GICSP: Global Industrial Cyber Security Professional Certification

Corporate/Business and control-system networks should use separate Active Directory domains so that their authentication and trust boundaries are not shared. This helps prevent compromise of a corporate identity service from extending into the control environment. CISA advises never sharing Active Directory or other trust stores between corporate and control networks.

The --tables switch enumerates table names, and -D dojo_control scopes that enumeration to the dojo_control database. The enumeration result contains three tables.

A buffer overflow occurs when input exceeds a program’s allocated memory buffer, potentially overwriting adjacent memory or control data. An attacker can use the overflow to execute a supplied command or bypass normal authentication, resulting in administrative access without valid credentials.

A business network and a control-server network require separate security boundaries, so they should use separate Active Directory domains with no trust relationship. Domains in the same Active Directory forest are automatically connected by two-way transitive trusts; that would allow cross-domain authentication rather than preserving isolation.

Static cryptographic keys are commonly stored in persistent device memory so the device can authenticate or encrypt communications after reboot. A data-at-rest acquisition can therefore expose those keys.