Defense in depth layers imperfect, independent protections so an attacker must defeat several barriers rather than one. A password database, for example, can hash passwords, add per-user salts, and use deliberately slow password hashing. Each measure addresses a different failure mode, but none makes compromise impossible. section 2.6
Common defensive layers include:
- Hash passwords instead of retaining plaintext, then add salts to prevent shared precomputation and use slow password-hashing functions to raise brute-force costs. section 2.6
- Combine certificate revocation with OCSP, OCSP stapling, and Certificate Transparency so compromised or mis-issued certificates can be detected or invalidated. section 9.3
- Separate cryptographic keys onto dedicated hardware and add further protections when attackers may physically access devices. section 13.2
A compromised certificate
Certificate revocation may appear useless until a certificate is compromised. It then provides a fallback layer, while Certificate Transparency helps expose certificates that were issued improperly. These defenses still depend on monitoring and rapid response. section 9.3
Figure 9.9 Certificate revocation on the web has had three popular solutions: Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and OCSP stapling.
Compare CRLs, OCSP, and OCSP stapling as successive approaches to certificate revocation. section 9.3
