update

Author: msmbaldwin

articles/security/fundamentals/secrets-best-practices.md

@@ -39,16 +39,14 @@ See:
 
 ### Use secure key stores
 
-Leveraging secure key stores ensures that your secrets are stored in a secure, encrypted location. Services like [Azure Key Vault](/azure/key-vault) provide robust security features, including access control, logging, and automatic rotation. This approach centralizes the management of your secrets and reduces the risk of unauthorized access.
+Leveraging secure key stores ensures that your secrets are stored in a secure, encrypted location. Services like [Azure Key Vault](/azure/key-vault) and [Azure Managed HSM](/azure/key-vault/managed-hsm) provide robust security features, including access control, logging, and automatic rotation. This approach centralizes the management of your secrets and reduces the risk of unauthorized access.
 
 For even greater security, particularly for highly sensitive or critical secrets, consider encrypting the secret with a key stores in a Hardward Security Model (HSM), which offer enhanced protection compared to software-based secret stores. For an overview of all the key management offering in Azure and guidance on which to choose, see [How to choose the right key management solution](key-management-choose.md).
 
 See:
 
 - [Key management in Azure](key-management.md)
 - [How to choose the right key management solution](key-management-choose.md)
-- [Azure Key Vault](/azure/key-vault/general/overview)
-- [Azure Managed HSM](/azure/key-vault/managed-hsm/overview)
 
 ### Implement secret scanning tools
 
@@ -104,10 +102,13 @@ See:
 
 ### Encrypt secrets at rest and in transit
 
-Ensure that your secrets are encrypted both at rest and in transit. Azure Key Vault automatically encrypts secrets at rest using industry-standard encryption algorithms. Additionally, use secure communication protocols like HTTPS to encrypt data in transit between your applications and the key vault. This approach ensures that your secrets remain protected from unauthorized access during storage and transmission.
+Ensure that your secrets are encrypted both at rest and in transit. Azure Key Vault securely stores secrets using envelope encryption, where Data Encryption Keys (DEKs) are encrypted by Key Encryption Keys (KEKs), providing an additional layer of security. This approach enhances protection against unauthorized access. Additionally, use secure communication protocols like HTTPS to encrypt data in transit between your applications and the key vault, ensuring that your secrets are safeguarded during both storage and transmission.
+
+In Azure, encryption at rest is implemented across various services using AES 256 encryption, while data in transit is secured through TLS and MACsec to prevent unauthorized access during transmission. These encryption practices provide comprehensive protection for your data, whether it’s being stored or transmitted between systems. For more details, see [Encryption at rest and in transit](encryption-atrest.md).
 
 See:
 
+- [Azure Key Vault](/azure/key-vault/general/overview)
 - [Encryption at rest and in transit](encryption-atrest.md)
 
 ### Safe Distribution of Secrets