You work as a cloud security specialist at SkyNet Solutions. One of your clients is a healthcare organization that plans to migrate its electronic health record (EHR) system to the cloud. This system

Relying solely on network-level encryption protects data in transit but does not address data at rest, nor does it inherently prevent a CSP with infrastructure access from potentially decrypting traffic or stored data if they manage the encryption keys or infrastructure components.

Allowing the CSP to manage encryption keys directly contradicts the core requirement that the CSP should not be able to decrypt the data, as key access inherently grants decryption capability.

While CSPs offer built-in data encryption services, these often involve the CSP managing or having access to the encryption keys, which would allow them to decrypt the data and thus fail to meet the strict requirement for CSP non-decryption.

Client-side encryption ensures data is encrypted before it leaves the client's control and is transmitted or stored with the CSP. Managing encryption keys independently means the CSP never possesses the decryption keys, thereby preventing them from accessing the plaintext data and meeting the stringent confidentiality requirement.