App Security

Question 1

Azure Key Vault

Answer 1

Helps you safeguard cryptographic keys, secrets, and certificates used by cloud applications and services. It offers a secure and centralized location to store and manage sensitive information such as passwords, connection strings, encryption keys, and certificates, helping you protect your data and comply with regulatory requirements.

-Built for progamatic access

Data Types

-Secrets: Sensitive data that needs to be protected, such as passwords, API keys, or connection strings

-Keys: Cryptographic keys that can be used for encryption, decryption, signing and verification

-Certificates: Digital certificates that can be used for authentication and encryption purposes

Architecture

1. Key Vault: Vault or Managed HSM for storing secret data (FIPS compliant)
2. Data: KV data (keys, secrets, certificates) are access via REST
3. Access Control: Grant Azure AD identities access using RBAC or an Access Policy

Implementation

-An Azure AD Identity is required to access the Key Vault (data/management)
-Managed Identities are recommended for apps (vs app registration + secret)
-Protect data with Soft Delete (recycle bin) and Purge Protection (time-based lock)

Question 2

Entra Permissions and Consent