IBM Security Access Manager for Mobile: Administration Guide Figures
Total Page:16
File Type:pdf, Size:1020Kb
IBM Security Access Manager for Mobile Version 8.0.0.1 Administration Guide SC27-6207-01 IBM Security Access Manager for Mobile Version 8.0.0.1 Administration Guide SC27-6207-01 Note Before using this information and the product it supports, read the information in “Notices” on page 115. Edition notice Note: This edition applies to version 8.0.0.1 of IBM Security Access Manager for Mobile (product number 5725-L52) and to all subsequent releases and modifications until otherwise indicated in new editions. © Copyright IBM Corporation 2013. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Figures ...............v Mapping obligations to a URL ........61 obligation ..............62 Tables ...............vii Predefined obligations ...........63 About this publication ........ix Chapter 7. Risk profiles .......65 Managing risk profiles...........65 Access to publications and terminology .....ix Predefined risk profiles ..........73 Accessibility ..............x Technical training.............x Support information ............x Chapter 8. Policies .........75 Statement of Good Security Practices ......x Managing policies ............75 Creating a policy ............76 Chapter 1. Overview of context-based Managing policy sets ...........79 access ...............1 Managing policy attachments ........81 Policy scenarios .............84 Business scenarios ............1 Denying access based on a set of conditions . 84 Features ................2 Denying access based on a set of conditions with Functional overview ............2 an OR clause .............85 Transaction flow .............4 Permitting access based on a set of conditions with an AND clause ..........86 Chapter 2. Risk management overview . 9 Permitting access after one-time password Risk score calculation ...........12 authentication ............87 Risk reports ..............13 Registering a device after user consent ....88 Configuring risk reports ..........13 Accessing risk reports ...........15 Chapter 9. Device fingerprints.....91 Managing device fingerprints ........91 Chapter 3. Attributes .........17 Silent device registration ..........92 Managing attributes ...........17 Consent-based device registration .......92 Updating location attributes .........18 Setting the authentication level for consent-based Attribute properties ...........21 device registration ...........93 Predefined attributes ...........23 Modifying consent template pages......93 Configuring the hash algorithm for attribute storage 32 REST services for device fingerprint registration 95 Dynamic attributes ............33 Scenarios for adding and manipulating attributes 34 Chapter 10. Runtime database ....97 Coding the dynamic.attributes.js file .....34 Managing the runtime database .......97 Updating and deploying the dynamic.attributes.js Deploying an external runtime database .....98 file ................36 Database usage requirements ........101 Custom attributes for the authorization service . 37 Runtime database tuning parameters .....101 [azn-decision-info] stanza.........37 [user-attribute-definitions] stanza ......41 Chapter 11. Policy information points 105 Setting the data type or category of a custom attribute ..............42 Managing policy information points ......105 RESTful web service properties .......106 Chapter 4. Attribute collection service 45 Chapter 12. Deploying pending Configuring the attribute collection service ....48 changes .............109 Chapter 5. Attribute matchers .....51 IP reputation ..............54 Chapter 13. User self-administration Configuring the IBM Security Access Manager tasks ...............111 for Mobile appliance to contact the license server. 55 Managing your registered devices ......111 Modifying attribute matchers ........56 Managing OTP secret keys .........112 Chapter 6. Obligations ........59 Notices ..............115 Managing obligations ...........59 Obligation properties ...........60 Index ...............119 © Copyright IBM Corp. 2013 iii iv IBM Security Access Manager for Mobile: Administration Guide Figures 1. Context-based access architecture .....2 3. The closest points, midpoints, and farthest 2. Context-based access transaction flow example 5 points on the accuracy ranges of two locations . 52 © Copyright IBM Corp. 2013 v vi IBM Security Access Manager for Mobile: Administration Guide Tables 1. REST services instructions........95 3. Runtime database tuning parameters 102 2. Runtime database deployment scripts ....98 © Copyright IBM Corp. 2013 vii viii IBM Security Access Manager for Mobile: Administration Guide About this publication The IBM Security Access Manager for Mobile Administration Guide describes how to manage, configure, and deploy an existing IBM Security Access Manager environment. Access to publications and terminology This section provides: v A list of publications in the “IBM Security Access Manager for Mobile library.” v Links to “Online publications.” v A link to the “IBM Terminology website.” IBM Security Access Manager for Mobile library The following documents are available online in the IBM Security Access Manager for Mobile library: v IBM Security Access Manager for Mobile Configuration Guide, SC27-6205-00 v IBM Security Access Manager for Mobile Administration Guide, SC27-6207-00 v IBM Security Access Manager Appliance Administration Guide, SC27-6206-00 v IBM Security Access Manager for Mobile Auditing Guide, SC27-6208-00 v IBM Security Access Manager for Mobile Troubleshooting Guide, GC27-6209-00 v IBM Security Access Manager for Mobile Error Message Reference, GC27-6210-00 Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security IBM Security Access Manager for Mobile library The product documentation site (http://pic.dhe.ibm.com/infocenter/ tivihelp/v2r1/topic/com.ibm.ammob.doc_8.0.0/welcome.html) displays the welcome page and navigation for the library. IBM Security Systems Documentation Central IBM Security Systems Documentation Central provides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific versions of each product. IBM Publications Center The IBM Publications Center site (http://www.ibm.com/e-business/ linkweb/publications/servlet/pbi.wss) offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at http://www.ibm.com/ software/globalization/terminology. © Copyright IBM Corp. 2013 ix Accessibility Accessibility features help users with a physical disability, such as restricted mobility or limited vision, to use software products successfully. You can use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see the IBM Accessibility website at http://www.ibm.com/able/. Technical training For technical training information, see the following IBM Education website at http://www.ibm.com/software/tivoli/education. Support information IBM Support provides assistance with code-related problems and routine, short duration installation or usage questions. You can directly access the IBM Software Support site at http://www.ibm.com/software/support/probsub.html. IBM Security Access Manager for Mobile Troubleshooting Guide provides details about: v What information to collect before contacting IBM Support. v The various methods for contacting IBM Support. v How to use IBM Support Assistant. v Instructions and problem-determination resources to isolate and fix the problem yourself. Note: The Community and Support tab on the product information center can provide additional support resources. Statement of Good Security Practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. x IBM Security Access Manager for Mobile: Administration Guide Chapter 1. Overview of context-based access Context-based access provides access decision and enforcement that is based on a dynamic risk assessment or confidence level of a transaction. Context-based access uses behavioral and contextual data analytics to calculate risk. Context-based access: v Improves security during authentication and authorization of business transactions. v Assesses risk based on static, contextual, and analytically calculated attributes. v Calculates a risk score based on multiple weighted attributes. v Provides policy rules that determine whether an access request must be permitted,