A cloud provider is evaluating an insider threat. A resource from the company operations team has access to the servers' virtual disks. This poses a risk that someone could copy and move the virtual…

Tokenization removes actual sensitive values from the virtual disk entirely and stores them in an isolated token vault that the operations team member does not have access to. Even if the virtual disk image is copied and moved, the attacker obtains only meaningless tokens, completely neutralizing the data exposure risk without relying on key management that the insider might also access.

Encryption protects data from unauthorized external access, but an insider who has legitimate access to the virtual disk or the associated decryption keys can still decrypt the data after copying it.

A virtual firewall controls east-west network traffic between virtual machines and does not protect data stored at rest within a virtual disk image from being copied.

Hashing is a one-way integrity verification function and does not protect the confidentiality of data stored on virtual disks; original data cannot be recovered from a hash, but hashing does not prevent the original data from being read.