Azure Key Vault - From Hardware To The Cloud!

Introduction - from Hardware to the Cloud - keeping it secure!

A hardware security module (HSM) is a physical computing device which safeguards and manages digital keys. They are used when security is important and include features such as auditing, tamper-proofing and encryption. However, as with all hardware devices there is expense and work involved in procuring, installing, upgrading and maintaining an HSM. This is where Azure Key Vault comes in. It provides the security of an HSM, but without the work of setting it up or maintaining it

What’s Azure Key Vault used for?

Whatever is stored in Azure Key Vault is safeguarded using industry-standard algorithms, HSMs and key lengths. The HSMs are Level 2 validated for Federal Information Processing Standard (FIPS). Microsoft provides the interface with which you can access the HSM device securely. For more assurance about the integrity of the key, you can generate it inside the HSM. Microsoft cannot access or extract your keys. Applications also have no direct access to the keys. Instead you’ll have to use Azure CLI, Portal or PowerShell as an interface.
Azure Key Vault can be used for key management as it makes it easy to create and control the encryption keys used to encrypt your keys. It can also be used for certificate management to enable you to easily provision, manage and deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS).
Azure Key Vault supports three types of data, including:

• Secrets. These are values that are 25KB or less. They are written to and read from and can be used to store passwords, access keys or SQL connect strings.
• Keys. These are written to the key vault but cannot be exported. They are used for encryption and hash generation. Even when the key is used it can be configured not to leave the HSM and instead the cipher operations required are sent to the key vault service and the result returned.
• Data. Sensitive pieces of information can also be stored in Azure Key Vault.

When application secrets are centrally stored in Azure Key Vault, it’s easier to control their distribution. There’s no longer any need for application developers to store security information in their application, so they no longer need to make this information part of the code.

How does it work?

No-one (a user or an application) can get access to Azure Key Vault unless they have proper authentication and authorization. The identity of the caller is established through authentication. This is done via the Azure Active Directory. Authorization determines what operations the caller is allowed to carry out. Authorization can be done using role-based access control (RBAC) or Key Vault access policy.