☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Azure Key Vault Overview:
  • Key Concepts of Azure Key Vault
  • Use Cases
  • Best Practices
  1. Azure Logging References
  2. Logging

Azure Key Vault

Azure Key Vault Overview:

Azure Key Vault is a cloud service provided by Microsoft Azure that allows you to securely store and manage sensitive information such as cryptographic keys, secrets, and certificates. It provides a centralized, cloud-based solution for managing the encryption keys and secrets that control access to your applications and resources.

Key Concepts of Azure Key Vault

  1. Vaults:

    • Key Vault: A Key Vault is a secure container in which you can store and manage cryptographic keys, secrets, and certificates. Each vault provides a unique namespace and is associated with a specific Azure region.

  2. Keys:

    • Cryptographic Keys: Azure Key Vault allows you to create, import, and manage cryptographic keys. These keys can be used for a variety of purposes, such as encrypting data, signing data, or controlling access to resources.

    • Key Types:

      • RSA Keys: Used for asymmetric encryption, digital signatures, and more.

      • HSM-backed Keys: These are stored in hardware security modules (HSMs) for added security.

    • Key Operations: You can perform cryptographic operations such as encryption, decryption, signing, and key wrapping directly within the Key Vault, ensuring that keys never leave the secure environment.

  3. Secrets:

    • Secrets: Secrets are values such as passwords, connection strings, API keys, or any other sensitive information that needs to be securely stored and accessed. Azure Key Vault securely stores these secrets and provides controlled access to them.

    • Versioning: Each secret in Azure Key Vault can have multiple versions, allowing you to roll back to a previous version if needed.

  4. Certificates:

    • Certificates: Azure Key Vault can also manage SSL/TLS certificates, providing features like certificate creation, renewal, and policy management. Certificates stored in Key Vault can be used to secure communication between applications or to authenticate users.

  5. Access Policies:

    • Access Control: Access to keys, secrets, and certificates in Azure Key Vault is controlled through Access Policies. These policies define which users, groups, or applications have permission to perform specific operations on the contents of the vault.

    • Role-Based Access Control (RBAC): You can also use Azure Active Directory (Azure AD) Role-Based Access Control (RBAC) to manage access to Key Vaults at a more granular level.

  6. Security:

    • Encryption: Data stored in Azure Key Vault is encrypted at rest using Microsoft-managed keys. For additional control, you can use customer-managed keys.

    • Integration with HSM: For high-security needs, you can use Azure Key Vault Managed HSM, which ensures that keys are generated and stored in FIPS 140-2 Level 3 validated HSMs.

    • Logging and Monitoring: Azure Key Vault integrates with Azure Monitor to provide logging and monitoring of all key vault operations. You can track who accessed your vault, what actions they performed, and when.

  7. Key Rotation:

    • Automatic Key Rotation: Azure Key Vault can automatically rotate keys and secrets based on policies you define. This helps ensure that cryptographic materials are regularly updated, reducing the risk of compromise.

    • Certificate Renewal: You can configure certificates to be automatically renewed before they expire, ensuring continuous security for your applications.

  8. Integration with Azure Services:

    • Azure Virtual Machines: Key Vault can store disk encryption keys for Azure Virtual Machines.

    • Azure App Service: Secrets stored in Key Vault can be accessed by applications running on Azure App Service without exposing the secrets in the application code.

    • Azure Functions: Serverless applications can securely access secrets and keys stored in Key Vault.

  9. Developer and DevOps Integration:

    • SDKs and APIs: Azure Key Vault provides SDKs and REST APIs that allow developers to programmatically manage and access keys, secrets, and certificates. This is useful for automating security in development pipelines.

    • Azure DevOps: Key Vault can be integrated with Azure DevOps to securely manage secrets and keys used in CI/CD pipelines.

  10. Disaster Recovery:

    • Geo-Replication: For high availability, Azure Key Vault supports geo-replication, allowing your vaults to be replicated to a secondary region. This ensures that your keys, secrets, and certificates are available even in the event of a regional outage.

Use Cases

  1. Data Protection: Use Key Vault to manage encryption keys for data protection, ensuring that sensitive data is encrypted both at rest and in transit.

  2. Secret Management: Securely store and access sensitive configuration information such as API keys, passwords, and connection strings.

  3. Certificate Management: Manage SSL/TLS certificates for your applications, automating the renewal process to prevent downtime.

  4. Compliance and Audit: Use Key Vault to meet compliance requirements for managing cryptographic keys and secrets, with full audit trails for all operations.

Best Practices

  • Use RBAC: Leverage Azure AD Role-Based Access Control to enforce the principle of least privilege, ensuring that only authorized users and applications have access to your keys, secrets, and certificates.

  • Enable Logging: Turn on logging and monitoring to track access and changes to your Key Vault, and set up alerts for suspicious activities.

  • Regularly Rotate Keys: Implement key rotation policies to minimize the risk of key compromise. Use automatic rotation features where possible.

  • Use Managed HSM for High Security: For highly sensitive data, consider using Azure Key Vault Managed HSM to ensure that your cryptographic keys are stored in FIPS 140-2 Level 3 validated hardware security modules.

Last updated 9 months ago