Scanning is a good idea but unfortunately most inexpensive scans only do vulnerability scanning which wouldn't catch this particular problem. A potential solut

Scanning is a good idea but unfortunately most inexpensive scans only do vulnerability scanning which wouldn't catch this particular problem. A potential solution is to have a second set of eyes on something. Take some insight from the pair programming model and have 2 sys admins look over a system design before it goes into production. I once heard someone say "Experience isn't worth what it costs, but you just can't get it any other way." It's really unfortunate that 14 million of us Verizon customers had to pay the price for that sys admin to learn the lesson. But back to the original article, this whole thing was broken on many levels. Whoever wrote the logging function really shouldn't have been logging sensitive data like that. The logs should have been consumed by some sort of logging platform directly instead of flat files on an S3 bucket. The S3 bucket shouldn't have been publicly accessible. Someone should have reviewed this system. It's also quite possible that someone did review it and threw up red flags and was squashed by management because they had to hit a shipment date. And I'm sure there are many other reasons.