BreachWatch
BreachWatch provides organizations oversight of the vulnerabilities of user's passwords through active monitoring of dark web breach data. Users and administrators are notified if any of their passwords in a record have been used in publicly known breach that could leave your organization vulnerable to a credential stuffing attack or an account takeover.
BreachWatch will prompt the user on their client device to Resolve the breached password by either changing the password or ignoring it. If a password alert is ignored, then that record will be skipped on future scans until the password is reset. The user may also do nothing (deferring a response) and leave the risky password unchanged and thus still "at risk".
BreachWatch provides Admins a dashboard overview and a summary table in the Admin Console detailing how users have dealt with their BreachWatch notifications.
If users have "At Risk" or "Ignored" passwords, the Keeper Administrator can click on a user's name to bring up the 'User Detail' to gain access to their email address so they can request the user to take action.
The user-specific BreachWatch data does not include shared records, only the records the user owns. Additionally, if a record does not contain a password, it will not be shown in the count.
If the optional, Advanced Reporting & Alerts module is installed, then BreachWatch specific events are sent from the devices/clients and can be used to report activity with a variety of filters, and/or generate an alert.
IMPORTANT: To activate event-level reporting of BreachWatch data to the Advanced Reporting & Alerts Module you must enable the event role enforcement policy under the specific role > Enforcement Policies > Vault Features screen.
All end user devices with the Keeper Password Manager application should be updated as they now support the sending of password status and events data to the console.
The BreachWatch capability can be deployed selectively to your organization via Role Enforcements. The Pause BreachWatch on client devices toggle controls whether devices send events for reporting purposes, and whether to pause the service so it will not appear on the user's devices at all. Note that enabling events to the reporting module will send record event metadata (User Email, Record UID, IP Address and Device Type) from Keeper’s backend to any connected SIEM product.
If you do not want to deploy BreachWatch to your entire organization at once, you can control the deployment using the Pause BreachWatch on client devices toggle. Users in this node will not have BreachWatch enabled on their client devices.
BreachWatch is a Zero Knowledge architecture that uses a number of layered techniques to protect our customer’s information. For detailed technical information regarding the security and encryption model of BreachWatch, please visit the BreachWatch section on the Keeper Encryption Model documentation by clicking This Link.
