unauthenticatedmail relayWindowsXPNobackupfailurealertsApplicationwith > 1000vulnerabilitiesSMBsigningnotenabledAdobeFlashinappropriateunconstraineddelegation inActiveDirectoryGuestSSID butno guestisolationuntrainedclickersVPN withweakencryptionInappropriteFirewallrules (notRDP)WinlogoncachedefaultvalueWirelessPSK olderthan 2yearsWindowsServer2003/2008No DMZ(whereappropriate)DNSloggingnotenabledroguedeviceDefaultadmincredentialsTelnetLMHash onadminNIPSdisabled/unconfiguredcpasswordNobotnetfilterSegmentationwithout ACLs>20%phishclick rateNoGeo-IPblockingUnpatchedExchangecomplianceviolationEDRMissingonendpointinsecurezonetransfersInsecureshare withPII/PHIPCIviolationunencryptedbackupsNoDKIM /DMARCEnd userPasswordsthat neverexpireNoredundantISPStaleusersolder than1yearLLMNRenabledunencryptedwebmanagementinterface"DomainUsers" groupas localadministratorNo MFAon365AdminComputersnotjoined toAD (or AAD)VMwithoutautostartBypassusersin DUOlegacyconfigurationnot removedGPO withinsecuresettingsminpasswordlength < 12characterspasswordcomplexitynotenforcedPlain textpassworddiscoveredin shareNoSPFrecordWindows7DefaultSNMPWritevalueUsersare localadminspasswordspreadsheetWhitelisteddomains inemail filterTeamviewer/ VNCUnlicensedhardwareor softwareIndividualuserpermissionsin sharescriticallyout-of-datefirmwareNo driveencryptionunauthenticatedmail relayWindowsXPNobackupfailurealertsApplicationwith > 1000vulnerabilitiesSMBsigningnotenabledAdobeFlashinappropriateunconstraineddelegation inActiveDirectoryGuestSSID butno guestisolationuntrainedclickersVPN withweakencryptionInappropriteFirewallrules (notRDP)WinlogoncachedefaultvalueWirelessPSK olderthan 2yearsWindowsServer2003/2008No DMZ(whereappropriate)DNSloggingnotenabledroguedeviceDefaultadmincredentialsTelnetLMHash onadminNIPSdisabled/unconfiguredcpasswordNobotnetfilterSegmentationwithout ACLs>20%phishclick rateNoGeo-IPblockingUnpatchedExchangecomplianceviolationEDRMissingonendpointinsecurezonetransfersInsecureshare withPII/PHIPCIviolationunencryptedbackupsNoDKIM /DMARCEnd userPasswordsthat neverexpireNoredundantISPStaleusersolder than1yearLLMNRenabledunencryptedwebmanagementinterface"DomainUsers" groupas localadministratorNo MFAon365AdminComputersnotjoined toAD (or AAD)VMwithoutautostartBypassusersin DUOlegacyconfigurationnot removedGPO withinsecuresettingsminpasswordlength < 12characterspasswordcomplexitynotenforcedPlain textpassworddiscoveredin shareNoSPFrecordWindows7DefaultSNMPWritevalueUsersare localadminspasswordspreadsheetWhitelisteddomains inemail filterTeamviewer/ VNCUnlicensedhardwareor softwareIndividualuserpermissionsin sharescriticallyout-of-datefirmwareNo driveencryption

Risk Assessment BINGO - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
  1. unauthenticated mail relay
  2. Windows XP
  3. No backup failure alerts
  4. Application with > 1000 vulnerabilities
  5. SMB signing not enabled
  6. Adobe Flash
  7. inappropriate unconstrained delegation in Active Directory
  8. Guest SSID but no guest isolation
  9. untrained clickers
  10. VPN with weak encryption
  11. Inapproprite Firewall rules (not RDP)
  12. Winlogon cache default value
  13. Wireless PSK older than 2 years
  14. Windows Server 2003/2008
  15. No DMZ (where appropriate)
  16. DNS logging not enabled
  17. rogue device
  18. Default admin credentials
  19. Telnet
  20. LM Hash on admin
  21. NIPS disabled /unconfigured
  22. cpassword
  23. No botnet filter
  24. Segmentation without ACLs
  25. >20% phish click rate
  26. No Geo-IP blocking
  27. Unpatched Exchange
  28. compliance violation
  29. EDR Missing on endpoint
  30. insecure zone transfers
  31. Insecure share with PII/PHI
  32. PCI violation
  33. unencrypted backups
  34. No DKIM / DMARC
  35. End user Passwords that never expire
  36. No redundant ISP
  37. Stale users older than 1year
  38. LLMNR enabled
  39. unencrypted web management interface
  40. "Domain Users" group as local administrator
  41. No MFA on 365 Admin
  42. Computers not joined to AD (or AAD)
  43. VM without autostart
  44. Bypass users in DUO
  45. legacy configuration not removed
  46. GPO with insecure settings
  47. min password length < 12 characters
  48. password complexity not enforced
  49. Plain text password discovered in share
  50. No SPF record
  51. Windows 7
  52. Default SNMP Write value
  53. Users are local admins
  54. password spreadsheet
  55. Whitelisted domains in email filter
  56. Teamviewer / VNC
  57. Unlicensed hardware or software
  58. Individual user permissions in shares
  59. critically out-of-date firmware
  60. No drive encryption