Packt+ | Advance your knowledge in tech

You're reading from Mastering Identity and Access Management with Microsoft Azure - Second Edition

Product typeBook

Published inFeb 2019

PublisherPackt

ISBN-139781789132304

Edition2nd Edition

Tools

Azure

Concepts

Identity Management

Author (1)

Jochen Nickel

Chapter 14. Understanding Encryption Key Management Strategies

In this chapter, you'll learn to use the three different key deployment models to address different compliance requirements and understand what role the Azure Key Vault service plays in this. We'll discuss the three Azure Rights Management Services flows for a better understanding of how keys are used in the complete Azure Information Protection (AIP) solution to address the correct implementation and to help you troubleshooting the solution. This chapter will be divided into the following sections:

Azure Information Protection key basics:
- Key deployment models
- What is a hardware security module (HSM)?
- What is the Azure Key Vault?
How Azure RMS works under the hood:
- Algorithms and key lengths
- User environment-initialization flow
- Content protection flow
- Content consumption flow

Let's start with the AIP key basics!

Azure Information Protection key basics

The Azure Rights Management Service (RMS) is part of the AIP solution of Microsoft. The Rights Management web service provides protection functionality, including administration, account certification, and licensing. Certification refers to the account certification and activation activities performed by Azure RMS. Each user must acquire a set of certificates and associated keys to be able to participate. Licensing refers to the set of operations by which Azure RMS grants access to protected content to authorized users. The Azure RMS service grants a use license (usage rights) for each document to authorized users.

Note

The Azure RMS service exposes Simple Object Access Protocol (SOAP) interfaces that are used by clients to interact with Azure RMS

The Azure Rights Management web service also uses rights management templates, which specify a predefined set of rights and conditions that can be applied to protect content. In AIP, the rights-management templates...

How Azure RMS works under the hood

It's quite important to how RMS works it delivers the data protection service of the complete Azure Information Protection solution. First of all, the protected data will never be transferred to the Azure Information Protection or Rights Management service itself. Basically, the data is encrypted at the application level and includes a policy that defines who is authorized and which usage rights are applied for these users. Keep in mind that group memberships are cached for three hours. So, if you change permissions, remember this to avoid misinterpreted results. To get a better understanding of the three typical flows, let's explore the flows in this section. But first, we'll look at the algorithms and key lengths used by Azure RMS.

Algorithms and key lengths

Azure RMS uses the following cryptographic controls in the different usage scenarios. The following table gives you the needed information if you get asked in a project or workshop:

Summary

In this chapter, you received all the necessary information to map your requirements to the correct key-deployment model. We looked at the pros and cons of using HYOK. With the provided configuration examples, we gathered practical experience, which you can now share or use in your next project or workshop. We learned about the main Azure RMS flows, which are helpful in understanding how Azure RMS works under the hood. You can use this knowledge to support deployments or troubleshoot common issues because many errors happen on the environment-initialization (bootstrapping) process or in the deployment.

In the next chapter, we'll finish configuring the example Azure Information Protection solution, and then you'll be fully prepared for your journey with this nice technology.

The rest of the chapter is locked

You have been reading a chapter from

Mastering Identity and Access Management with Microsoft Azure - Second Edition

Published in: Feb 2019Publisher: PacktISBN-13: 9781789132304

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at £13.99/month. Cancel anytime

Author (1)

Jochen Nickel

Jochen Nickel is a Cloud, Identity and Access Management Solution Architect with a clear focus and in-depth technical knowledge of Identity and Access Management. He is currently working for inovit GmbH in Switzerland leading and executing projects in the field of Identity and Access Management including Data Classification and Information protection. Jochen is focused on Microsoft Technologies, especially in the Enterprise Mobility + Security Suite, Office 365 and Azure. He is an established speaker at many technology conferences like Azure Bootcamps, TrustInTech Meetups or the Experts Live Switzerland and Europe.
Read more about Jochen Nickel

Other recommended products

Related to this chapter

Active Directory Administration Cookbook

Active Directory and Azure Active Directory offer centralized administration possibilities to automate network, security and access management in Microsoft-oriented environments. This book will help you in deploying, administering, and automating Active Directory through a recipe-based approach.

BookMay 2019620 pages

Identity with Windows Server 2016: Microsoft 70-742 MCSA Exam Guide

This practical guide covers Identity with Windows Server 2016: 70-742 exam objectives required for MCSA: Windows Server 2016 certification.

BookJan 2019232 pages

Microsoft 365 Security Administration: MS-500 Exam Guide

MS-500: Microsoft 365 Security Administration offers complete, up-to-date coverage of the MS-500 exam so you can take it with confidence, fully equipped to pass the first time.

BookJun 2020672 pages

Microsoft 365 Mobility and Security - Exam Guide MS-101

The MS-101 exam is part of the Microsoft 365 Certified: Enterprise Administrator Expert certification path in which users learn to evaluate, plan, migrate, deploy, and manage Microsoft 365 services. This book offers complete, up-to-date coverage of the MS-101 exam so you can take them with confidence, fully equipped to pass the first time.

BookNov 2019312 pages

Mastering Active Directory

Identity is key for any infrastructure, no matter the size. Active Directory Domain Services provide the ability to manage elements in an infrastructure, such as attributes, resources, and privileges. Using them in an effective manner will help organizations manage their infrastructure in a secure, productive, and efficient way. The vision behind this book is to help professionals gain the knowledge to address modern identity infrastructure challenges in enterprises.

BookAug 2019786 pages

Managing Microsoft Teams: MS-700 Exam Guide

Managing Microsoft Teams: MS-700 Exam Guide offers complete, up-to-date coverage of the exam course content to help you pass with confidence. With this book, you will learn the steps of how to plan for a Microsoft Teams deployment within a business environment and manage Teams administrative functions on a day-to-day basis.

BookFeb 2021452 pages

Implementing Microsoft Azure Infrastructure Solutions: Exam Guide 70-533

This book focuses on skills and knowledge for provisioning and managing services in Microsoft Azure. This includes implementing infrastructure components such as virtual networks, virtual machines, containers, web and mobile apps, storage, planning and managing Azure AD and configuring Azure AD integration with on-premises Active Directory domains.

BookAug 2018516 pages

Architecting Microsoft Azure Solutions - Exam Guide 70-535

This study guide includes all the topics that are still relevant from the previous 70-534 exam, updated with the latest features like Artificial Intelligence, IoT, and architecture styles. This guide will help Azure Architects, Developers or anyone interested in designing and implementing effective Cloud architecture strategies.

BookApr 2018418 pages

Mastering Active Directory

Identity is key for any infrastructure, no matter the size. Active Directory Domain Services enable you to manage infrastructure elements, such as attributes, resources, and privileges, in a secure, productive, and efficient way. This book will help you develop the skills required to address modern identity infrastructure challenges in enterprises.

BookJun 2017742 pages

Microsoft Azure Administrator ‚Äì Exam Guide AZ-103

Microsoft Azure Administrator- Exam Guide AZ-103 is a complete guide that will help you master topics related to Azure administrator practices. Using this guide, you will have all the information required to ace the AZ-103 exam and become a Microsoft Azure administrator expert.

BookMay 2019452 pages

Microsoft 365 Certified Fundamentals MS-900 Exam Guide

Microsoft? ?365? ?Certified? ?Fundamentals certification demonstrates your knowledge of cloud services in general and the SaaS cloud model. This MS-900 exam guide, filled with practice questions, exam patterns, and mock tests, will help help you pass the exam on the first go and get to grips with adopting core Microsoft 365 services and cloud concepts.

BookFeb 2020342 pages

Mastering Azure Security

Mastering Azure Security enables you to implement top-level security in your Azure tenant. With a focus on cloud security, this book will look at the architectural approach on how to design your Azure solutions to keep and enforce resources secure.

BookMay 2020262 pages

Personalised recommendations for you

Based on your interests and search pattern

Et al.

Ever wonder why speech recognition systems don't understand the Scottish accent, or what would happen if an astronaut only ate mac 'n' cheese, or other spurious reflections you'd have at a bar? We did, then collated those deliberations into absurd research articles with fake figures and methodologies inspired by even more fictionally absurd studies.

BookAug 2023230 pages5

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages4

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages5

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages1

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages5

Mastering Tableau 2023

This book is a comprehensive resource to mastering your Tableau skills and becoming a BI expert. As you progress, you will learn how to build advanced dashboards and improve your storytelling to derive key business insight, as well as make you well-versed with advanced functionalities of Tableau in the business intelligence domain.

BookAug 2023684 pages

Building AI Applications with ChatGPT APIs

This guide covers all ChatGPT API features for effortless creation of robust AI powered apps. With its help, you’ll be able to leverage ChatGPT’s cutting-edge NLP models to take your app development skills to the next level. You’ll also work on ten exciting projects that will give you the practical know-how that you can apply to your existing applications.

BookSep 2023258 pages5

Building AI Applications with ChatGPT APIs

This guide covers all ChatGPT API features for effortless creation of robust AI powered apps. With its help, you’ll be able to leverage ChatGPT’s cutting-edge NLP models to take your app development skills to the next level. You’ll also work on ten exciting projects that will give you the practical know-how that you can apply to your existing applications.

BookSep 2023258 pages2

Data Engineering with AWS

Embark on a journey to master data engineering pipelines on AWS! Our book offers a hands-on experience of AWS services for ingesting, transforming, and consuming data. Whether you're an absolute beginner or someone with basic data engineering experience, this guide is an indispensable resource.

BookOct 2023636 pages5

Modern Data Architecture on AWS

Every organization wants an agile, performant, and cost-effective data platform that meets all their current and future business needs. Purpose-built AWS analytics services and their features play a big part in building such a modern data platform. This book brings to you all the design and architectural patterns that’ll help you achieve this goal.

BookAug 2023420 pages5

Practical Guide to Applied Conformal Prediction in Python

Discover the power of Conformal Prediction with the "Practical Guide to Applied Conformal Prediction in Python." Master the latest techniques to quantify uncertainty in machine learning and computer vision models, and seamlessly apply them to your industry applications.

BookDec 2023240 pages

TinyML Cookbook

With over 70 project-based recipes, the TinyML Cookbook is a practical guide that will help you to get the most out of your microcontrollers. It provides a comprehensive understanding of the theoretical foundations while giving you hands-on experience training ML models for deployment on Arduino Nano 33 BLE Sense, Raspberry Pi Pico, and SparkFun RedBoard Artemis Nano microcontrollers.

BookNov 2023664 pages

Cryptographic controls...