During a cloud lake review, auditors find a storage bucket of citizen personally identifiable information left publicly readable. What security baseline judgment is correct?
Select an answer to reveal the explanation.
Short Explanation
Leaving citizen identity files on a public shelf is a breach waiting to happen, cloud or not. Public buckets of PII fail the basic security baseline for a municipal lake. Rename tricks and “it’s only cloud” excuses do not fix exposure.
Full Explanation
Public buckets of citizen personally identifiable information are unacceptable and must be closed and remediated immediately when auditors find them. Cloud object stores make mis-sharing easy; municipal baseline judgment is that PII exposure via public read access is a security incident, not a naming inconvenience. BDPC cloud security awareness treats this as a hard fail for civic lakes.
Calling public citizen PII buckets fine if the folder name includes “temporary” confuses labeling with access control and will not satisfy auditors. Allowing only encrypted public buckets for open civic transparency of every identity field misunderstands transparency—encryption does not remove public readability for holders of the URL if objects are world-readable. Claiming PII exposure rules apply to paper forms but never to cloud object stores invents a medium-based exemption that does not exist.
Exam caveat: some non-PII open data should be public by policy; the bright line is citizen PII and other protected categories, which require tight IAM, logging, and often tokenization or redaction. Operational check: scan for publicly readable buckets, quarantine any with PII, rotate exposed credentials or URLs, complete incident documentation, and add continuous public-access guardrails with alerting.