"Parts of Mandrill's infrastructure are hosted with Amazon Web Services (AWS), and we use EC2 Security Groups to control access." then "As a result, a cluster o

"Parts of Mandrill's infrastructure are hosted with Amazon Web Services (AWS), and we use EC2 Security Groups to control access." then "As a result, a cluster of servers hosting Mandrill's internal application logs was made publicly accessible instead of allowing internal-only access." Does this mean that security groups (ie. firewalls) are the only line of defense between _the internet_ and customer data?