When CiviCRM is installed for the first time, it provides a standard set of permissions with the CMS. The biggest source of security problems with CiviCRM is permissioning, so it is critical that you visit your CMS permissions and check them.
Setting permissions is an important part of the CiviCRM planning process. From the outset, you should understand what each permission does so that you can configure your installation properly.
Navigate in Drupal to People | Permissions, and scroll down to CiviCRM Profile permissions.
CiviCRM: profiles listings is used in situations where you provide listings of contacts on your website, for example, a membership directory. If you want everyone to be able to search for and see the lists of contacts on your site, you can give the anonymous user and the authenticated user this permission. Note that these permissions are global. If you want only some lists to be available, then you can remove this permission...