The core issue is a "flat" network architecture, which lacks internal controls to isolate resources. This design allows for broad, uncontrolled access, making it easy for sensitive storage to be inadvertently exposed. Implementing network segmentation divides the flat network into smaller, isolated zones (e.g., VLANs or subnets). Access Control Lists (ACLs) are then applied to the boundaries of these segments to enforce granular traffic rules. This approach directly remedies the architectural flaw by creating a defensible space around the sensitive file storage, allowing the company to explicitly deny public access while permitting legitimate internal traffic.

B. Configure logging and monitoring to the SIEM. This is a detective control that alerts on unauthorized access after it occurs, rather than a preventative measure that stops it from happening.
C. Deploy MFA to cloud storage locations. MFA strengthens user authentication but is ineffective if the storage is misconfigured for public, unauthenticated access, which bypasses the authentication process entirely.
D. Roll out an IDS. An Intrusion Detection System (IDS) is a detective control. It monitors and alerts on suspicious activity but does not actively block the traffic or fix the underlying network vulnerability.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations.

Control SC-7

Boundary Protection: This control explicitly discusses the need to "monitor and control communications at the external boundary of the system and at key internal boundaries within the system." The discussion section further clarifies

"This control also addresses the segmentation of systems and system components." This directly supports using segmentation and access controls (like ACLs) to secure internal resources.

2. National Institute of Standards and Technology (NIST) Special Publication 800-125B

Secure Virtual Network Configuration for Virtual Machine (VM) Protection.

Section 4.2

Network Segmentation: "Network segmentation is the separation of a network into smaller

isolated networks... Segmentation can be used to isolate VMs from one another and from other resources

which can help to contain the impact of a security breach." This highlights segmentation as a primary security solution in cloud/virtual environments.

3. Purdue University

"Information Security Policy (VII.B.2)"

Network Segmentation and Segregation.

Section 1

Standard: "Network segmentation and segregation will be used to control access to Sensitive and Restricted Data... Access Control Lists (ACLs) or other appropriate controls will be used to enforce the separation of network segments." This university policy document demonstrates the direct link between segmentation and ACLs as the standard solution for protecting sensitive data.