System and methods for minimizing organization risk from users associated with a password breach
View Patent ↗System and methods are disclosed for organizations to run a test against an active directory list to see if any user-provided passwords have been part of an existing data breach. Utilizing information from such a test identifies users that have weak passwords, reused passwords or shared passwords that have been associated with an earlier breach. With this information, the organization can seek to reduce risk by training staff for this specific issue in a timely and appropriate manner to significantly reduce the risk of a future breach by those identified users. Training can be customized and targeted at those users who attempt to use passwords that have been associated with a breach (either of their own account or of another account on the same or related domain.
1 . A method comprising:
identifying, by one or more processors, one or more types of password breach that occurred as part of one or more existing data breaches;
selecting, by the one or more processors, one or more users having a type of password breach, of the one or more types of password breach, that occurred as part of the one or more existing data breaches;
communicating, by the one or more processors, an electronic training based at least on the type of password breach to the selected one or more users that occurred as part of the one or more existing data breaches; and
adjusting, by the one or more processors, a risk score of the selected one or more users based at least on results of the electronic training and at least on the type of password breach that occurred as part of the one or more existing data breaches.
2 . The method of claim 1 , further comprising determining, by the one or more processors, the adjustment to the risk score based at least on the type of password breach.
3 . The method of claim 1 , further comprising generating, by the one or more processors, the electronic training based at least on the type of password breach.
4 . The method of claim 1 , further comprising selecting, by the one or more processors, the one or more users from a group of users having a same type of password breach.
5 . The method of claim 1 , further comprising classifying, by the one or more processors, the one or more password breaches into a type of password breach.
6 . The method of claim 5 , further comprising determining, by the one or more processors, the electronic training based at least on the type of data breach.
7 . The method of claim 1 , further comprising identifying, by the one or more processors, the one or more users as having one or more passwords subject to the one or more data breaches.
8 . The method of claim 1 , further comprising identifying, by the one or more processors, the one or more users as having one or more weak passwords.
9 . The method of claim 8 , further comprising determining, by the one or more processors, the one or more users as having one work weak passwords based at least on one or more weak password tests.
10 . The method of claim 8 , further comprising adjusting, by the one or more processors, the risk score of the one or more users responsive to identifying the one or more users as having one or more weak passwords.
11 . A system comprising:
one or more processors, coupled to memory and configured to:
identify one or more types of password breach that occurred as part of one or more existing data breaches;
select one or more users having a type of password breach, of the one or more types of password breach, that occurred as part of the one or more existing data breaches;
communicate an electronic training, based at least on the type of password breach that occurred as part of the one or more existing data breaches, to the selected one or more users; and,
adjust, a risk score of the selected one or more users based at least on results of the electronic training and at least on the type of password breach that occurred as part of the one or more existing data breaches.
12 . The system of claim 11 , wherein the one or more processors are further configured to determine the adjustment to the risk score based at least on the type of password breach.
13 . The system of claim 11 , wherein the one or more processors are further configured to generate the electronic training based at least on the type of password breach.
14 . The system of claim 11 , wherein the one or more processors are further configured to select the one or more users from a group of users having a same type of password breach.
15 . The system of claim 11 , wherein the one or more processors are further configured to classify the one or more password breaches into a type of password breach.
16 . The system of claim 15 , wherein the one or more processors are further configured to determine the electronic training based at least on the type of data breach.
17 . The system of claim 11 , wherein the one or more processors are further configured to identify the one or more users as having one or more passwords subject to the one or more data breaches.
18 . The system of claim 11 , wherein the one or more processors are further configured to identify the one or more users as having one or more weak passwords.
19 . The system of claim 18 , wherein the one or more processors are further configured to identity the one or more users as having one work weak passwords based at least on one or more weak password tests.
20 . The system of claim 18 , wherein the one or more processors are further configured to adjust the risk score of the one or more users responsive to identifying the one or more users as having one or more weak passwords.