How is a keyvault more secure than standard storage?

Question

I am trying to understand the security benefits that Azure Key Vault would offer (or equally AWS KMS)

I understand the benefits of key management, of being able to easily rotate, change, audit key access.

What perplexes me a little though is how it is more secure.

As I understand it, if I develop a web application and want to protect my connection string (for instance) I can create a key pair in Key Vault and save it there. I then create an application in AAD, and use the client ID/Secret/URI to authenticate to Key Vault to obtain my connection string. There is also the possible benefit of restricting that further by Resource Group.

However this now means I have a client ID/Secret/URI to protect.

How is this better?

P.S. I'm not a developer! I just like to poke around in these things to understand them from a devops point of view. So if you could aim your answer at the typical clueless ops guy, that would be appreciated ;)

Answer 1

Azure Key Vault uses Hardware Security Modules (HSMs) by Thales. Special about HSMs is that they do not give you keys. You create or import a key into an HSM. Later on you give data to the HSM and the HSM is executing cryptographic operations on that data. E.g. encrypting, decrypting, hashing ect. By the way, those hardware devices are really expensive. With Azure Key Vault you are able to use this protection for a small price. That's one benefit using Azure Key Vault.

To your question why this is more secure: Keys are more worth than a single VM that has been compromised. If one of your VMs have been compromised and you would have your encryption keys on that VM, the attacker would have your keys.

If you have only your client ID and secret on your VM, then the attacker has only those credentials but not your keys. And as you know even with those credentials the attacker is not able to get your keys from the HSM. That means the attacker would be able to execute cryptographic operations for a certain amount of time with your credentials. The moment you recognize the attack you invalidate the credentials.

So the difference in a nutshell:

Without HSM: the attacker has your keys and can use those keys as long as they want (and they are valid).

With HSM: the attacker does not have your keys and is only able to execute cryptographic operations with your credentials as long they are valid.