While undergoing a security audit, it is determined that an organization has several backup repositories nested in the cloud without any level of…

The audit identified that backup repositories lack any protection, which is fundamentally an access control failure. The most immediate and critical action is to contain this vulnerability by restricting access. Applying the principle of least privilege through mechanisms like Identity and Access Management (IAM) policies or Access Control Lists (ACLs) directly mitigates the risk of unauthorized data exposure. This is the foundational first step in securing any data asset, especially sensitive backups. Actions such as investigation or scanning should follow after the immediate threat has been contained.

B. Run a vulnerability scan: This action identifies software vulnerabilities (e.g., CVEs), not the configuration issue of open access permissions, which is the stated problem.

C. Disable the backup repositories: This is an overly drastic measure that would halt critical business continuity functions. Restricting access secures the data while maintaining operational availability.

D. Audit access logs: This is an investigative step to determine if a compromise has already occurred. It is reactive, whereas restricting access is a proactive, protective measure that must be prioritized.

1. Amazon Web Services (AWS) Documentation: In the Amazon S3 User Guide, the section on "Identity and access management for Amazon S3" emphasizes that managing access is a primary security task. It states, "By default, all S3 resources...are private and can be accessed only by the object owner." The first step to correct an unprotected repository is to enforce this principle. (See: AWS S3 User Guide, "Blocking public access to your Amazon S3 storage," Section: Block public access settings).

2. National Institute of Standards and Technology (NIST): NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, identifies Access Control (AC) as a fundamental control family. Control AC-3, "Access Enforcement," requires that the system enforces approved authorizations for logical access to information. This directly supports restricting access as the primary corrective action. (See: NIST SP 800-53 Rev. 5, pp. 53-54, Control Family: Access Control).

3. Microsoft Azure Documentation: The security recommendations for Azure Blob Storage prioritize managing access. The documentation states, "The first step in securing your Blob storage is to control who can access it... Azure Storage supports Azure Active Directory (Azure AD), Shared Key authorization, and shared access signatures (SAS)." This highlights access control as the initial and most critical security measure. (See: Microsoft Docs, "Security recommendations for Blob storage," Section: Manage access to Blob data).

4. Carnegie Mellon University, Software Engineering Institute (SEI): In the publication Cloud Security: A Review of Current Issues, and A Proposed Approach to Secure Cloud Adoption, the authors highlight that "improperly configured access controls" are a primary threat. The recommended mitigation is the immediate implementation of strong authentication and authorization mechanisms. (See: CMU/SEI-2019-TR-003, Section 3.2.1, Data Breaches).