Running Head: ISE 510
1
ISE 510 Video Game Assignment
SNHU
ISE 510
2
Introduction
The Agent Surefire: InfoSec game has been played and a number of physical
vulnerabilities have been identified. A total of seven vulnerabilities have been
discovered, assessed, and documented which exist in the virtual environmental setting.
These elements have been categorized based on the specific methods that have been
specified in the game.
Seven security vulnerabilities
1. There was a computer system which was not locked and it did not require to
be logged in by a user. This is one of the key vulnerabilities as it contained
a folder which was titled “marketing” and it was saved in the network driver.
The folder contained confidential information such as press releases, budget,
artwork and details on strategic meetings. The vulnerability can be categorized
under “unauthorized access” as anyone could gain access into the system and
use or manipulate the sensitive data and information.
2. There were numerous employees who used the last four digits of their phone
numbers as the PIN for their voicemail. This is another major vulnerability
which falls under the “Using predictable PIN” category. Thus anyone could
get access into the voicemails of the personnel by merely using the phone
extension. In the voice mail by George Himsdale he had stated that he
wanted to discuss international partnership. A listener with malicious intent
could disrupt the deal. ab ab
3. An illegal software had been found in the drawer of an employee of the
organization. The disk actually contained Microsoft Office but it had been
labeled as MS Project and the same was cracked. In case the organizational
personnel would insert the specific disk into a computer system of the firm, it
ISE 510
3
could lead to a major ‘Malware infection’ that could compromise the security
posture of the entity.
4. The trash cans that were present there contained documents with official
information which should have been shredded instead of being thrown away
in the dustbin. The category under which the vulnerability can be placed is
“Improper handling or Disposal of Sensitive Documents”. In case anybody
would pass by these trash cans he or she could steal these documents
containing sensitive work-related data such as details about paychecks,
information on VIP clients, debriefs from sales calls and time reports.
5. Numerous drawers and cabinets were not unlocked and the contents contained
information on the company. It is necessary to make sure that all drawers and
cabinets are locked and secure whether the information contained in them is
sensitive or not. This vulnerability can be categorized under “Office Cabinets
and Drawers Security”.
6. Some of the employees of the firm had a large number of documents and
files on their desks which contained details relating to the firm’s business
plan. This physical vulnerability can be categorized under the “improper
handling of sensitive documents”. In order to take care of this vulnerability,
the employees need to make sure that the documents containing confidential
information are kept in a safe and secure manner.
7. There were a couple of Portable Device Assistants (PDAs) and a storage
device that had been placed under a desk. This particular physical
vulnerability can be categorized under “Lost Laptop or Portable Devices”. It is
necessary to ensure that all the devices such as laptops as well as portable
devices are secured to the desk and they have cable locks. In case an
ISE 510
4
employee goes away from his or her desk, then they must ensure that the
device that has been assigned to them is securely locked up in their drawer.
This will prevent unauthorized individuals cannot from gaining access into the
systems and stealing or viewing sensitive information.
It is necessary to eliminate these physical vulnerabilities and keep the company
information on a safe and secure manner. ab ab ab
Reference:
Federal Incident Reporting Guidelines | CISA. (2019). Us-cert.gov. Retrieved 31
August 2019, from https://www.us-cert.gov/government-users/reporting-requirements
