Insurance Fraud Manager User Group
February 8-9, 2011
San Diego, CA
Best Practices
Security, Roles and Permissions
Andrea Allmon
Product Management-Sr Director
Health Care and Insurance
February 2010
Confidential. This presentation is provided for the recipient only and cannot
be reproduced or shared without Fair Isaac Corporation's express consent.
1
© 2011 Fair Isaac Corporation.
Kevin Harrison
Product Management-Sr Director
FICO Platform
Agenda
» FICO Platform Architecture
» Security(LDAP)/SSO (shared portal)
» Users
» Permissions (IFM - screen level)
» Roles
» Groups
» Organizations
2
© 2011 Fair Isaac Corporation. Confidential.
© 2010 Fair Isaac Corporation. Confidential.
FICO Platform Architecture
3
© 2010
2011 Fair Isaac Corporation. Confidential.
FICO Platform Architecture
» Business Objectives
» Faster Application Development
» Faster Time-to-Value solutions for our clients
» Faster turn-around for Upgrades to our clients
» Implementation
» Standards-based, Service Oriented Architecture (SOA)
» Integrates with Operating Systems and Middleware
»
»
»
»
»
Operating System
JEE – Java Platform, Enterprise Edition
Application Server
Database Server
LDAP Server
» Configurable by Application
4
© 2011 Fair Isaac Corporation. Confidential.
FICO Platform Architecture
» Configurations for
FICO Applications
» FICO Platform and shared
Strategic Differentiators
Debt
Fraud
Origination
Insurance
DM
DM
Manager
Manager
Manager
Fraud
App
App
FICO Platform
FICO Application
Business Services
» Java Platform, Enterprise Edition (JEE)
» Third Party Platform Stack
» Application Server
» Database Server
» Operating System
Hardware
5
© 2011 Fair Isaac Corporation. Confidential.
» LDAP Server
What is FICO Platform?
What functionality does it provide?
» Common Data Model
» Extensible Data Entities
» Encryption
» Data Access Layer
» Audit, Logging, and History
» License Management
» Data Acquisition
» FICO Network + Transformation
» Bureau + Data Interfaces
» Decision Management System
»
»
»
»
»
Characteristic Library
Model Deployment
Adaptive Control
Performance Reporting
Transaction Scoring
» Business Rules Management
» Blaze Advisor (RMA)
» Business Intelligence
» Browser-based reports integration
6
© 2011 Fair Isaac Corporation. Confidential.
» Security Framework
» Role Based Access Control
» LDAP Integration + Federation
» Single Sign-on
» UI Framework
» UI Builder (SmartForms)
» Context Sensitive Help
» Call Scripting
» Internationalized (I18N)
» Double-byte character set (DBCS)
» Locale aware (Region + Language)
» Date, Time, Currency, Numeric separators
» Externalized Translation Configuration
» Case Management
» History + Notes
» Evidence Locker
» Workflow
» Document Services
» Document Templates
» PDF, E-Mail, SMS
Security (LDAP)/SSO
7
© 2010
2011 Fair Isaac Corporation. Confidential.
FICO Platform use of LDAP
» What is LDAP and what purpose does it serve?
» LDAP = Lightweight Directory Access Protocol
» FICO client needs
» LDAP integration for Administration and Support
» Reuse Corporate configuration for Groups, Users, and Password policy
» Centralized and Delegated Administration
» FICO Platform products
» Use standard LDAPv3 integration for Directory Services
» Have Delegated administration features to write to LDAP
» Use of LDAP Server
» Users (with Group membership)
» only attributes in standard LDAP schema
» Extended attributes in FICO database
» Groups (with hierarchy)
» only attributes in standard LDAP schema
» Extended attributes in FICO database
» Password policy
8
© 2011 Fair Isaac Corporation. Confidential.
Single Sign On
» FICO application roadmap requirements from clients
» Support for Single Sign On environments
» Support for Federated Security integration
» Requires centralized authorization server
» Typically an LDAP server or integrated with LDAP servers
» Implemented by an authentication token
» Federation requires trusted relationship
» Site-deployed
» Workstation login establishes authentication token
» No user/password required to access applications supporting SSO
» ASP/Hosting
» One user/password in portal/extranet for multiple hosted applications
» Federation allows trust to auto-provision clients
9
© 2011 Fair Isaac Corporation. Confidential.
Users
10
© 2010
2011 Fair Isaac Corporation. Confidential.
Users
11
Creating Users
Setting up the Users
Department is a free-form entry for “Primary
Group.” In a future release, we will be
making this a drop-down selector.
Tenants are used when you are hosting more
than one customer
© 2011 Fair Isaac Corporation. Confidential.
Locales will be used in future releases for
localizations (English, Dutch, German)
Users
» User Creation
» Users are Created in LDAP
» Username required
» Validated to be unique
» First and Last name required for application display
» E-Mail address required for sending temporary password
» A temporary password is generated
» An e-mail is sent to users e-mail address
» Users are also created in Business Objects
» User Setup for Additional details
» Some additional LDAP details available for reference
» Emp #, phone, mobile, title
» Remaining details are user details in the database
» Settings: Tenant, Locale, Time Zone
» Associations: Groups, Roles, Queues
» User is made member of Groups in LDAP
» User locale and time zone settings are updated in Business Objects
12
© 2011 Fair Isaac Corporation. Confidential.
Roles
13
© 2010
2011 Fair Isaac Corporation. Confidential.
Roles
» Roles should be configured by job function
» Contain a set of permissions to access a resource
» Typically assigned to a Group of users that do that job
» Ease roles administration for large number of users
» Ensure backup resource with 2 or more users in each group
» IFM ships with the following default Roles:
»
»
»
»
»
»
»
»
14
Full Administrator
Manager
Investigator
Medical Management
Claims Reviewer
Claims Supervisor
Information Only
Triage/Case Administrator
© 2011 Fair Isaac Corporation. Confidential.
Roles Hierarchy example
Roles
System
Administrator
All security
permissions for all
users, user groups,
and organizations
All Permissions for
this set of roles.
User
Administrator
Sub-set of
permissions from the
parent role.
Queue
Administrator
Security
Administrator
Claims VP
Claim Supervisor
User
Administrator
Claim Reviewer
Report
Administrator
Fraud Manager
Document
Template
Administrator
Fraud Supervisor
Sr. Fraud
Manager
Chief Medical
Officer
Fraud Analysts
Each role below System
Administrator, Claims VP,
Fraud Manager, CMO and
Security Administrator
contains a subset of the
permissions from the
parent role.
15
© 2011 Fair Isaac Corporation. Confidential.
Nurse Reviewer
External
Reviewers
Permissions and Roles
» Permissions
» Allows access to system-level features
» Roles – Job Function
» Group of access permissions
» Roles hierarchy
» lower-level roles contain subset of upper-level role’s permissions
» Users and Work Groups may have one or more Roles
» Role administration can be delegated
» By Role with Role Permissions (Add, Manage, Change, Modify)
» Users are limited to Scope of Authority (their lower-level Roles)
» Roles are not bound by organization or operational areas
» Allows shared job functions across the organization and operation
» ie: Delegated Administration: User Administration, Group Administration
» Unless defined that way in the hierarchy
16
© 2011 Fair Isaac Corporation. Confidential.
Role Based Access Control (RBAC)
» Separation of Duties
» Role Type: Security Administrator
» Top-level access control to all security objects and audit logs
» Defines primary roles and groups
» Establishes System Administrators and Delegated Administrators
» Role Type: System Administrators
» Manages System Configuration options
» Monitors System Function and maintains operational environment
» Role Type: Delegated Administrators
» Manages Business or Departmental Operations
» Allows configuration changes to respond quickly to business needs
» Best Practice*
» Define top-level roles as superset for job functions
» Create lower-level child roles as permission subsets
» Allows sharing some permissions for staff in cross-functional roles
» Typical that some users do two jobs
» or cover tasks of other staff as needed (out-of-office, vacation, sick)
17
© 2011 Fair Isaac Corporation. Confidential.
Permissions
18
© 2010
2011 Fair Isaac Corporation. Confidential.
Permissions
» IFM Permissions are at the detailed functional level
»
»
»
»
Permissions are defined as Action and Resource pair
Permissions can be assigned to multiple roles
Authorization service checks user’s Roles for permissions
Permissions can control access to various User Interface elements
» Menus
» Menu Items
» Screens/Page
» Screen Elements
» Navigation items (buttons, hyperlinks)
» Controls (textbox, drop-down list, grid, etc)
» Work in Progress
» Renaming permissions to provide better clarity
» Next release includes permission category
» Ability to filter list of permissions by category
» examples: Users, Groups, Roles, Queues, Menu, Grid, Domain Values
19
© 2011 Fair Isaac Corporation. Confidential.
Groups
20
© 2010
2011 Fair Isaac Corporation. Confidential.
Groups
» Work Groups/Departments
» Work Groups
» set of users that are grouped
» represent operational groups or teams.
» Work groups simplify administration of large number of users
» roles and queues associated to group apply to all members of the group
» Administration for lower level user groups can be delegated to users
or user groups associated to upper level user groups.
» Next release changing to User Group nomenclature
» Common name for container for number of users
» Better represents the alignment with LDAP User Groups
» New attribute in user details for Tenant-specific Primary Group
21
© 2011 Fair Isaac Corporation. Confidential.
Work Groups are defined by
» Tenant
» Each tenant may have different users and operational needs
» User with appropriate permission in Roles
» Create Work Groups (add)
» Maintain Work Groups (edit)
» Business Managers or Supervisors
» Define group and team structure for their business operations area
» Hierarchy (inheritance) to define Managers, Supervisors, Teams
» Scope of Authority limited to the groups they are in
» Maintaining users and assignments in “my work groups”
» Maintain configuration for lower-level work groups
22
© 2011 Fair Isaac Corporation. Confidential.
Organization
23
© 2010
2011 Fair Isaac Corporation. Confidential.
Organization
» Coming Soon – Organization lets you have better control of
Document Templates, etc.
» Optional – Default organization is used until configured
» Authorization to certain system resources can be based on an
organizational hierarchy and RBAC.
» Roles determine if user can access the screen and perform actions
» Organization hierarchy determines what data the user can act upon
» What resource is listed as available to act on
» Organization hierarchy models division, departments, and teams
» Work groups are associated to one or more organizations
» Users can also be associated individually to organizations
» Administration for lower level organizations can be delegated to
users or user groups associated to upper level organizations.
24
© 2011 Fair Isaac Corporation. Confidential.
Organization
» Example
»
»
»
»
A role permission allows user to update document templates
The user is a member of one or more organizations
Certain document templates are associated to organizations
The document templates available to the user are limited to
document templates that belong to the user’s organization(s)
» Organization resources
»
»
»
»
document templates
business calendars
Scripts
other entities defined by FICO products
» For backward compatibility, these resources are part of the
Default Organization available to All User and All Groups
25
© 2011 Fair Isaac Corporation. Confidential.
Delegated Administration
» Delegated Administration
» Of Users, Work Groups, and Roles
» managed by individual clients, divisions, departments
» Such as directors, managers, and supervisors
» hierarchal structure allows Scope of Authority limits to
» Roles they have been associated to and the child roles of those roles
» Work Groups they have been associated to, the child groups of those
groups
» Users within those work groups.
» Organizations they have been associated to and the child organizations of
those organizations
» Role permissions determine which maintenance has been delegated
» Users are always limited to Scope of Authority
» User cannot change hierarchy without permission to act on resource
» Create, Edit, or Delete
» For specific hierarchy (Roles, Work Groups, or Organizations)
26
© 2011 Fair Isaac Corporation. Confidential.
Tenant with Delegated Administration
By having standard RBAC (Role Based
Access Control) to deny all access unless
granted, and limit a user’s access to those
Organizations, User Groups, and Roles they
are a member of, delegated administration can
allow Clients to manage their own hierarchies.
Elevated permissions can exist and be
granted to Tenant administrators to allow
views or selections of Organizations, User
Groups, or Roles they are not a member of.
LDAP
Groups
DM Suite
Tenant C
Tenant C
User Groups
Hierarchy
Organizations
Client A
Organization
Client 1
Organizations
Client 2
Organizations
Client A
User Groups
Client 1
User Groups
Product Category
A
Product Category
B
Product Category
C
27
© 2011 Fair Isaac Corporation. Confidential.
Client 2 Managed Through
Delegated Administration
Roles
Hierarchy
Client 2
User Groups
Client A
Roles
Client 1
Roles
Client 2
Roles
Team 1
Client 2
Admin
Team 2
Client 2
Analyst
Team 3
Client 2
Data Entry
Open Discussion
» What have you found that works best?
» What don’t you like?
» What would you like to see differently?
28
© 2011 Fair Isaac Corporation. Confidential.
Insurance Fraud Manager User Group
February 8-9, 2011
San Diego, CA
THANK YOU
Confidential. This presentation is provided for the recipient only and cannot
be reproduced or shared without Fair Isaac Corporation's express consent.
29
© 2011 Fair Isaac Corporation.