Microsoft Adds Hardware Audit Logging to Azure Cloud HSM for Verifiable Security Records

At a glance

Microsoft has released Hardware Audit Logging for Azure Cloud HSM. An HSM (a dedicated security device that stores encryption keys) creates its own records, which can be collected to show who did what and when. Strictly regulated companies can use it for security reviews and compliance reporting.

Key points

1. 1

   The records are created by the HSM device itself, so they are closer to real security-device evidence than ordinary server or app logs.

2. 2

   Administrative actions such as sign-ins, user management, policy changes, key management, and backup and recovery are recorded.

3. 3

   Customers receive human-readable records, the device-signed original data, and certificates, so they can verify on their own that the records have not been tampered with.

4. 4

   The logging feature is turned on by an unchangeable policy, which reduces the risk of logs being turned off during administrative work.

Why it matters

Companies that handle important encryption keys need trustworthy evidence for incident investigations and audits. This feature lets them obtain that evidence from the security device itself.