DNSloggingnotenabledAdobeFlashNoSPFrecordNo IRPlanComputersnot joinedto DomainUnpatchedExchangeMinimalGroupPolicyNooffsitebackups>50%passwordscrackedDefaultSNMPWritevalueWindowsXPNo truenetworksegmentation"We updatewhen thereareproblems"Teamviewer/ VNC"We'venever hadanincident."Usersare localadminsNoMFADefaultadmincredentialsStaleObjectsolder than1yearNoSecurityAwarenessTrainingInappropriteFirewallrules (notRDP)PasswordsneverexpireNo driveencryptionTelnetManualBackups"We're assecure aswe canbe."No DRPlanNoEDRNoDMZNoDKIM /DMARCGuestSSID butnoisolationPlain textpassworddiscoveredin shareWindowsServer2003/2008Shares with"Everyone,Full Control"Individualpermissionsin sharesWindows7"We justuseWindowsDefender"crackedadminpasswordUnidentifiedPCIrequirementsWhitelisteddomains inemail filterpasswordspreadsheetWirelessPSK olderthan 2yearsExternalRDPclosetspaghettiUnlicensedhardwareor softwareDNSloggingnotenabledAdobeFlashNoSPFrecordNo IRPlanComputersnot joinedto DomainUnpatchedExchangeMinimalGroupPolicyNooffsitebackups>50%passwordscrackedDefaultSNMPWritevalueWindowsXPNo truenetworksegmentation"We updatewhen thereareproblems"Teamviewer/ VNC"We'venever hadanincident."Usersare localadminsNoMFADefaultadmincredentialsStaleObjectsolder than1yearNoSecurityAwarenessTrainingInappropriteFirewallrules (notRDP)PasswordsneverexpireNo driveencryptionTelnetManualBackups"We're assecure aswe canbe."No DRPlanNoEDRNoDMZNoDKIM /DMARCGuestSSID butnoisolationPlain textpassworddiscoveredin shareWindowsServer2003/2008Shares with"Everyone,Full Control"Individualpermissionsin sharesWindows7"We justuseWindowsDefender"crackedadminpasswordUnidentifiedPCIrequirementsWhitelisteddomains inemail filterpasswordspreadsheetWirelessPSK olderthan 2yearsExternalRDPclosetspaghettiUnlicensedhardwareor software

Risk Assessment Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  1. DNS logging not enabled
  2. Adobe Flash
  3. No SPF record
  4. No IR Plan
  5. Computers not joined to Domain
  6. Unpatched Exchange
  7. Minimal Group Policy
  8. No offsite backups
  9. >50% passwords cracked
  10. Default SNMP Write value
  11. Windows XP
  12. No true network segmentation
  13. "We update when there are problems"
  14. Teamviewer / VNC
  15. "We've never had an incident."
  16. Users are local admins
  17. No MFA
  18. Default admin credentials
  19. Stale Objects older than 1year
  20. No Security Awareness Training
  21. Inapproprite Firewall rules (not RDP)
  22. Passwords never expire
  23. No drive encryption
  24. Telnet
  25. Manual Backups
  26. "We're as secure as we can be."
  27. No DR Plan
  28. No EDR
  29. No DMZ
  30. No DKIM / DMARC
  31. Guest SSID but no isolation
  32. Plain text password discovered in share
  33. Windows Server 2003/2008
  34. Shares with "Everyone, Full Control"
  35. Individual permissions in shares
  36. Windows 7
  37. "We just use Windows Defender"
  38. cracked admin password
  39. Unidentified PCI requirements
  40. Whitelisted domains in email filter
  41. password spreadsheet
  42. Wireless PSK older than 2 years
  43. External RDP
  44. closet spaghetti
  45. Unlicensed hardware or software