McGraw Hill's S3 buckets exposed 100,000 students' grades and personal info

Misconfigured Amazon Web Services S3 buckets belonging to McGraw Hill exposed more than 100,000 students' information as well as the education publishing giant's own source code and digital keys, according to security researchers. The research team at vpnMentor said they discovered the open S3 buckets on June 12, and contacted …

[PhoenixKebab]

Published but unread

That's not much of an endorsement of the AWS Security books that they publish.

[Potemkine!]

It's not the first time this happens. Shouldn't these buckets be secured by default?

== Bring us Dabbsy back! ==

[Anonymous Coward]

They ARE secure by default with only the private owner account having access - adding public access requires permissions to be granted by an administrator.

However a combination of the JFDI approach to problem solving and admins assuming they are JUST granting filesystem permissions and something else will manage security (i.e. the typical on-prem model) means mistakes are made.

[John H Woods]

They should be ...

... and they are.

Just create yourself a free AWS account and then create one if you don't believe me.

[David 140]

Re: They should be ...

Yeah, but I don't think that was the case a few years ago. And if the buckets were created then___

[Mike 137]

Re: They should be ...

"There's a hole in my bucket, dear Liza, dear Liza..."

A common problem is that client side devs disable the security to get their applications working, and then neglect to enable it again before they go live. Sometimes, they develop applications that won't even work with security enabled.

[Gene Cash]

"could face enforcement actions"

Good. That's the only way these people will start paying attention to security.