To share files quickly with a supplier, an engineer sets a cloud storage container to allow anonymous public access. Weeks later the files appear in search results. There is no evidence of intent, and the engineer reported the problem as soon as she noticed it. How should this threat be classified?
Select an answer to reveal the explanation.
Short Explanation
Think of a coworker who props the back door open so the delivery driver can get in, then forgets about it. No bad intent, real damage. That's an accidental insider -- and you'll see plenty of those, because good people make configuration mistakes all the time.
Full Explanation
The accidental or unintentional insider is a recognized threat actor type: someone with legitimate access who causes harm through error, carelessness or misunderstanding rather than intent. The engineer had authorized access, made a configuration choice to finish a legitimate task faster, showed no sign of malicious purpose and self-reported the problem, which together define the unintentional category. Classifying her as a malicious insider seeking profit requires evidence of intent, such as selling or deliberately leaking files, and the scenario says there is none. Calling it an external threat because outsiders found the data confuses the actor who created the exposure with those who discovered it; the root cause sits inside the organization. Labeling it a supply chain threat blames the recipient, yet the supplier did nothing to introduce the weakness; the exposure came from how the container was configured. Exam caveat: accidental insiders are addressed mainly through training, guardrails and safer defaults, not disciplinary deterrence alone. Operational check: remove public access, review access logs to determine what was downloaded, assess breach notification duties, and apply a policy or posture check that blocks anonymous access on storage containers by default.