WindowsXPNooffsitebackupsExternalRDPIndividualpermissionsin sharesWhitelisteddomains inemail filter"We'venever hadanincident."TelnetNoDMZ"We justuseWindowsDefender"crackedadminpasswordGuestSSID butnoisolationUnidentifiedPCIrequirementsUsersare localadminsWindowsServer2003/2008Windows7No DRPlanNoEDRInappropriteFirewallrules (notRDP)No driveencryptionManualBackupsTeamviewer/ VNCNoSecurityAwarenessTrainingpasswordspreadsheetMinimalGroupPolicy>50%passwordscrackedWirelessPSK olderthan 2yearsUnlicensedhardwareor software"We're assecure aswe canbe."Plain textpassworddiscoveredin shareNoDKIM /DMARCNo truenetworksegmentationclosetspaghetti"We updatewhen thereareproblems"NoSPFrecordDefaultSNMPWritevaluePasswordsneverexpireNo IRPlanAdobeFlashComputersnot joinedto DomainNoMFADefaultadmincredentialsShares with"Everyone,Full Control"DNSloggingnotenabledUnpatchedExchangeStaleObjectsolder than1yearWindowsXPNooffsitebackupsExternalRDPIndividualpermissionsin sharesWhitelisteddomains inemail filter"We'venever hadanincident."TelnetNoDMZ"We justuseWindowsDefender"crackedadminpasswordGuestSSID butnoisolationUnidentifiedPCIrequirementsUsersare localadminsWindowsServer2003/2008Windows7No DRPlanNoEDRInappropriteFirewallrules (notRDP)No driveencryptionManualBackupsTeamviewer/ VNCNoSecurityAwarenessTrainingpasswordspreadsheetMinimalGroupPolicy>50%passwordscrackedWirelessPSK olderthan 2yearsUnlicensedhardwareor software"We're assecure aswe canbe."Plain textpassworddiscoveredin shareNoDKIM /DMARCNo truenetworksegmentationclosetspaghetti"We updatewhen thereareproblems"NoSPFrecordDefaultSNMPWritevaluePasswordsneverexpireNo IRPlanAdobeFlashComputersnot joinedto DomainNoMFADefaultadmincredentialsShares with"Everyone,Full Control"DNSloggingnotenabledUnpatchedExchangeStaleObjectsolder than1year

Risk Assessment Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  1. Windows XP
  2. No offsite backups
  3. External RDP
  4. Individual permissions in shares
  5. Whitelisted domains in email filter
  6. "We've never had an incident."
  7. Telnet
  8. No DMZ
  9. "We just use Windows Defender"
  10. cracked admin password
  11. Guest SSID but no isolation
  12. Unidentified PCI requirements
  13. Users are local admins
  14. Windows Server 2003/2008
  15. Windows 7
  16. No DR Plan
  17. No EDR
  18. Inapproprite Firewall rules (not RDP)
  19. No drive encryption
  20. Manual Backups
  21. Teamviewer / VNC
  22. No Security Awareness Training
  23. password spreadsheet
  24. Minimal Group Policy
  25. >50% passwords cracked
  26. Wireless PSK older than 2 years
  27. Unlicensed hardware or software
  28. "We're as secure as we can be."
  29. Plain text password discovered in share
  30. No DKIM / DMARC
  31. No true network segmentation
  32. closet spaghetti
  33. "We update when there are problems"
  34. No SPF record
  35. Default SNMP Write value
  36. Passwords never expire
  37. No IR Plan
  38. Adobe Flash
  39. Computers not joined to Domain
  40. No MFA
  41. Default admin credentials
  42. Shares with "Everyone, Full Control"
  43. DNS logging not enabled
  44. Unpatched Exchange
  45. Stale Objects older than 1year