Q:

Azure Key Vault safety when hacking

I want to increase my safety of my web app in case of an attack.
The following components are present in my system:

Azure Web App
Azure Blob Storage
Azure SQL Azure
Azure KeyVault

Now there is the scenario that the app encrypts and stores uploaded documents.
This works as described:
1) User Uploads doc to the web app
2) random encryption key is generated
3) random encryption key is stored to the azure key vault
4) sql azure stores the blob url and the key url
Now my question is:
How is using the key vault safer in case of hacking the web app instance? I mean there is the client id and client secret in the app.config to access the keyvault, we need it to read and write keys. So if i use key vault or not does not increase safety in terms of hacking the web app, right?

A:

The Key Vault is an API wrapped around an HSM.  What makes the Key Vault or HSM Secure is that the keys can not be extracted from them once imported / created.  Also, the crypto (encrypt / decrypt in your case) operations happen inside the vault so the keys are never exposed, even in memory.  
If someone was able to hack your web application and get the credentials to your key vault they could use the vault to decrypt the data.  So, in this case you could regenerate the credentials for the Key Vault and still continue to use the same keys that are in the vault - because they were never exposed.  Meaning any data that is encrypted that the attacker didn't already decrypt is still safe because the keys were never exposed.  
Typically HSMs aren't designed to store a large number of keys in only a few really important keys.  You might want to consider using a key wrapping solution where you have one key in the vault. 
You probably want to encrypt the client id and client secret in your config and decrypt them at runtime - this adds another layer of security.  Now the attacker either needs to read the keys out of your application memory while it is running on your Cloud Service / VM (not an easy task).  Or the attacker would need to obtain the config file and the private key of the certificate used to encrypt your config values (easier than reading memory, but still requires a lot of access to your system).

