6 Managing Knowledge-Based Authentication

6.1.1 Knowledge Based Authentication

Oracle Adaptive Access Manager provides out-of-the-box secondary authentication in the form of knowledge based authentication (KBA). KBA is a secondary authentication method, an extension to the existing authentication method. It is presented after successful primary authentication (for example, a user entering a single factor credentials, such as a username and password) to improve authentication strength.

KBA provides an infrastructure for

• Users to select questions and provide answers which are used to challenge them later on

  KBA is used to authenticate an individual based on the user's answers substantiated by a real-time interactive question and answer process.

• Levels of logic algorithm for registration

  Registration Logic manages the registration of challenge questions and answers.

• Levels of logic algorithm for answers

  Answer Logic is made up of advanced matching algorithms (fuzzy logic) used by the system to intelligently detect the correct answers in the challenge response process. The algorithms and the level of Answer Logic are factors in evaluating answers.

• Validations

  Validations are used to validate the answers given by a user at the time of registration.

KBA is used during online authentication of the user, which is automated, or a CSR challenge where the CSR interacts with the user to authenticate him before providing CSR services.

6.1.2 Challenge Response Process

The KBA solution consists of securing an application using a challenge/response process where users are challenged with one or more questions to proceed with their requested sign-on, transaction, service, and so on.

6.1.3 Challenge Response Configuration

The challenge/response process is controlled by a combination of properties and rules.

• Question presented at random or round robin

  Presentation logic (random versus round robin) is configurable through properties. If the deployment supports Oracle Identity Manager integration, the presentation is round robin. The user is expected to answer all the registered questions online.

• The number of attempts a user is allowed for each question is set by a property.

• The total number of KBA challenge failures a user is allowed before he is locked out by Oracle Adaptive Access Manager is configured in a rule condition.

6.1.4 Registration

During registration, which could be enrollment, opening a new account, or another events such as a reset, the user is asked to select questions and provide answers. The order of questions that are presented to a user during the registration phase is random using configurable parameters.

Later on, the challenge questions selected at registration or during a reset may be used for challenge during high risk log ins, to access transactions, or sensitive information, or both, and so on. Oracle Adaptive Access Manager's Rules Engine and business rules are responsible for determining if it is appropriate to use challenge questions to authenticate the user.

6.1.5 Challenge Questions

During registration, users are presented with several question menus. For example, he may be presented with three question menus. A user must select one question from each menu and enter answers for them during registration. Only one question from each question menu can be registered. These questions become the user's "registered questions."

When rules in OAAM Admin trigger challenge questions, OAAM Server displays the challenge questions and accepts the answers in a secure way for users. The questions can be presented in the QuestionPad, TextPad, and other pads, where the challenge question is embedded into the image of the authenticator, or simple HTML. These are configured through properties.

The out-of-the-box categories that questions can be grouped into are listed. The customer can configure questions from these categories.

• Childhood

• Sports

• Your Birth

• Parents, Grandparents, Siblings

• Automobile

• Education

• Children

• Your Employment

• Significant Other

• Pets

• Miscellaneous

6.1.6 Question Set

KBA offers a large pool of questions, which is the framework for obtaining answers from the user during registration or reset.

The Question Set is a fixed set of questions that is allotted to the user. This set is allotted at random and once for the user unless it is reset.

It is generated based on the settings configured in the Registration Logic.

This Question Set prevents any single user from having access to all the challenge questions. This is to prevent a fraudster from harvesting questions for use in a phishing exercise.

A user can receive a new Question Set if a customer service representative resets it for the user.

6.1.7 Registration Logic

Registration Logic manages the registration of challenge questions and answers.

During KBA registration each user is presented with a Question Set, a subset of the challenge questions library.

The Question Set is generally broken up into several drop-downs that have questions to select. The drop-down with questions is called a "menu."

The number of questions that appear on each menu, the number of categories per menu, and the number of questions that a user must register is configurable.

Out-of-the-box, questions are grouped into categories.

The challenge questions in the questions menus do not change unless the question set is changed.

The user is required to select one question from each menu and enter answers for them. Only one question from each question menu can be registered.

Validations are applied to the answers provided by the user during registration.

For example, if the question, "What year did you start junior high school," is assigned the Month-Day-Year (MMDDYY) validation, a user registering for this question is not allowed to provide "April 1st 1920" for the answer.

To configure the Registration Logic, you specify the settings for:

• The question set generation

  • The number of questions to be registered

  • The number of questions per menu

  • The number of categories per menu

  The Question Set is generated based on the Registration Logic.

• The validations that will be applied to the answers

For information on setting Registration Logic, see Section 6.8, "Configuring the Registration Logic."

How do the KBA Registration Logic settings affect a customer's question set?

Example configurations are presented in the following table.

Example #1, shown on line 1, results in registration menus containing 2 questions from category A and 2 questions from category B and 2 questions from category C and 1 question from category D.

This continues in a round robin fashion as needed. If there are any categories with an insufficient number of questions or an insufficient number of categories duplicate questions can result.

The following is an example of a configuration to avoid:

• Number of questions user will register: 3

  The number of questions that a user must register. The new user registration should display the same number of question menus as the number of questions that a user must register.

• Number of questions per menu: 5

  The number of questions that appear on each menu. The new user registration should display the same number of questions in each menu as the number of categories for each menu. The total number of questions from all the menus (number of questions multiplied by the questions in each menu) cannot exceed the total number of questions available in the database.

• Number of categories per menu: 5

  The number of categories per menu. The new user registration should display the same number of categories for each menu as the number of questions in each menu.

Fifteen or more categories are required, each with at least one question enabled. But if there are fewer than 15 categories and one of these categories has only one question enabled, some Question Sets will have that question twice.

The algorithm tries to use as many available categories as possible.

For example to generate a Question Set with:

• 3 menus

• 5 questions per menu

• 5 categories per menu

The algorithm tries to pick one question each from 15 categories if 15 categories are available.

The minimum number of questions per category should be equal to the number of questions in the Question Set divided by the total number of categories.

Pre-requisite for Configuring Registration Logic for Locales

The deployment administrator must ensure that there are enough questions in the database for each of the supported locale as configured in OAAM Admin during deployment; otherwise, OAAM Server displays only the English language questions during registration.

The number of locale-specific questions must be equal to or greater than the "Questions User Will Register" multiplied by the "Questions per Menu" multiplied by the "Categories per Menu."

6.1.8 Answer Logic

Answer Logic checks to see if the answer provided by the user matches closely to the ones provided during registration.

Answer Logic is made up of advanced matching algorithms used by the system to intelligently detect the correct answers in the challenge response process. The algorithms and the level of Answer Logic are factors in evaluating answers.

Errors can be caused by simple input errors such as fat fingering, extra characters, misspellings, and so on.

Common misspellings and abbreviations for example can be accepted if the basic information of the answer is correct.

The following algorithms are available and can be configured for your requirements:

• Phonetics

• Missing character(s)

• Extra character(s)

• Common misspellings

• Common abbreviations

• Common acronyms

• Keyboard fat fingering

• Common nicknames

• Regional spelling differences

• Date Format

The Answer Logic algorithms can be enabled or disabled and the intensity or strength of some algorithms (the level of Answer Logic used to evaluate answers given for challenge questions) can also be configured.

For example, high risk transactions such as wire transfers may require a high degree of certainty (i.e. exact match) whereas accessing personal, non-sensitive information may require a lower degree of response certainty.

Answer Logic algorithms are available for both the online challenge and CSR phone challenge processes.

Online settings are applied for answers the user provided online using OAAM Server. Phone challenge settings are applied for answers provided by users over the phone and entered by the CSR.

The online challenge and CSR phone challenge Answer Logic are completely independent of each other. They can be configured separately.

For example, you can set the online challenge logic strength to high and the CSR phone challenge logic strength to low. For the CSR phone challenge logic strength, you may have provided more margin for error, because CSRs are listening to the answers over the phone and entering the answers.

6.1.9 Validations

Validations are used to validate the answers given by a user at the time of registration. Validations can be at the local level, to associated with each individual question, or at the global level, to be applied to all the questions presented to the user.

There are no automated validations to ensure that question specific validations and global validations do not conflict. Administrators must take care not to configure the same validations for local and global. For example, validation for a question should not be set to numeric only if the alpha only is set as a global validation.

Question Registration Validation (Local)

Each question can be assigned unique validations to control the answers a user is allowed to register. For example, if the business team wants to force users to answer a particular question using a specific date format.

The scope of validations applied to an individual question is local. Local validations are specified during the creation of a question.

Global Registration Validation (Global)

Global validations control the answers a user is allowed to register for all questions.

Global validations influence all answer registration. For example, if the "Four-digit year (YYYY)" validation is applied globally then only numeral answers are accepted during KBA registration. This would be a problem if there are questions available to users that would normally have alphanumeric answers.

Global validations are specified during the configuration of Registration Logic.

Global-Local Validation

The scope of validations can be applied to individual questions or a combination of questions.

6.1.10 Failure Counters

Failure counters are used to lock out fraudsters so that they are unable to obtain the answers/questions.

KBA uses two failure counters. They are:

• the Online Counter

• the Phone Counter

The maximum number for online challenges and phone challenges are configurable. The phone counter maximum is "per question."

For the following example, assume:

• Max online = 3

• Max phone (per question) = 3

If the user is answering challenge questions online, and if the user is given three attempts to provide a correct answer, a total of three attempts is allowed. Each failure increments the Online Counter. The user is locked out of the session after three attempts. The online only challenge is designed to limit the exposure of questions to fraudsters.

If the user is answering challenge questions over the phone, and if the user is given three attempts at answering each question, a total of nine attempts is allowed. Each failure increments the Phone Counter. The user is locked out of the session after nine attempts.

A success for an online or a phone challenge automatically resets all counters to zero. For the next challenge, the next question is displayed.

6.1.11 KBA Resets

Authenticator uses questions as additional credentials to help prevent fraud. A customer service representative (CSR) can reset these questions for the user when necessary.

The CSR can reset KBA-related items for a user, as described.

6.1.12 Disable Question and Category Logic

This section describes the logic to handle disabled questions and categories.

Disabling Logic

The disabling logic is as follows for KBA:

• If you disable the last remaining question in a category, the category is automatically disabled as well.

• The number of active categories must be equal to or greater than the maximum number of categories in the question menu. An error message results when you try to disable a category and this requirement is not met.

Consequences

The following table summarizes the disable results.

6.1.13 Locked Status

Locked is the status that OAAM Admin sets if the user fails the question challenge. The "Locked" status is only used if the KBA or OTP Anywhere is in use.

A user is locked out of the session after the failure counter reaches the maximum number of failures.

After the user is locked out, a Customer Service Representative must reset the status to Unlocked before the account can be used to enter the system.

6.2.1 Loading Challenge Questions

The challenge questions must be loaded into Oracle Adaptive Access Manager before the users can be asked to register.

For information on loading challenge questions, see Section 2.5, "Importing Challenge Questions."

6.2.2 Setting Up KBA

To set up KBA:

• Create Category

  If the out-of-the-box categories do not meet your needs, create categories that can hold relevant questions you plan to create.

  For information, see Section 6.7.2, "Creating a New Category."

• Create Questions

  Create questions that can be applicable to the users accessing your application.

  For information, see Section 6.5.3, "Creating a New Question" and Section 6.14.2, "Guidelines for Designing Challenge Questions."

• Apply Validations

  Apply validations to the questions.

  For information, see Section 6.6.2, "Adding a New Validation."

6.2.3 Setting Up Challenge

To set up challenge:

• Set up the Registration Logic - Validations are used to validate the answers given by a user at the time of registration.

  For information, see Section 6.8, "Configuring the Registration Logic."

• Set up the Answer Logic - The Answer Logic settings can be configured for the exactness required for challenge question answers and for answering threshold/tolerance, such as the level of fat fingering, typos, abbreviations, and so on.

  For information, see Section 6.9, "Configuring the Answer Logic."

6.2.4 User Flow

The following diagram illustrates the user experience with the KBA framework implemented.

Figure 6-1 KBA User Flow

Use Case: New User Registration

This section illustrates an example of the new user registration experience.

The use case: You are Helen, a new Acme Corp customer. You have heard the horror stories about online identity theft and it has kept you from utilizing the online service Acme offers. This month however Acme did a customer education campaign showing the many ways customers are protected while online. You feel much better and your trust in the Acme brand has been bolstered. Today you are logging in for the first time.

Directions: Complete the registration flow to log in for the first time.

1. Open the OAAM Server page.

2. On the first sign in page, enter <user name> in the Username field and press Continue.

3. On the second sign in page, enter <password> into the secure TextPad and click Enter.

   The Your New Security Profile page is displayed with information about Security Image and Phrase and Security Questions and Answers.

4. Click Continue to register your security profile.

   The Your Security Device page is displayed with a personalized virtual authentication device. On the page you are given options to learn more about your device, obtain a new image and phrase, and upgrade to a higher security device.

5. If you want, you can select a new image and phrase by clicking the image and phrase link or select a new device by clicking the Upgrade link.

   Click the image and phrase link until you find a device you want.

   If you clicked Upgrade and decided against the upgrade, you can revert to the default security device by clicking the Revert link.

6. Click Continue to accept the security device, image and phrase.

   The Security Questions set up page is displayed.

7. Select a question from the pull-down menu, and then answer the question in the TextPad, and click Enter.

8. Repeat Step 7 until you have completed selecting the questions and entering the answers.

   A welcome screen appears with a message that you are successfully logged in.

Use Case: User Login

This section illustrates an example of the user login experience.

Use case: It has been a week since you completed the registration process on your laptop at work. Today you are on a business trip to another state and you are logging in on your laptop from using free Wi-Fi at a local coffee shop.

Directions: Try to log in to OAAM server using a different IP (this should be a public IP and should belong to a different state).

1. Log in on your laptop using free Wi-Fi at a coffee shop in another state.

   1. On the first sign in page, enter <user name> in the Username field and press Continue.

   2. On the second sign in page, enter <password> into the secure TextPad and click Enter.

      A page appears asking you to answer a security question. The question appears in QuestionPad.

      You are asked a challenge question because the public IP group and uncommon state rules are triggered.

      The public IP group rule contains the "Location: in IP group" condition and the uncommon state rule contains the "User: state first time for user" condition.

2. Enter the answer to the security question in QuestionPad and press Enter.

   If you answer the question successfully, you are logged in.

6.3.1 Ensuring that Universal Installation Option Base Policies are Installed

If you are using pre-packaged policies, ensure that the base policies are installed. If you are not using pre-packaged policies, use this chapter as a guideline for enabling challenge questions.

Oracle Adaptive Access Manager is shipped with default policies packaged into two ZIP files.

The default policies are available in oaam_init in the MW_HOME/IDM_ORACLE_HOME/oaam/init directory.

If you want to use these policies, import them into your system by following the instructions in Section 9.16.2, "Importing a Policy."

6.3.2 Ensuring that KBA Properties/Default Properties are Set

Ensure that the bharosa.kba.active property is set to true. See Chapter 22, "Using the Properties Editor" for information on modifying properties.

6.3.3 Uploading Challenge Questions

The challenge questions must be loaded in Oracle Adaptive Access Manager before the users can be asked to register.

For information on importing challenge questions, see Section 2.5, "Importing Challenge Questions."

6.3.4 Importing and Enabling Policies

Import KBA security policies that pertain to your business and security needs and link them to a user group to which you want KBA to be enabled.

For information on importing policies, see Chapter 9, "Managing Policies, Rules, and Conditions."

6.3.5 Configuring Rules for Registration and Challenge Policies

Change the rules within the policies for your needs.

6.5.1 Searching for a Challenge Question

Use the Questions Search page to view a list of all challenge questions and search for a question based on various criteria. The Questions Search page provides access to the Questions Details page for any question.

When the Questions Search page first appears, the Search Results table is displayed with default filter values.

To search for a question:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

   An example Questions Search page is shown in Figure 6-2.

   Figure 6-2 Questions Search page

   
   

   The Questions Search page displays a Search section and a Search Results table that shows a summary of the questions that match your search criteria.

2. Specify criteria in the Search Filter to locate the questions and click Search.

   The search filter criteria are described in Table 6-1.

   If you want to reset the search parameters to the default setting, use the Reset button.

   Table 6-1 Question Search Criteria

   Field	Description
   Question ID	The ID for the question.
   Question Keyword	The keyword in the question.
   Status	The status of the question: Active or disabled.
   Category	The category to which the question belong. For example: education, pets, sports and so on.
   Locale	The language the question is in. For example, English, Finnish, Czech, and so on.
   Validations	Global validations. For example: Four-digit year (YYYY), Month Day (MMDD), and so on
   Answer Logic Hints	A hint added to questions individually to affect the Answer Logic used to evaluate given answers. For example: Date Answer Hint.
   Create Time	A timeframe within which the question was created
   Update Time	A timeframe within which the question was modified.

   
   

The Search Results table displays a summary of questions that match the criteria specified.

By default, questions are sorted on Question Name, but you can sort questions on Update Time, Create Time, Status, Question, and Category.

In the Search Results table, click the question link to view more details. The Question Details page appears.

Table 6-2, "Question Action menu commands" lists the commands that are available through the Action menu. You can select one or more questions and perform actions on those questions.

Except for creating a question, edit selected, and edit category, all other operations are bulk operations.

6.5.2 Viewing Question Details and Statistics

The Question Details page provides information such as:

• Question Sets with Question

• Users Registered for Question

• Percentage of Users Registered For Question

• Percentage of Successful Challenges

• Percentage of Unsuccessful Challenges

• Question ID

• Last Updated Date

To view question statistics:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. From the Questions Search page, click the question of interest in the Search Results table

   The Question Detail page appears with the statistics.

6.5.3 Creating a New Question

To create a new question

1. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

2. From the Questions Search page, click the New Questions button.

   The New Questions page appears where you can enter details to create a new question.

   Alternative methods to open create pages are listed in Section 3.9, "Access to Search, Create, and Import."

   When the New Question page first appears, the default value for the question status is Active.

   Question, Category, Status, and Locale are required fields.

3. Type the new question in the Question field.

   The question names must be unique across categories.

4. From the Category list, select the category of question you want.

   By default, there is no data in the Category list. You must import the challenge questions ZIP files (oaam_kba_questions_<locale>.zip) for data to appear in the Category menu. You can also create a new category.

5. In the Locale list, select the language you want.

   By default, the Locale menu displays English and 26 other default locale languages.

6. Each question can be assigned unique validations to control the answers a user is allowed to register. To assign a local validation, select the validation type from the Registration Validation list.

   The local validations you select in this step control the answers a user is allowed to register for this particular question.

   It does not control the registration of answers for all questions.

   For information on the difference between global and local validations, refer to Section 6.1.9, "Validations."

7. In the Answer Logic Hints list, select the type of Answer Logic Hint you want.

   A hint can be added to questions individually to affect the Answer Logic used to evaluate given answers. This is performed to better tune the logic for the type of question. This is especially important for date related questions.

   These hints help the Answer Logic function more successfully on some questions, for example, on date related questions. If a question has the date answer hint applied then the abbreviations, phonetics and fat fingering Answer Logic runs first, and then special date format logic is applied.

8. Click Apply. A confirmation dialog appears telling you that the question was created successfully.

9. Click OK to dismiss the dialog.

   The Question Detail page appears for the newly created question.

   After the question has been created, you can edit details.

6.5.4 Creating a Question Like Another Question

To create a new question that is similar to an existing question:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. From the Questions Search page, select the row corresponding to the question of interest.

3. Click the Create Like icon.

   The Create Like screen appears where you can enter details to create a new question.

   The Create Like screen appears with pre-populated data from the original question. Pre-populated fields are Category, Locale, Status, Answer Logic Hints, and Registration Validations.

   Question, Category, Status and Locale are required fields.

   The Create Like icon is disabled if multiple rows are selected.

   You can create a question for any locale.

4. Type the new question in the Question field.

5. Edit any of the other fields if you want.

6. Click OK.

   The Question Detail page appears for the newly created question.

   If you click Cancel, the Questions Search page appears.

6.5.5 Editing a Question

The Question Details page enables you to activate/disable questions and edit the question, question category, locale, and registration and answer validation.

Read-only question statistics are available in the Question Statistics section.

If you edit a question, users using that question receive the updated question.

To edit a question

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the questions you are interested in.

3. Click the hyperlinked question you want to edit.

   The Question Details page appears.

4. Make the changes you want.

   You cannot edit the Question ID or last updated time.

5. Click Apply to save the changes or Revert to discard them.

   If you click Revert, the edited details are reverted to the initial state.

6.5.6 Importing Questions

To import questions:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, click Import Questions or select Import Selected from the Actions menu.

3. In the Import Questions screen, type the path and name of the file; or use the Browse (...) button to locate the ZIP file that contains the questions, and then select the file.

4. Click Open and then click Import.

   If you import questions that belong to a category not currently in the system, the category is also imported. If you import a question with the same ID number as an existing question, the existing question is overwritten.

   A confirmation dialog displays the status of the operation and a list of questions that were imported into the system.

5. Click Done.

6.5.7 Exporting Questions

Multiple questions can be selected and exported.

To export questions:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the questions you are interested in.

3. Select the rows corresponding to the questions of interest.

4. Select the Export icon or Export from the Actions menu.

5. In the Export screen, click the Export button.

   The selected questions are exported.

6.5.8 Deleting a Question

To delete a question, follow these instructions.

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the questions you are interested in.

3. Select the rows corresponding to the questions of interest and click Delete or select Delete Selected from the Actions menu.

   The Delete button and Delete Selected menu item are enabled only if a question is selected.

   A Confirm Delete dialog is displayed with a list of questions and question IDs.

4. Click Delete to delete the questions.

   Deleted questions are not available for new registrations but users currently registered for these questions can continue to use them.

   A confirmation dialog is displayed.

5. In the confirmation dialog, click OK.

An error is displayed when you try to delete a question that is in used by a registered user.

Deleted questions are not available for new registrations but the user currently registered for these questions can continue to use them.

6.5.9 Disabling a Question

To disable a question

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the question you want to disable.

3. Click the hyperlinked question you want to disable.

   The Question Details page appears.

4. In the Status field, select Disable and click Apply.

   The selected questions are disabled.

The following scenarios occur when a question is disabled:

• The disabled question cannot be used to generate a new user's Question Set.

• At re-registration or reset, the disabled question is replaced with another question from the same category for those users who had the disabled question in their question set.

• The disable question remains active for users who have registered the question. If the user is re-registering or changing user preference, the disabled question is replaced with another question from the same category.

6.5.10 Activating Questions

To activate questions:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the questions you are interested in.

3. Select the rows corresponding to the questions you want to activate.

4. Press the Activate button or select Activate from the Actions menu.

   The selected questions are activated.

6.5.11 Deactivating Questions

To deactivate questions:

1. Navigate to the Questions Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Questions Search page, search for the questions you want to deactivate.

3. Select the rows corresponding to the questions you want to deactivate.

4. Press the Deactivate button or select DeActivate from the Actions menu.

   The selected questions are deactivated.

The following scenarios occur when a question is deactivated:

• The deactivated question is not used to generate a new question set.

• At re-registration or reset, the deactivated question is replaced with another question from the same category for those users who had the deactivated question in their question set.

• The deactivated question remains active for users who have registered the question. If the user is re-registering or changing user preference, the deactivated question is replaced with another question from the same category.

6.6.1 Using the Validations Page

The Validations page enables you to perform the following functions:

• Adding a New Validation

• Editing an Existing Validation

• Exporting Validations

• Deleting Validations

Navigate to the Validations page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

An example Validations page is shown in Figure 6-3.

Figure 6-3 Validations Page

By default, validations are sorted on Validation Name, but you can sort validations on Updated.

Table 6-3, "Validation Action menu commands" lists the commands that are available through the Action menu. You can select one or more validations and perform actions on those questions.

6.6.2 Adding a New Validation

You can add a new validation to the system when needed.

Validations are defined for use during challenge questions registration.

To add a validation:

1. Navigate to the Validations page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. From the Validations page, click the New Validation button.

   The Add a New Validation page appears where you can enter details to create a new validation.

   Alternatively, you can open the Add a New Validation page by:

   • Selecting the Add Validation button from the Search Results toolbar.

   • Selecting New Validation from the Actions menu in Search Results.

3. In the Validation Type list, select the validation scheme you want to add.

   You might, for example, select the validation type, Maximum Length. This validation scheme allows the customer to create a validation for the maximum allowed length for the answer.

   The parameters of the validation appears in the Validation Parameters Details area of the Validations page.

   Note:

   · The fields displayed on the screen depends on the validation type selected.

4. In the Name field, enter the name you want for this instance of the validation scheme.

   When you create a validation from available validation schemes in the system, you are adding an instance of validation. You can then customize that instance.

5. Specify validation parameter that correspond to your validation type.

   For example, validation parameter can be 30 for an instance of Maximum Length validation. This validation instance restricts the user from entering an answer longer than 30 characters in length.

   Table 6-4 Validation Parameters

   Validation Type	Label for Fields	Description for Validation Parameter	Example for note
   Inappropriate Language	Enter Inappropriate Words	Inappropriate language for answer	Example: Sloppy, Wrong, Yucky
   Regex	Enter Regex Pattern	Real expression pattern string for the answer. For example, pattern can be "[A-Za-z0-9]+" for Alpha-numeric validation. If the answer entered by the user is not as per the configured regular expression pattern; then, the validation fails and a configured error message is displayed.	Example: [0-9]+
   Date	Enter Date Notation	Date/Time pattern string for the answer. For example, the pattern can be "MMddyy" for Month Day Year validation. If the date/time answer entered by the user is not as per the configured pattern, the validation fails and a configured error message is displayed.	Example: MMDDYY
   Minimum Length	Enter Minimum Length	Minimum length (number) for the answer. If the length of the answer entered by the user is less than the configured value, the validation fails and a configured error message is displayed.	Example: 3
   Maximum Length	Enter Maximum Length	Maximum allowed length (number) for the answer. If length of the answer entered by the user is above the configured value, the validation fails and a configured error message is displayed.	Example: 3
   Repeated Character	Enter Number of Repeating Characters	Allowed number of repeated characters in the answer. If the answer entered by the user contains repeated characters more than the configured value, the validation fails and the user gets a configured error message.	Example: 3
   Repeated Answers	Enter Number of Repeating Answers	Allowed number of repeated answers. For example parameter value can be '1' for unique answer validation. If the answer entered by the user is repeated more than configured number of times, the validation fails and the user gets a configured error message.	Example: 1
   Character	Enter Disallowed Characters	Characters that are not allowed.	Example: *

   
   

6. Click Add.

   OAAM Admin adds this validation instance to the list of validations in the System.

6.6.3 Editing an Existing Validation

To edit an existing validation

1. Navigate to the Validations page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. From the Validations page, select the hyperlinked configured validation you want to edit.

3. In the Validation Parameter Details section, make the necessary changes. See Table 6-4, "Validation Parameters".

   You can edit strings, numbers, and characters in the validation parameters field.

4. Click Save

   OAAM Admin updates this validation instance in the system.

6.6.4 Exporting Validations

To export validations:

1. Navigate to the Validations page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Validations page, search for the validations you are interested in.

3. Select the rows corresponding to the validations you want to export.

4. Select Export Selected from the Actions menu.

5. When the Export screen appears, select Save File, and then Save.

   The file is exported and saved as a ZIP file.

6.6.5 Deleting Validations

To delete validations:

1. Navigate to the Validations page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Validations page, search for the validations you want to delete.

3. Select the rows corresponding to the validations of interest and click Delete.

   A dialog appears asking you if you want to delete the validation.

4. Click Delete to confirm.

   A dialog appears with the message that the validation was deleted successfully.

5. Click OK to dismiss the dialog.

6.7.1 Searching for a Category

On the Categories Search page you can view a list of all categories and search for a category based on various criteria. The Categories Search page provides access to the Category Details page for any category.

When the Categories Search page first appears, the Search Results table displays results from the default search values.

To search for a category:

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

   An example Categories Search page is shown in Figure 6-4.

   Figure 6-4 Categories Search page

   
   

   The Categories Search page displays a Search section and a Search Results table that shows a summary of the categories that match your search criteria.

2. Specify criteria in the Search Filter to locate the specific question category and click Search.

   The search filter criteria are described in Table 6-1.

   If you want to reset the search parameters to the default setting, use the Reset button.

   Table 6-5 Question Search Criteria

   Field	Description
   Category	The category name. For example: education, pets, sports and so on.
   Status	The status of the category.
   Create Time	A timeframe within which the category was created or modified.
   Update Time	A timeframe within which the category was updated

   
   

The Search Results table displays a summary of categories that match the criteria specified.

In the Search Results table, click the hyperlinked category you interested in to view more details. The Category Details page appears.

6.7.2 Creating a New Category

If the out-of-the-box categories do not meet your needs, create categories that can hold relevant questions you plan to create.

To create a new category

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. From the Categories Search page, click the New Category button or the New icon.

   Alternative methods to open create pages are listed in Section 3.9, "Access to Search, Create, and Import."

   The New Category page appears where you can enter details to create a new category.

3. Type the new category in the Category field.

4. Enter a description.

5. Click Apply.

   The Category Details page appears for the newly created category.

6.7.3 Editing a Category

The Category Details page enables you to changed the status, name, and description for an existing category.

To edit a category

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Categories Search page, search for the category you are interested in.

3. Click the hyperlinked category you want to edit.

   The Category Details page appears.

4. Make the changes you want.

   Category name edits do not affect the questions already registered or new registrations.

5. Click Apply to save the changes or Revert to discard them.

   If you click Revert, the edited details revert to the initial state.

   If questions that belonged to a category are moved to the new category, the user would be presented with the same questions.

6.7.4 Deleting Categories

To delete a category, follow these instructions.

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Categories Search page, search for the categories you want to delete.

3. Select the rows corresponding to the categories you want and click Delete.

   A dialog is displayed asking if you want to delete the categories.

4. Click Delete to confirm.

   A dialog is displayed with a message that the categories were deleted successfully.

5. Click OK to dismiss the dialog.

You can delete a category if it is not referenced by questions. If the category is referenced by a question, an error message appears.

6.7.5 Activating Categories

To activate categories:

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Categories Search page, search for the categories you want to activate.

3. Select the row for each category you want to activate.

4. Press the Activate button.

   A dialog is displayed with a message that the category was activated successfully.

5. Click OK to dismiss the dialog.

6.7.6 Deactivating Categories

The deactivated category is not used to generate a new question set.

All questions in the deactivated category are replaced with questions from a new category that has not been used to generate a current question set at re-registration or the changing of user preferences for users with the question in their question set.

For users with the questions registered, the questions from the deactivated category continue to be active. If the user is re-registering or changing user preferences, all questions in the deactivated category are replaced with questions from a new category that has not been used to generate current question set.

To deactivate categories:

1. Navigate to the Categories Search page, as described in Section 6.4, "Accessing Configurations in KBA Administration."

2. In the Categories Search page, search for the categories you are interested in.

3. Select the row for each category you want to deactivate.

4. Press the Deactivate button.

   A dialog is displayed with a message that the category was deactivated successfully.

5. Click OK to dismiss the dialog.

6.9.1 About Answer Logic

The Answer Logic algorithms can be enabled or disabled and the intensity or strength of some algorithms can also be configured.

The following Answer Logic algorithms are available for both the online challenge and phone challenge processes:

Abbreviations

This algorithm handles common abbreviations, common nicknames, common acronyms, and date format.

Phonetics

This algorithm handles Answers that "sound like" the registered answer, regional spelling differences, and common misspellings

Keyboard fat fingering

This algorithm handles Answers with typos due to the proximity of keys on a standard keyboard.

6.9.2 Answer Logic Algorithms Examples

This section highlights the most common response errors and shows how Answer Logic algorithms are used for the system to intelligently detect the correct answers in the challenge response process.

Examples of abbreviations, phonetics, and keyboard fat fingering are also provided.

6.9.3 Level of Answer Logic

The level of Answer Logic, the intensity or strength of algorithms, used to evaluate answers given for challenge questions is adjustable. You can enable or disable each algorithm and you can also specify the following levels for the algorithms used:

• Off – No Answer Logic is used; answers must exactly match those previously registered by the user.

• Low – Less Answer Logic; answers provided by the user must be a match or near-match to the answers that were provided at the time of registration

• Medium – More Answer Logic; the user is given some leeway for the answers that are provided. For example, St. might be accepted for Street.

• High – Highest level of Answer Logic. The constraints are not strict for matching.

Each algorithm generates a score that represents how close the given answer is to the registered answer. OAAM Admin can be configured to accept different threshold score ranges for each algorithm individually. Separate threshold values for each algorithm (low/medium/high) are set in a properties file. The default thresholds are described as follows.

Abbreviation: Mead–Mesd=0; Elementary-Elem=100; School-Sch=100
Fat-finger: Mead-Mesd=75; Elementary-Elem=0; School-Sch=0
Phonetics: Mead-Mesd=0; Elementary-Elem=0; School-Sch=0

6.13.1 Use Case: Create Challenge Question

You have been asked to develop some new challenge questions to augment the existing out-of-the-box questions. Come up with a new question. Directions: Part A: Export the existing challenge questions as a backup. Part B: Create the new question in any category you like in English.

1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

3. In the Questions Search page, click the column header on the Search Results table to select all the rows.

4. Select Export Selected from the Actions menu.

5. In the Export screen, select Save File and click OK.

6. Browse for the location to save the ZIP file and click Save.

7. After backing up the questions, search for the question that you are interested in.

8. If the question does not exist, click New Question. The New Question page is displayed.

   Question, Category, Status, and Locale are required fields.

   When the New Question page first appears, the default value for the question status is Active.

9. In the Question field, type in the question.

10. In the Category field, select a category.

11. Select English as the locale.

12. Select the registration validation.

13. Select Answer Logic hints.

14. Click Apply. A confirmation dialog appears telling you that the question was created successfully.

15. Click OK to dismiss the dialog.

    The Question Details page appears with information about the question and the question statistics.

16. After the question has been created, you can edit details.

6.13.2 Use Case: KBA Registration Logic

The security team has determined that it only wants to have challenge questions about sports and pets. Part A: You must log in to OAAM Admin and delete all the questions for all categories except Sports and Pets. Before doing this you should export all the challenge questions as a backup in case you want to revert. Part B: The security team has also decided that each user should register four questions and that each registration menu should contain questions from at least four categories. Configure this in OAAM Admin.

To configure KBA Registration Logic:

1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

3. Select all the questions in the Search Results table to export all the challenge questions as a backup in case she wants to revert.

   Clicking the # in the column header selects all rows in the Search Results table.

4. Select Export Selected from the Actions menu.

5. In the Export screen, select Save File and click OK.

6. Browse for the location to save the ZIP file and click Save.

7. After the export, in the Search Results table of the Questions Search page, sort questions by Category.

8. Select questions that are not in the category of Sports and Pets, and click the Delete.

9. In the Navigation tree, double-click Registration Logic under KBA. The Registration Logic page is displayed.

10. In Categories per Menu, enter 4.

11. In Questions per Menu, enter 4.

12. In Questions User will Register, enter 4.

13. Click Apply.

6.13.3 Use Case: KBA Phone Challenge

CSRs can authenticate a user by asking challenge questions over the phone. KBA Phone Challenge can be used for any registered user.

1. CSR sees the user's status (i.e. Block, Locked, etc.) and the date/time of the last login attempt when a user calls.

2. CSR requests a question with the Ask Question action and is presented with a challenge question and a the field to enter the user's response.

3. The challenge question presented is not the same question the user has failed online if the user is currently locked out.

4. The next question in the user's registered questions is presented to the CSR.

5. The user has a limited number of over the phone attempts at each question. See Section 6.1.10, "Failure Counters" for details and examples.

6. Error messages are displayed to notify the CSR.

7. This process continues until the user runs out of questions and attempts or the user has answered a question correctly.

6.14.1 Best Practices for Managing Questions

Applying Validations

Many validations may be applied locally or globally. You must be careful not to apply any validations globally that you do not want to influence all answer registration. For example, if the "Four-digit year (YYYY)" validation is applied globally then only for numeral answers will be accepted during KBA registration. This would be a problem if there are questions available to users that would normally have alphanumeric answers.

Deleting Questions and Categories

You can create, edit, and delete questions and categories. You should take care when deleting categories and questions. Insufficient numbers of questions and categories can impact the security of the solution and cause usability issues. For example, if the Categories per menu Registration Logic is set to a number that is more than the total number of categories in the system then there may be duplicate questions listed. This can be confusing to users so it should be avoided.

Questions per Menu Setting

The Questions per menu setting should be between 4 and 7. This range provides a good mix of questions in a question set but does not expose too many questions to any single user.

Question User will Register Setting

The Questions user will register setting should be between 3 and 7. This provides enough questions to offer good security but does not over burden a user's memory. The basic industry standard for KBA is 3 registered questions.

The max and min limits are configurable through the following properties.

bharosa.config.type.kba_config.enum.regQuestionsCount.validation.minValue=3 
bharosa.config.type.kba_config.enum.regQuestionsCount.validation.maxValue=7

Challenge Questions Configuration

It is recommended that you completely configure all of the challenge questions, including locale, before making the question available to users.

Challenge Question Disabling

If you disable a challenge question, users who previously had that question continue to have the question even after it is disabled. However, users that are registering for the first time or re-registering will not be presented with the disabled question.

6.14.2 Guidelines for Designing Challenge Questions

Guidelines for designing challenge questions are listed below:

• No confidential data used in question.

• Answers are difficult to guess.

• Answers cannot be obtained from public sources.

• Questions that are applicable to general public.

• Answers are memorable/personally significant.

• Questions where answers can change over time are avoided.

• Questions cannot pertain to religion, politics, taboo subjects, and so on.

6.14.3 Guidelines for Answer Input

Recommended requirements for answers are listed below:

• Answers must be at least 4 characters.

• No more than 2 answers can be the same during registration.

• Answers cannot have more than 2 repeating characters.

• Special characters are not allowed.

• Answers are not case-sensitive.

• Extra white spaces are removed.

• Fuzzy logic implemented - degree configurable by client.

6.14.4 Other Recommended Requirements

Other tips for challenge questions are:

• A unique question set should be generated for each user.

• The user should register 3-5 questions. i.e. 15 total questions to select from, 3 drop-down menus of 5 questions each.

• There should be a maximum of 2 questions from the same category.

• There should be a maximum opt-out - i.e. 3 opt-out attempts before forcing registration.

• When challenged, the same question is to be presented until the user responds correctly or question is reset by customer service agent.