>50%passwordscrackedExternalRDPWhitelisteddomains inemail filterTelnetWirelessPSK olderthan 2yearsNo IRPlanNoDMZUnlicensedhardwareor software"We updatewhen thereareproblems"NoMFADefaultSNMPWritevalueNoEDRWindowsServer2003/2008Shares with"Everyone,Full Control"crackedadminpasswordComputersnot joinedto DomainNo truenetworksegmentationStaleObjectsolder than1yearMinimalGroupPolicyNo DRPlan"We're assecure aswe canbe."Usersare localadminsNooffsitebackupsPasswordsneverexpireNoSecurityAwarenessTrainingDNSloggingnotenabledUnidentifiedPCIrequirementsWindows7GuestSSID butnoisolation"We'venever hadanincident."closetspaghettiPlain textpassworddiscoveredin sharepasswordspreadsheetAdobeFlashDefaultadmincredentials"We justuseWindowsDefender"ManualBackupsWindowsXPNo driveencryptionInappropriteFirewallrules (notRDP)Individualpermissionsin sharesNoDKIM /DMARCUnpatchedExchangeNoSPFrecordTeamviewer/ VNC>50%passwordscrackedExternalRDPWhitelisteddomains inemail filterTelnetWirelessPSK olderthan 2yearsNo IRPlanNoDMZUnlicensedhardwareor software"We updatewhen thereareproblems"NoMFADefaultSNMPWritevalueNoEDRWindowsServer2003/2008Shares with"Everyone,Full Control"crackedadminpasswordComputersnot joinedto DomainNo truenetworksegmentationStaleObjectsolder than1yearMinimalGroupPolicyNo DRPlan"We're assecure aswe canbe."Usersare localadminsNooffsitebackupsPasswordsneverexpireNoSecurityAwarenessTrainingDNSloggingnotenabledUnidentifiedPCIrequirementsWindows7GuestSSID butnoisolation"We'venever hadanincident."closetspaghettiPlain textpassworddiscoveredin sharepasswordspreadsheetAdobeFlashDefaultadmincredentials"We justuseWindowsDefender"ManualBackupsWindowsXPNo driveencryptionInappropriteFirewallrules (notRDP)Individualpermissionsin sharesNoDKIM /DMARCUnpatchedExchangeNoSPFrecordTeamviewer/ VNC

Risk Assessment Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  1. >50% passwords cracked
  2. External RDP
  3. Whitelisted domains in email filter
  4. Telnet
  5. Wireless PSK older than 2 years
  6. No IR Plan
  7. No DMZ
  8. Unlicensed hardware or software
  9. "We update when there are problems"
  10. No MFA
  11. Default SNMP Write value
  12. No EDR
  13. Windows Server 2003/2008
  14. Shares with "Everyone, Full Control"
  15. cracked admin password
  16. Computers not joined to Domain
  17. No true network segmentation
  18. Stale Objects older than 1year
  19. Minimal Group Policy
  20. No DR Plan
  21. "We're as secure as we can be."
  22. Users are local admins
  23. No offsite backups
  24. Passwords never expire
  25. No Security Awareness Training
  26. DNS logging not enabled
  27. Unidentified PCI requirements
  28. Windows 7
  29. Guest SSID but no isolation
  30. "We've never had an incident."
  31. closet spaghetti
  32. Plain text password discovered in share
  33. password spreadsheet
  34. Adobe Flash
  35. Default admin credentials
  36. "We just use Windows Defender"
  37. Manual Backups
  38. Windows XP
  39. No drive encryption
  40. Inapproprite Firewall rules (not RDP)
  41. Individual permissions in shares
  42. No DKIM / DMARC
  43. Unpatched Exchange
  44. No SPF record
  45. Teamviewer / VNC