System and methods for minimizing organization risk from users associated with a password breach

Patent metadata

Field	Value
Publication number	US-12499209-B2
Application number	US-202318128394-A
Country	US
Kind code	B2
Filing date	Mar 30, 2023
Priority date	Sep 19, 2018
Publication date	Dec 16, 2025
Grant date	Dec 16, 2025

Abstract

System and methods are disclosed for organizations to run a test against an active directory list to see if any user-provided passwords have been part of an existing data breach. Utilizing information from such a test identifies users that have weak passwords, reused passwords or shared passwords that have been associated with an earlier breach. With this information, the organization can seek to reduce risk by training staff for this specific issue in a timely and appropriate manner to significantly reduce the risk of a future breach by those identified users. Training can be customized and targeted at those users who attempt to use passwords that have been associated with a breach (either of their own account or of another account on the same or related domain.

First claim

What is claimed is:

1 . A method comprising:
identifying, by one or more processors, one or more types of password breach that occurred as part of one or more existing data breaches; selecting, by the one or more processors, one or more users having a type of password breach, of the one or more types of password breach, that occurred as part of the one or more existing data breaches; communicating, by the one or more processors, an electronic training based at least on the type of password breach to the selected one or more users that occurred as part of the one or more existing data breaches; and adjusting, by the one or more processors, a risk score of the selected one or more users based at least on results of the electronic training and at least on the type of password breach that occurred as part of the one or more existing data breaches.

2 . The method of claim 1 , further comprising determining, by the one or more processors, the adjustment to the risk score based at least on the type of password breach.

3 . The method of claim 1 , further comprising generating, by the one or more processors, the electronic training based at least on the type of password breach.

4 . The method of claim 1 , further comprising selecting, by the one or more processors, the one or more users from a group of users having a same type of password breach.

5 . The method of claim 1 , further comprising classifying, by the one or more processors, the one or more password breaches into a type of password breach.

6 . The method of claim 5 , further comprising determining, by the one or more processors, the electronic training based at least on the type of data breach.

7 . The method of claim 1 , further comprising identifying, by the one or more processors, the one or more users as having one or more passwords subject to the one or more data breaches.

8 . The method of claim 1 , further comprising identifying, by the one or more processors, the one or more users as having one or more weak passwords.

9 . The method of claim 8 , further comprising determining, by the one or more processors, the one or more users as having one work weak passwords based at least on one or more weak password tests.

10 . The method of claim 8 , further comprising adjusting, by the one or more processors, the risk score of the one or more users responsive to identifying the one or more users as having one or more weak passwords.

11 . A system comprising:
one or more processors, coupled to memory and configured to: identify one or more types of password breach that occurred as part of one or more existing data breaches; select one or more users having a type of password breach, of the one or more types of password breach, that occurred as part of the one or more existing data breaches; communicate an electronic training, based at least on the type of password breach that occurred as part of the one or more existing data breaches, to the selected one or more users; and, adjust, a risk score of the selected one or more users based at least on results of the electronic training and at least on the type of password breach that occurred as part of the one or more existing data breaches.

12 . The system of claim 11 , wherein the one or more processors are further configured to determine the adjustment to the risk score based at least on the type of password breach.

13 . The system of claim 11 , wherein the one or more processors are further configured to generate the electronic training based at least on the type of password breach.

14 . The system of claim 11 , wherein the one or more processors are further configured to select the one or more users from a group of users having a same type of password breach.

15 . The system of claim 11 , wherein the one or more processors are further configured to classify the one or more password breaches into a type of password breach.

16 . The system of claim 15 , wherein the one or more processors are further configured to determine the electronic training based at least on the type of data breach.

17 . The system of claim 11 , wherein the one or more processors are further configured to identify the one or more users as having one or more passwords subject to the one or more data breaches.

18 . The system of claim 11 , wherein the one or more processors are further configured to identify the one or more users as having one or more weak passwords.

19 . The system of claim 18 , wherein the one or more processors are further configured to identity the one or more users as having one work weak passwords based at least on one or more weak password tests.

20 . The system of claim 18 , wherein the one or more processors are further configured to adjust the risk score of the one or more users responsive to identifying the one or more users as having one or more weak passwords.

Assignees

• Knowbe4 Inc

Inventors

• Kras Greg

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G09B9/00

  Simulators for teaching or training purposes (for the use of weapons F41; computing aspects G06; {protocols for games, networked simulations or virtual reality H04L67/131}) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G09B5/00

  Electrically-operated educational appliances (working with questions and answers G09B7/00; simulators G09B9/00; advertising or displaying in general G09F) · CPC title

• G06F21/46 Primary

  by designing passwords or checking the strength of passwords · CPC title