A provider encrypts all customer data at rest by default, using keys it creates and manages. A bank's threat model includes malicious provider insiders and compelled disclosure of data by the provider. Which change best addresses that threat?
Select an answer to reveal the explanation.
Short Explanation
If the landlord holds both the lock and the key, changing the lock more often doesn't keep the landlord out. When provider insiders are in your threat model, you need the key in your own hands. That's the point of customer-controlled keys, ideally in an HSM you run.
Full Explanation
Provider-managed encryption at rest protects against stolen media and some infrastructure attacks, but the provider controls both the data and the keys, so anyone with sufficient provider privilege, or a legal order served on the provider, can obtain cleartext. When the threat model includes provider insiders and compelled disclosure, the control has to separate key custody from data custody. Keeping keys in a customer-managed HSM outside the provider, sometimes described as hold your own key, means the provider stores only ciphertext and cannot decrypt it without the customer releasing key material or performing operations. Customer-managed keys held inside the provider's own key management service improve control and auditability but still leave key material within the provider's environment. Extending provider default encryption to more tiers broadens coverage but leaves key custody unchanged. Rotating provider-managed keys more often limits exposure of any single key but still leaves the provider able to decrypt with current keys. A second provider-managed layer adds cost and complexity while the same party holds both sets of keys. Exam caveat: external key custody adds availability risk, because losing the HSM means losing access to data. Operational check: confirm key material never leaves the customer HSM and that key use is logged by the customer.