Blast Radius & Certificate Constraints

Experienced security practitioners know that key management is fraught with risk. And systems that build on secure key management, like internal TLS deployments, inherit these risks of key compromise and exploitation. By designing systems with “blast radius” in mind, it is possible to contain these risks. Fortunately, internal certificate authorities have some unique but little-known properties available for shaping the “blast radius” to reduce operational risk.

Leave a Comment