best-practices
Best Practices
Best practices for implementing and managing DuoKey for Office 365 Customer Key to ensure security, reliability, and compliance.
Security Best Practices
Key Management Security
1. Implement Least Privilege Access
- Grant only minimum required permissions
- Use separate service principals for different operations
- Regularly audit access permissions
- Implement just-in-time (JIT) access for administrative tasks
2. Enable Multi-Factor Authentication (MFA)
Require MFA for all accounts with Key Vault access:
- Azure administrators
- Key Vault contributors
- Security operations team
- Compliance auditors
3. Secure Key Backups
Backup Storage
Store backups in encrypted format, use separate encryption keys, maintain in multiple geographic locations, and store offline backups in secure physical locations.
Access Control
Limit backup access to authorized personnel, implement multi-person authorization, log all backup and restoration operations, and regularly test restoration procedures.
Monitoring and Alerting
Enable all diagnostic categories for Azure Key Vault including AuditEvent, AllMetrics, and AllLogs. Configure critical alerts for key access failures and unusual access patterns.
Operational Best Practices
Key Rotation
Establish Rotation Schedule
| Environment | Frequency | Trigger |
|---|---|---|
| Production keys | Annually | Scheduled rotation policy |
| High-security environments | Quarterly | Enhanced security requirements |
| After security incidents | Immediately | Incident response |
| Upon personnel changes | Within 30 days | Employee offboarding |
Rotation Procedure Checklist
Prerequisites
- Notify stakeholders of planned rotation
- Generate new keys using DuoKey MPC
- Test new keys in non-production environment
- Schedule rotation during low-usage period
- Create DEP with new keys
- Monitor re-encryption progress
- Verify encryption completed successfully
- Archive old keys (do not delete)
- Update documentation
- Conduct post-rotation review
Change Management
Maintain a change log for DEP creations and modifications, key rotations, access policy changes, configuration updates, and incident responses.
Require approval for new DEP creation, key rotation, access policy modifications, and Key Vault configuration changes.
Compliance Best Practices
Audit and Reporting
| Frequency | Activities |
|---|---|
| Daily | Review key access logs, check for failed operations, monitor encryption status |
| Weekly | Generate key usage reports, review access patterns, validate backup integrity |
| Monthly | Comprehensive compliance report, review and update policies, conduct access review |
| Quarterly | Internal audit of procedures, test disaster recovery, update documentation |
Data Sovereignty
- Store keys in regions that match data residency requirements
- Use multi-geo Office 365 with region-specific DEPs
- Document key storage locations for compliance
High Availability and Disaster Recovery
High Availability Design
Redundant Vaults
Maintain two Key Vaults in different Azure regions.
Synchronization
Synchronize keys across vaults.
Automatic Failover
Configure automatic failover where possible.
Disaster Recovery
| Metric | Target | Test Frequency |
|---|---|---|
| RTO (Recovery Time Objective) | 4 hours | Quarterly |
| RPO (Recovery Point Objective) | 1 hour | Quarterly |
DR Testing Checklist
Prerequisites
- Test key restoration from backup
- Verify failover to secondary Key Vault
- Practice DEP recreation
- Test emergency access procedures
- Validate monitoring and alerting
- Document lessons learned
- Update DR procedures
Performance Optimization
Assign DEPs during off-peak hours. Schedule bulk assignments for evenings or weekends and avoid peak business hours. Monitor system performance during assignments.
Latest API Versions
Use latest API versions for improved performance and features.
Retry Logic
Implement retry logic with exponential backoff for resilience.
Caching
Cache key metadata when possible to reduce API calls.
Load Distribution
Distribute load across Key Vaults for optimal throughput.
DuoKey MPC Best Practices
MPC Configuration
| Environment | Threshold | Percentage |
|---|---|---|
| Production | 3-of-5 | 60% |
| High Security | 4-of-7 | 57% |
| Standard | 2-of-3 | 67% |
Distribute MPC nodes across different cloud regions, data centers, physical locations, and administrative domains.
Node Maintenance
Regularly update MPC node software, monitor node health and availability, test node failover procedures, and maintain spare nodes.
Key Share Management
Store shares in separate secure locations, implement multi-person control, regularly verify share integrity, and test reconstruction procedures.
Cost Optimization
Licensing Considerations
| Component | Requirement |
|---|---|
| Office 365 | E5 required for Customer Key |
| Azure | Subscription costs for Key Vaults |
| DuoKey | Licensing based on usage |
| Growth | Plan for growth in user count |
- Remove unused keys after retention period
- Consolidate Key Vaults where appropriate
- Use appropriate SKU (Premium for HSM-backed keys)
- Monitor transaction rates to avoid unnecessary operations
Training and Awareness
Staff Training
Prerequisites
- Customer Key concepts
- Key management procedures
- Security best practices
- Incident response
- Compliance requirements
- Tool usage (PowerShell, Azure Portal, DuoKey)
Training Schedule
| Training Type | Frequency |
|---|---|
| Initial training | Before implementation |
| Refresher training | Quarterly |
| Emergency procedures | Semi-annually |
| New features | As released |
| Compliance updates | As needed |
Compliance Frameworks
- Maintain data processing records
- Implement data protection by design
- Enable data portability
- Support right to erasure
- Document cross-border transfers