risk policy, you can assign it to a specific application or resource. For more information, see Application field descriptions or Adding application resources.
Editing a risk policy
Steps
-
Go to Access → Risk Policies.
-
Click the Expand icon to view more details about the risk policy that you want to edit.
-
On the Properties tab, click the Pencil icon.
-
Make the required changes.
For more information, see Risk policy field descriptions.
-
Click Save.
Deleting a risk policy
Steps
-
Go to Access → Risk Policies.
-
Click the Expand icon to view more details about the risk policy that you want to delete.
-
Click the Delete icon.
-
Click Delete.
Risk policy field descriptions
The following table describes the fields available for managing risk policies on the Risk Policies tab in PingAccess.
| Field | Required | Description | ||||||
|---|---|---|---|---|---|---|---|---|
Name |
Yes |
A unique name for the risk policy. |
||||||
PingOne Connection |
Yes |
The PingOne connection that you created in steps 2a-2c of Adding a PingOne connection. |
||||||
PingOne Risk Policy ID |
No |
The ID of the PingOne risk policy that you want to use to perform risk evaluation. A null value tells PingOne Protect to use a default policy.
|
||||||
Risk Check Interval (MS) |
No |
The rate at which PingAccess requests an evaluation from PingOne Protect for the same end-user. This field accepts values from zero to a full day. The default value is 20000 ms (20 seconds).
|
||||||
User ID Attribute |
Yes |
Tells PingOne Protect what kind of user attribute to define as an end user’s user ID. |
||||||
High Risk Policy Evaluator |
Yes |
A policy that tells PingAccess what action to take if the returned risk score from an end user’s request is In the High Risk Policy Evaluator list, select one of the following options: Section
|
||||||
Medium Risk Policy Evaluator |
Yes |
A policy that tells PingAccess what action to take if the returned risk score from an end-user’s request is In the Medium Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry. |
||||||
Low Risk Policy Evaluator |
Yes |
A policy that tells PingAccess what action to take if the returned risk score from an end user’s request is In the Low Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry. |
||||||
Failed Risk Policy Evaluator |
Yes |
A policy that tells PingAccess what action to take if the returned risk score is an invalid value or if the risk evaluation service is unavailable. In the Failed Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry. |
||||||
Device Profiling Method |
Yes |
Specify if and how you want to collect an end-user’s device profile. The default value is
In the Device Profiling Method list, select one of the following options: Section
|
||||||
Device Profile Interval (S)
|
No |
Define, in seconds, how frequently PingAccess should interrupt end-user requests to gather device profile data when the Device Profiling Method is set to Captured by PingAccess. This parameter accepts an integer value between 1-86400 seconds. The default value is |
||||||
Device Profile Timeout (MS)
|
No |
Define, in milliseconds, how long the device profiling collection script will attempt to collect an end-user’s device profile when the Device Profiling Method is set to Captured by PingAccess. If this timeout is exceeded, the script can’t send device profile cookies to PingAccess, so PingAccess will follow the Invalid Profile Risk Policy. The default value is |
||||||
Device Profile Cookie Prefix
|
No |
Define the cookie prefix that’s used to send device profile data to PingAccess. The cookie prefix must be a valid token as described by RFC 6265. The default value is
|
||||||
Send Device Profile
|
No |
Select this check box if you want PingAccess to include device profile cookies in requests made to the protected application. This check box is cleared by default.
|
||||||
Invalid Profile Risk Policy |
Yes |
A policy that tells PingAccess what action to take in response to an end-user’s request if the device profile information sent to PingAccess is invalid. For example, device profile information could be invalid because it’s missing or because it isn’t being collected as expected. In the Invalid Profile Risk Policy Evaluator list, select one of the five options described in the High Risk Policy Evaluator table entry. |
||||||
IP Change Enforcement |
Yes |
Specify the enforcement strategy that you want to use when PingAccess detects an IP address change from the end user. The default value is In the IP Change Enforcement list, select one of the following options: Section
|
Advanced Settings
To configure advanced settings on a risk policy, expand the Show Advanced Settings section at the bottom of the Risk Policy page. These settings are optional.
| Field | Description | ||
|---|---|---|---|
Device Profile Page |
Specify the HTML template that PingAccess should render if the Device Profiling Method is set to Captured by PingAccess. If you leave this field blank, PingAccess populates it with the
|
||
Max Expected Device Profile Cookies
|
Define the number of device profile cookies that PingAccess attempts to reset when it displays the Device Profile Page. The default value is 5. You must specify a value between 1-64. If PingAccess has seen the user before, it checks the user session data to determine the last set of device profile cookies it was sent and resets those cookies when it displays the device profile page. Max Expected Device Profile Cookies is only used when PingAccess is unable to determine the last set of device profile cookies that it was sent from the user. If you use the default Device Profile Cookie Prefix, |