Merge pull request #109794 from timlt/oemupdate

Further PM review

Author: PRMerger14

articles/iot-dps/concepts-device-oem-security-practices.md

@@ -28,14 +28,14 @@ X.509 certificates are a type of digital identity you can use for authentication
 - CA authentication based on a full chain. A certificate chain is a hierarchical list of all certificates needed to authenticate an end-entity (EE) certificate. To authenticate an EE certificate, it's necessary to authenticate each certificate in the chain including a trusted root CA. 
 
 Pros for X.509:
-- X.509 is the most secure key type supported in Azure IoT.
+- X.509 is the most secure authentication type supported in Azure IoT.
 - X.509 allows a high level of control for purposes of certificate management.
 - Many vendors are available to provide X.509 based authentication solutions.
 
 Cons for X.509:
-- Many customers must rely on external vendors for their certificates.
+- Many customers may need to rely on external vendors for their certificates.
 - Certificate management can be costly and adds to total solution cost.
-- Certificate life-cycle management can be difficult due to the logistical complexity.
+- Certificate life-cycle management can be difficult if logistics are not well thought out. 
 
 ### Trusted Platform Module (TPM)
 TPM, also known as [ISO/IEC 11889](https://www.iso.org/standard/66510.html), is a standard for securely generating and storing cryptographic keys. TPM also refers to a virtual or physical I/O device that interacts with modules that implement the standard. A TPM device can exist as discrete hardware, integrated hardware, a firmware-based module, or a software-based module. 
@@ -46,7 +46,7 @@ There are two key differences between TPMs and symmetric keys:
 
 Pros for TPM:
 - TPMs are included as standard hardware on many Windows devices, with built-in support for the operating system. 
-- TPM attestation is more secure than shared access signature (SAS) token-based symmetric key attestation.
+- TPM attestation is easier to secure than shared access signature (SAS) token-based symmetric key attestation.
 - You can easily expire and renew, or roll, device credentials. DPS automatically rolls the IoT Hub credentials whenever a TPM device is due for reprovisioning.
 
 Cons for TPM: 
@@ -56,14 +56,14 @@ Cons for TPM:
 - If you roll the EK on a TPM, it destroys the identity of the TPM and creates a new one. Although the physical chip stays the same, it has a new identity in your IoT solution.
 
 ### Symmetric key
-With symmetric keys, the same key is used to encrypt and decrypt messages. As a result, the same key is known to both the device and the service that authenticates it. Azure IoT supports SAS token-based symmetric key connections. However, symmetric authentication is less secure than the other methods surveyed in this article. If you use symmetric keys, the recommended practice is to protect the keys by using a hardware security module (HSM).
+With symmetric keys, the same key is used to encrypt and decrypt messages. As a result, the same key is known to both the device and the service that authenticates it. Azure IoT supports SAS token-based symmetric key connections. Symmetric key authentication requires significant owner responsibility to secure the keys and achieve an equal level of security with X.509 authentication. If you use symmetric keys, the recommended practice is to protect the keys by using a hardware security module (HSM).
 
 Pros for symmetric key:
 - Using symmetric keys is the simplest, lowest cost way to get started with authentication.
 - Using symmetric keys streamlines your process because there's nothing extra to generate. 
 
 Cons for symmetric key: 
-- Symmetric keys are less secure than X.509 certificates or TPM. The same key is shared between device and cloud, which means the key must be protected in two places. In contrast, the challenge with TPM and X.509 certificates is proving possession of the public key without revealing the private key.
+- Symmetric keys take a significant degree of effort to secure the keys. The same key is shared between device and cloud, which means the key must be protected in two places. In contrast, the challenge with TPM and X.509 certificates is proving possession of the public key without revealing the private key.
 - Symmetric keys make it easy to follow poor security practices. A common tendency with symmetric keys is to hard code the unencrypted keys on devices. While this practice is convenient, it leaves the keys vulnerable. You can mitigate some risk by securely storing the symmetric key on the device. However, if your priority is ultimately security rather than convenience, use X.509 certificates or TPM for authentication. 
 
 ### Shared symmetric key