1
Running Head: ISE 510
ISE 510 Video Game Assignment
Carlos Delapaz
SNHU
September 1,2019
2
ISE 510
Introduction
The Agent Surefire: InfoSec game has been played and a number of physical
vulnerabilities have been identified. A total of seven vulnerabilities have been discovered,
assessed, and documented which exist in the virtual environmental setting. These elements
have been categorized based on the specific methods that have been specified in the game.
Seven security vulnerabilities
1. There was a computer system which was not locked and it did not require to be
logged in by a user. This is one of the key vulnerabilities as it contained a folder
which was titled “marketing” and it was saved in the network driver. The folder
contained confidential information such as press releases, budget, artwork and details
on strategic meetings. The vulnerability can be categorized under “unauthorized
access” as anyone could gain access into the system and use or manipulate the
sensitive data and information.
2. There were numerous employees who used the last four digits of their phone numbers
as the PIN for their voicemail. This is another major vulnerability which falls under
the “Using predictable PIN” category. Thus anyone could get access into the
voicemails of the personnel by merely using the phone extension. In the voice mail by
George Himsdale he had stated that he wanted to discuss international partnership. A
listener with malicious intent could disrupt the deal.
3. An illegal software had been found in the drawer of an employee of the organization.
The disk actually contained Microsoft Office but it had been labeled as MS Project
and the same was cracked. In case the organizational personnel would insert the
specific disk into a computer system of the firm, it could lead to a major ‘Malware
infection’ that could compromise the security posture of the entity.
3
ISE 510
4. The trash cans that were present there contained documents with official information
which should have been shredded instead of being thrown away in the dustbin. The
category under which the vulnerability can be placed is “Improper handling or
Disposal of Sensitive Documents”. In case anybody would pass by these trash cans he
or she could steal these documents containing sensitive work-related data such as
details about paychecks, information on VIP clients, debriefs from sales calls and time
reports.
5. Numerous drawers and cabinets were not unlocked and the contents contained
information on the company. It is necessary to make sure that all drawers and cabinets
are locked and secure whether the information contained in them is sensitive or not.
This vulnerability can be categorized under “Office Cabinets and Drawers Security”.
6. Some of the employees of the firm had a large number of documents and files on their
desks which contained details relating to the firm’s business plan. This physical
vulnerability can be categorized under the “improper handling of sensitive
documents”. In order to take care of this vulnerability, the employees need to make
sure that the documents containing confidential information are kept in a safe and
secure manner.
7. There were a couple of Portable Device Assistants (PDAs) and a storage device that
had been placed under a desk. This particular physical vulnerability can be
categorized under “Lost Laptop or Portable Devices”. It is necessary to ensure that all
the devices such as laptops as well as portable devices are secured to the desk and
they have cable locks. In case an employee goes away from his or her desk, then they
must ensure that the device that has been assigned to them is securely locked up in
their drawer. This will prevent unauthorized individuals cannot from gaining access
into the systems and stealing or viewing sensitive information.
4
ISE 510
It is necessary to eliminate these physical vulnerabilities and keep the company
information on a safe and secure manner.
Reference:
Federal Incident Reporting Guidelines | CISA. (2019).@Us-cert.gov. Retrieved 31 August
2019, from https://www.us-cert.gov/government-users/reporting-requirements
