Add Risk Factors

Risk factors are either connected to the Access Evaluation node or the Start node if no Access Filters have been added to the graph. Risk factors are then connected to the Risk Evaluation node. The following figures provide examples.

Risk Factor connections in the graph

Risk factors with Access Filter connections

Risk Factors with no Access Filters connections

Risk Factors

Risk factors are optional policy signals that contribute to the resource rule risk evaluation. For an overview of what each risk factor detects and when to use it, see Create and manage resource rules.

The following risk options are available:

Risk Factor	Description
Date/Time	Sets restrictions for authentication attempts within specific dates and times.
Device Verification	Checks that the authenticating device contains a device certificate issued by a Trusted CA configured in IDaaS.
External	Adds External Risk Engines as a risk factor to the resource rule. You must have a risk engine configured to use this feature. See Manage external risk engines.
Geolocation	Allows or denies authentication from a list of countries.
Source IP Address	Allows or denies authentication from a list of IP addresses.
Location History	Checks that the IP address in the request matches a location that was used for a previous authentication request. No further configuration is required for this setting.
Machine Authentication	Checks for the fingerprint mismatch risk limit.
Transaction	Evaluates risk from transaction details supplied with the authentication request.
Travel Velocity	Checks that the travel speed (KMH) is above the value defined in the Check Travel Velocity setting of risk-based authenticators.

Configure date/time risk factor

Complete the following, as required:

1. Click the Time/WeekDay tab to set the time, date, and day restrictions, as follows:
   1. Click Allow or Deny to allow or deny a user access based on the Date and Time settings.
   2. Select the Time Zone from the drop-down list.
   3. Set the Start Time. You can enter it manually or click the icon and set it with the clock.
   4. Optional. Set the End Time. You can enter it manually or click the icon and set it with the clock.
   5. Click the specific Weekdays that are restricted by the Date/Time settings.
2. Click the Date Range tab, to set Date Range decision.
   1. Click Allow or Deny to allow or deny a user access based on the Date Range settings.
   2. Select the Time Zone from the drop-down list.
   3. Set the Start Date. You can enter it manually or click the icon and set it with the calendar.
   4. Optional. Set the End Date. You can enter it manually or click the icon and set it with the calendar
   5. Click Save.

Device verification risk factor

Device verification requires no additional configuration. However, before you use this risk factor, configure the trusted certificate authority that issued the device certificates. See Configure a Trusted CA. For information about Entrust PKI products that can support certificate issuance and management, see Entrust PKI.

Configure external risk factor

Complete the following, as required:

1. Select the External Risk Engine from the drop-down list.
2. Click Add to add Rules.
3. Select the Rule from the list.
4. Repeat this step to add more rules.
5. Set a Risk Limit.
   • The risk limit value must be less than the maximum risk score.
   • External risk engine risk points apply if the accumulated risk score of the failed rules exceeds the risk limit.
6. Click Save.

Example: Apply risk when riskLevel is above 70

You can use the following example when your external connector returns a numeric riskLevel from 0 to 100. For the connector configuration that creates the riskLevel result item and high-ip-risk rule, see Configure Connector-based risk engines.

These are the configuration steps for this example:

1. In the external risk engine configuration, create a rule with the following values:
   • Name: high-ip-risk
   • Risk Item: riskLevel
   • Operator: GREATER_THAN
   • Value: 70
2. In the resource rule External risk factor, select the high-ip-risk rule.
3. Set the Risk Limit to 70 so only values above 70 apply external risk points.
4. In Risk Evaluation, configure the medium-risk and high-risk branches to apply the required outcome (for example, step-up authentication or deny access). See Add Risk Evaluation.

Configure geolocation risk factor

Complete the following, as required:

1. Select Allow or Deny to create an allowed or denied country list.
2. From the Build countries drop-down list, select the country to add to the allowed or denied list.
3. Repeat this step to add more countries to the list.
4. Click Save.

Configure source IP address risk factor

To use this feature:

• To use an IP List, you must configure an IP List. See Manage IP Lists.
• Add Custom IP addresses or IP Ranges.

Complete the following, as required:

1. To add allow or deny access to an IP List:
   1. Click IP List.
   2. Select Allow or Deny to allow or deny access to an IP List.
   3. From the IP List drop-down list, select the IP address to add to the allowed or denied list.
   4. Repeat this step to add more IP Lists.
2. To add a Custom IP address:
   1. Click Custom. In the IP Range field, type the IP address or the CIDR (custom IP range). This feature supports IPv4, IPv6, and CIDR addresses.
   2. Press Enter to add the IP address or the CIDR.
   3. Repeat these steps to add more custom IP addresses or CIDRs.
3. Click Save.

Location history risk factor

No further configuration is required for this setting. The Location History is determined by the settings configured for risk-based authentication. See Modify risk-based authenticator settings.

Configure machine authentication risk factor

With machine authentication risk factor, the risk score is based on the attribute differences between a user's Machine Authentication information and that recorded on Identity as a Service before the condition fails. If an attribute does not match, the attribute incurs the number of risk points shown in the Fingerprint Mismatch Risk Limit. The Fingerprint Mismatch Risk Limit values of each non-matching attribute are added together, resulting in a total risk score. This score is normalized to be out of 100 as follows:

Total Risk Score = (Total Risk Points of Failing Attributes / Maximum Risk Points of All Enabled Attributes) * 100

The resource rule condition fails when the number of non-matching risk points exceeds the Machine Authentication Risk value defined in this step. A value of 0 means that a single attribute difference causes the Device Fingerprint condition to fail. The default value is 3. The value between 0-50 can be entered.

The default value is defined by the Machine Risk Limit. To use this feature, both machine nonce and device fingerprint must be enabled. See Manage machine authenticator settings.

Set the fingerprint mismatch risk limit

Complete the following, as required:

1. Drag the rule to set the Fingerprint Mismatch Risk Limit to the maximum total number of non-matching risk points allowed before a machine authentication attempt fails. Each mismatch adds 10 risk points by default.
2. Click Save.

Configure transaction risk factor

Resource rules can support up to two transaction contexts as part of their evaluations for IDaaS Authentication APIs and OIDC and OAuth applications. Transaction contexts work as follows:

• Resource rules can support up to two transaction contexts as part of their evaluations for IDaaS Authentication API applications.
• A transaction context is associated with one or more transaction rules with a risk score. As transaction rules are evaluated, if the accumulated risk score of the failed transaction rule is greater than a defined risk limit value for the transaction context, risk is assumed and the transaction context risk points are added to the overall risk point total.
• A transaction rule is defined as a transaction rule expression.
• A transaction rule expression is a boolean expression, using AND and OR operators, where the operands of the expression can be additional transaction rule expressions or transaction item expressions.
• A transaction item expression is a simple, single expression of a transaction item and its expected value (for example, Account = "S053541", Amount > "10000", Action = "DEPOSIT", Channel = "ATM").
• A transaction item is a transaction detail name, that is passed in transaction details during authentication, along with its type (STRING or NUMERIC), whether it must be present if a transaction rule uses it, and its default value if it is does not need to be present and is not passed as part of the transaction details during authentication.
• To set transactions contexts, see Manage transactions. You need to do this first before you add Transactions to the resource rule.

How to configure transaction risk factor

Complete the following to configure the transaction risk factor.

1. Click the Risk Condition tab, and configure the following:

   1. Enter a Name for the transaction.
   2. Click Add to add a transactions rule. See Manage transactions.
   3. Click Add again to add more rules.
   4. Enter the Risk Limit to the maximum transaction risk points allowed before a transaction attempt fails. Transaction risk points apply if the accumulated risk score of the failed transaction exceeds the risk limit.
   5. Click Save.

2. Click the Manage Transactions tab to add or edit Transaction Rules, as follows:

   To add a rule

   1. Under Transactions Rules, click Add. The Add Transaction Rule dialog box appears.
   2. Enter a Name for the transaction rule.
   3. Select the AND or OR operator for each added group expression.
   4. Select the Transaction Item to which the rule applies from the drop-down list.
   5. Select the Operator from the drop-down list.
   6. Add a value in the Value text box.

   To add another set of rules to the Transaction Rule

   1. Click Add Group.
   2. Select the AND or OR operator for each added group expression.
   3. Select the Transaction Item, Operator, and add a Value.
   4. Click Submit when done.

3. Click Save.

   To test a rule

   1. Click to test the Transaction Rule. The Test Rule dialog box appears.
   2. Click Test Rule.
   3. Click Close to close the dialog box.

Travel velocity

No further configuration is required for this setting. This risk factor uses the setting defined in the Check Travel Velocity setting of risk-based authenticators to check that the travel speed (KMH) is above the value. See Modify risk-based authenticator settings.