ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Rainbow tables exploit the fact that identical passwords always produce the same unsalted hash, allowing attackers to pre-compute large tables of hash-to-password mappings. Adding a unique, cryptographically strong random salt to every password before hashing forces an attacker to generate separate tables for each possible salt value, making the attack computationally impractical. Simply switching to an encryption algorithm or encrypting the database at rest does not prevent rainbow table use against the stored hashes, and performing additional unsalted hash iterations slows guessing but still leaves the hashes vulnerable to pre-computed tables. Therefore, salting each password before hashing is the most effective and minimally disruptive measure.