Usersare localadmins"We're assecure aswe canbe."No DRPlanWindows7StaleObjectsolder than1yearDNSloggingnotenabledTelnetWhitelisteddomains inemail filterNoDMZWindowsXP>50%passwordscrackedWindowsServer2003/2008passwordspreadsheetComputersnot joinedto DomainIndividualpermissionsin sharesUnidentifiedPCIrequirementsNoSPFrecordUnpatchedExchange"We'venever hadanincident."DefaultSNMPWritevaluePasswordsneverexpireWirelessPSK olderthan 2yearsGuestSSID butnoisolationNoEDRExternalRDPNo truenetworksegmentationUnlicensedhardwareor softwareTeamviewer/ VNCNoSecurityAwarenessTrainingDefaultadmincredentialsManualBackupsNooffsitebackupsAdobeFlashMinimalGroupPolicy"We justuseWindowsDefender"No IRPlanInappropriteFirewallrules (notRDP)No driveencryptionclosetspaghettiShares with"Everyone,Full Control"NoDKIM /DMARCPlain textpassworddiscoveredin sharecrackedadminpassword"We updatewhen thereareproblems"NoMFAUsersare localadmins"We're assecure aswe canbe."No DRPlanWindows7StaleObjectsolder than1yearDNSloggingnotenabledTelnetWhitelisteddomains inemail filterNoDMZWindowsXP>50%passwordscrackedWindowsServer2003/2008passwordspreadsheetComputersnot joinedto DomainIndividualpermissionsin sharesUnidentifiedPCIrequirementsNoSPFrecordUnpatchedExchange"We'venever hadanincident."DefaultSNMPWritevaluePasswordsneverexpireWirelessPSK olderthan 2yearsGuestSSID butnoisolationNoEDRExternalRDPNo truenetworksegmentationUnlicensedhardwareor softwareTeamviewer/ VNCNoSecurityAwarenessTrainingDefaultadmincredentialsManualBackupsNooffsitebackupsAdobeFlashMinimalGroupPolicy"We justuseWindowsDefender"No IRPlanInappropriteFirewallrules (notRDP)No driveencryptionclosetspaghettiShares with"Everyone,Full Control"NoDKIM /DMARCPlain textpassworddiscoveredin sharecrackedadminpassword"We updatewhen thereareproblems"NoMFA

Risk Assessment Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  1. Users are local admins
  2. "We're as secure as we can be."
  3. No DR Plan
  4. Windows 7
  5. Stale Objects older than 1year
  6. DNS logging not enabled
  7. Telnet
  8. Whitelisted domains in email filter
  9. No DMZ
  10. Windows XP
  11. >50% passwords cracked
  12. Windows Server 2003/2008
  13. password spreadsheet
  14. Computers not joined to Domain
  15. Individual permissions in shares
  16. Unidentified PCI requirements
  17. No SPF record
  18. Unpatched Exchange
  19. "We've never had an incident."
  20. Default SNMP Write value
  21. Passwords never expire
  22. Wireless PSK older than 2 years
  23. Guest SSID but no isolation
  24. No EDR
  25. External RDP
  26. No true network segmentation
  27. Unlicensed hardware or software
  28. Teamviewer / VNC
  29. No Security Awareness Training
  30. Default admin credentials
  31. Manual Backups
  32. No offsite backups
  33. Adobe Flash
  34. Minimal Group Policy
  35. "We just use Windows Defender"
  36. No IR Plan
  37. Inapproprite Firewall rules (not RDP)
  38. No drive encryption
  39. closet spaghetti
  40. Shares with "Everyone, Full Control"
  41. No DKIM / DMARC
  42. Plain text password discovered in share
  43. cracked admin password
  44. "We update when there are problems"
  45. No MFA