Spycloud, Inc.

Avast Software A.s.

David Endler

Alen Puzic

Edward Ross

Rohit Dhamankar

Nick Brands

Pedram Amini

Jacob Wagh

A process that includes receiving an identity risk query for a user, accessing a security database of available user information associated with a plurality of users, and identifying that the user is associated with first available user information of the available user information included in the security database. The process also includes generating a first identity risk score for the user based on the first available user information, and providing the first identity risk score in response to the identity risk query.

User identity risk score generation in an enterprise network

A process that includes receiving a session identity protection query that includes a target domain. The process further includes accessing a security database of compromised cookie data associated with a plurality of domains and determining the target domain is associated with first compromised cookie data of the compromised cookie data included in the security database. The process includes providing the first compromised cookie data in response the session identity protection query.

Browser session security system

Provided is a process, including: obtaining a first password to a private computer network; determining, with a credential-monitoring application within the private computer network, whether the first password satisfies one or more criteria by: comparing the first password to a set of compromised credentials within a database within the private computer network; and determining whether the first password matches one or more passwords within the database; and in response to the determination that the first password satisfies the one or more criteria from among the plurality of criteria, causing a use of the first password to access the private computer network to be rejected and causing a first user associated with the first password to be notified to change the first password.

Filtering passwords based on a plurality of criteria

Provided is a process including: obtaining, with a domain controller of a private computer network, a set of user-authentication credentials comprising a first username and a first password; querying a distributed credential-monitoring application; receiving query results including one or more passwords associated with the first username; determining that at least some of the one or more passwords in the query results match the obtained first password; and in response to the determination, blocking, with the domain controller, access to a first user account on the private computer network associated with the obtained first username and first password.

Detecting use of compromised security credentials in private enterprise networks

Provided is a process that includes: obtaining a fictitious data entry associated with a field present in a plurality of records associated with an online resource; sending a query to a monitoring application, the query specifying the fictitious data entry and a request to determine whether a second repository of compromised data includes the fictitious data entry; in response to the query, receiving query results indicating that the second repository of compromised data includes the fictitious data entry; in response to the received indication that the second repository of compromised data includes the fictitious data entry, identifying at least some of the first set of one or more repositories that store the data entry; designating other data entries within the at least some of the first set of one or more repositories as potentially having been breached; and storing the designation in memory.

Generating and monitoring fictitious data entries to detect breaches

Provided is a process that includes: obtaining with a distributed application comprising an identity management system, a first password; comparing with the distributed application, the first password to a set of compromised credentials within a database external to the network-accessible resource; receiving one or more passwords that match the first password based on the comparison; determining with the distributed application whether the one or more passwords satisfy a criterion; and in response to the determination that the one or more passwords satisfy the criterion, causing the first user associated with a first account and the first password to be notified that the first password has been compromised.

Detecting use of passwords that appear in a repository of breached credentials

Provided is a process that includes: obtaining, with one or more processors, a set of user-authentication credentials of a plurality of users; accessing, with one or more processors, a repository of breached credentials and determining, with one or more processors, an amount of the obtained set of user-authentication credentials in the repository of breached credentials, wherein the repository includes credentials from a plurality of entities obtained after the entities suffered a breach; and determining, with one or more processors, a score based on the amount of the set of user-authentication credentials in the repository of breached credentials, wherein the score is indicative of effectiveness of cybersecurity practices of the entity and the users associated with the entity.

Measuring data-breach propensity

Provided is a process that includes: obtaining, with one or more processors, a query identifying a user identification; retrieving, with one or more processors, via an application programming interface, from a database, one or more passwords associated with one or more user identification entries in the database that matches the user identification in response to the obtained query; determining, with one or more processors, whether the one or more passwords matches a password associated with the user identification; blocking, with one or more processors, access to a user account associated with the user identification and the password when the one or more passwords matches the password associated with the user identification; and notifying, with one or more processors, a user associated with the user account to reset the password when the one or more passwords matches the password associated with the user identification.

Determining the intersection of a set of compromised credentials with a set of active credentials with data structures and architectures that expedite comparisons

Modifying system configuration data. At least some of the illustrative embodiments are methods including changing operation of a program on a computer system that comprises a native operating system stored on a long term storage device. In some cases, the changing by: reading system configuration data of the native operating system, the reading by a scan program executed under a non-native operating system booted on the computer system; identifying, by the scan program, the program on the long term storage device; and modifying, by the scan program, the system configuration data of the native operating system such that the change in operating of the program is implemented on a subsequent boot of the computer system under the native operating system.

Growing community of inventors

Austin, TX, United States of America

David Endler