Systems and methods for improving assessment of security risk based on personal internet account data
Systems and methods are described for improving assessment of security risk based on a user's personal information. Registration of personal information of a user of an organization is received at a security awareness system. Post receiving the registration of the personal information, at least one of an exposure check or a security audit of the personal information of the user is performed by the security awareness system. A personal risk score of the user is then generated or adjusted based at least on a result of one of the exposure check or the security audit.
1. A method comprising:
receiving, by a security awareness system configured on one or more servers, from a user of an organization registration of personal information;
performing, by the security awareness system, at least one of an exposure check against one or more breach databases or a security audit of the personal information of the user; and
adjusting, by the security awareness system, a personal risk score of the user based at least on a result of one of the exposure check or the security audit, the personal risk score comprising at least a component representing a willingness of the user to provide the personal information to the organization to which the user is not obliged to provide the personal information; and
performing, by the security awareness system based on at least the personal risk score of the user, one of a computer-based remedial training or a simulated phishing campaign directed to the user.
2. The method of claim 1 , further comprising verifying, by the security awareness system, an email address as used in a personal domain of the user.
3. The method of claim 2 , further comprising storing, by the security awareness system, the email address used in the personal domain of the user in association with a profile of the user for the security awareness system.
4. The method of claim 2 , further comprising registering the personal information with the security awareness system responsive to the email address used in the personal domain of the user being verified.
5. The method of claim 1 , further comprising storing, by the security awareness system, the personal information in an obfuscated form.
6. The method of claim 1 , further comprising performing the exposure check by searching using at least one of an email address or a username in the personal information for breached user information in the one or more breach databases.
7. The method of claim 1 , further comprising performing the security audit by assessing a strength of one or more registered personal passwords from the personal information and compliances to password requirements of the organization.
8. The method of claim 1 , further comprising adjusting the personal risk score of the user based at least on the user's registration of the personal information with the security awareness system.
9. The method of claim 1 , further comprising determining, by the security awareness system, a risk score based at least on the personal risk score of the user.
10. The method of claim 1 , further comprising monitoring, by the security awareness system, the one or more breach databases for the personal information.
11. A system comprising:
a security awareness system configured on one or more processors, coupled to memory, the security awareness system configured to:
receive from a user of an organization registration of personal information;
perform at least one of an exposure check against one or more breach databases or a security audit of the personal information of the user;
adjust a personal risk score of the user based at least on a result of one of the exposure check or the security audit, the personal risk score comprising at least a component representing a willingness of the user to provide the personal information to the organization to which the user is not obliged to provide the personal information; and
perform, based on at least the personal risk score of the user, one of a computer-based remedial training or a simulated phishing campaign directed to the user.
12. The system of claim 11 , wherein the security awareness system is further configured to verify an email address as used in a personal domain of the user.
13. The system of claim 12 , wherein the security awareness system is further configured to store the email address used in the personal domain of the user in association with a profile of the user for the security awareness system.
14. The system of claim 12 , wherein the security awareness system is further configured to register the personal information responsive to the email address used in the personal domain of the user being verified.
15. The system of claim 11 , wherein the security awareness system is further configured to store the personal information in an obfuscated form.
16. The system of claim 11 , wherein the security awareness system is further configured to perform the exposure check by searching using at least one of an email address or a username in the personal information for breached user information in the one or more breach databases.
17. The system of claim 11 , wherein the security awareness system is further configured to perform the security audit by assessing a strength of one or more registered personal passwords from the personal information and compliances to password requirements of the organization.
18. The system of claim 11 , wherein the security awareness system is further configured to adjust the personal risk score of the user based at least on the user's registration of the personal information with the security awareness system.
19. The system of claim 11 , wherein the security awareness system is further configured to determine a risk score based at least on the personal risk score of the user.
20. The system of claim 11 , wherein the security awareness system is further configured to monitor the one or more breach databases for the personal information.