System and methods for minimizing organization risk from users associated with a password breach

Patent metadata

Field	Value
Publication number	US-11640457-B2
Application number	US-202117347158-A
Country	US
Kind code	B2
Filing date	Jun 14, 2021
Priority date	Sep 19, 2018
Publication date	May 2, 2023
Grant date	May 2, 2023

Abstract

System and methods are disclosed for organizations to run a test against an active directory list to see if any user-provided passwords have been part of an existing data breach. Utilizing information from such a test identifies users that have weak passwords, reused passwords or shared passwords that have been associated with an earlier breach. With this information, the organization can seek to reduce risk by training staff for this specific issue in a timely and appropriate manner to significantly reduce the risk of a future breach by those identified users. Training can be customized and targeted at those users who attempt to use passwords that have been associated with a breach (either of their own account or of another account on the same or related domain.

First claim

What is claimed is:

1. A method comprising:
identifying, by one or more processors, a plurality of users associated with one or more weak passwords based on one or more weak password tests for each of the plurality of users, the plurality of users associated with one or more passwords subject to one or more data breaches;
identifying, by the one or more processors, one or more types of password breach associated with the one or more data breaches;
modifying, by the one or more processors, a risk score of the plurality of users with one or more weak passwords and one or more passwords subject to one or more data breaches based at least on the one or more types of password breach of the plurality of users; and
providing, by the one or more processors, an electronic training to one or more of the plurality of users, the electronic training configured to provide training on using passwords based at least on the identification of the plurality of users.

2. The method of claim 1 , further comprising running, by the one or more processors, the one or more weak password tests.

3. The method of claim 2 , further comprising running, by the one or more processors, the one or more weak password tests based at least on one or more rules for weak passwords against user passwords stored in a user passwords storage.

4. The method of claim 2 , further comprising running, by the one or more processors, the one or more weak password tests based at least on one or more rules for weak passwords against user passwords in an active directory domain.

5. The method of claim 1 , wherein determining the risk score comprises modifying the risk score for each of the plurality of users based at least on results of the weak password tests.

6. The method of claim 1 , further comprising using, by the one or more processors, results of the one or more weak password tests to determine the plurality of users associated with one or more data breaches.

7. The method of claim 6 , further comprising classifying, by the one or more processors, the one or more data breaches into one or more types of password breach.

8. The method of claim 7 , further comprising modifying, by the one or more processors, the risk score for each of the plurality of users based at least on the one or more types of password breach of the plurality of users associated with the one or more data breaches.

9. The method of claim 8 , wherein the one or more types of password breach is one of a data breach associated with another user within a same domain as a user or the data breach associated with a password of the user being subject to the data breach.

10. The method of claim 1 , wherein the electronic training is configured to provide training on using passwords based at least on the risk score of each of the plurality of users.

11. A system comprising:
one or more processors, coupled to memory and configured to:
identify a plurality of users associated with one or more weak passwords based on one or more weak password tests for each of the plurality of users, wherein the plurality of users are associated with one or more passwords subject to one or more data breaches;
identify one or more types of password breach associated with the one or more data breaches;
modify a risk score for the plurality of users with one or more weak passwords and one or more passwords subject to one or more data breaches based at least on the one or more types of password breach of the plurality of users; and
provide an electronic training to one or more of the plurality of users, the electronic training configured to provide training on using passwords based at least on the identification of the plurality of users.

12. The system of claim 11 , wherein the one or more processors are further configured to run the one or more weak password tests.

13. The system of claim 12 , wherein the one or more processors are further configured to run the one or more weak password tests based at least on one or more rules for weak passwords against user passwords stored in a user passwords storage.

14. The system of claim 12 , wherein the one or more processors are further configured to run the one or more weak password tests based at least on one or more rules for weak passwords against user passwords in an active directory domain.

15. The system of claim 11 , wherein the one or more processors are further configured to modify the risk score for each of the plurality of users based at least on the weak password tests.

16. The system of claim 11 , wherein the one or more processors are further configured to use results of the one or more weak password tests to determine the plurality of users associated with one or more data breaches.

17. The system of claim 16 , wherein the one or more processors are further configured to classify the one or more data breaches from the one or more data breaches into one or more types of password breach.

18. The system of claim 17 , further comprising modifying, by the one or more processors, the risk score for each of the one or more users based at least on the one or more types of password breach associated with one or more data breaches.

19. The system of claim 18 , wherein the one or more types of password breach is one of a data breach associated with another user within a same domain as a user or the data breach associated with a password of the user being subject to the data breach.

20. The system of claim 18 , wherein the electronic training is configured to provide training on using passwords based at least on the risk score of each of the plurality of users.

Assignees

• Knowbe4 Inc

Inventors

• Kras Greg

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G09B9/00

  Simulators for teaching or training purposes (for the use of weapons F41; computing aspects G06; {protocols for games, networked simulations or virtual reality H04L67/131}) · CPC title

• G09B5/00

  Electrically-operated educational appliances (working with questions and answers G09B7/00; simulators G09B9/00; advertising or displaying in general G09F) · CPC title