The concepts here are diffusion and confusion, the goal of diffusion is to spread the influence of one bit over all bits. The job of confusion is to obscure the relationship between input and output.
S-boxes confuse (transform series of bits into different bits), P-boxes diffuse (shuffle bits around).
S-boxes need to have certain properties to be secure, they need to be non-linear to a degree where they can't even be linearly approximated. Given any two possible inputs into the box the difference in input must not correlate with difference in output.
Consider some input going into some number of S-boxes, it has changed drastically. But now consider that input being mixed (XOR) with the key before going to the box, it now changed in a very different way. If all you do is shuffle your entire function is linear and you can just build a matrix to represent it, then it's broken trivially.
In practice you apply shuffling and S-boxes multiple times (rounds) with multiple keys (derived from a master key).