The threat model for a cloud application that handles trade secrets includes a malicious administrator employed by the cloud service provider. Which mitigation most directly reduces this risk?

CSP insider threats involve provider personnel abusing privileged access to infrastructure that hosts customer workloads. The most direct technical mitigation is to make that access useless without the customer's cooperation: encrypt sensitive data with keys the customer controls, through bring your own key arrangements in a key management service or hold your own key designs where keys stay in customer-operated hardware, and monitor key usage and data access so unexpected decryption is detected. Separation between data and keys means an administrator who can reach storage or snapshots sees only ciphertext. A SOC 2 Type II report provides assurance that the provider's controls, including personnel screening, operated effectively over a period; it informs provider selection and residual risk, but it does not prevent a determined insider from acting. Security group rules filter traffic in the customer's virtual network; they do not constrain administrators who operate the underlying hypervisors, storage and management systems below that layer. Multi-factor authentication protects the customer's own console accounts, a different threat actor. Exam caveat: with BYOK the provider's key service still performs cryptographic operations, so HYOK or confidential computing gives stronger separation for the most sensitive data at the cost of complexity. Operational check: confirm where keys reside, who can use them, and that key usage logs alert on access outside approved workloads.