The application server must synchronize internal application server clocks to an authoritative time source when the time difference is greater than the organization-defined time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57437	SRG-APP-000372-AS-000212	SV-71709r2_rule		Medium

Description
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronization of internal application server clocks is needed in order to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization will define an authoritative time source and have each system synchronize when the time difference is greater than a defined time period. The industry standard for the threshold is 1ms.

Description

Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronization of internal application server clocks is needed in order to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization will define an authoritative time source and have each system synchronize when the time difference is greater than a defined time period. The industry standard for the threshold is 1ms.

STIG	Date
Application Server Security Requirements Guide	2019-01-07

Details

Check Text ( C-58113r1_chk )
Review application server documentation and configuration to determine if the application server is configured to reset internal information clocks when the difference is greater than a defined threshold with an authoritative time source. If the application server cannot synchronize internal application server clocks to the authoritative time source when the time difference is greater than the organization-defined time period, this is a finding.

Check Text ( C-58113r1_chk )

Review application server documentation and configuration to determine if the application server is configured to reset internal information clocks when the difference is greater than a defined threshold with an authoritative time source.

If the application server cannot synchronize internal application server clocks to the authoritative time source when the time difference is greater than the organization-defined time period, this is a finding.

Fix Text (F-62475r1_fix)
Configure the application server to reset internal information system clocks when the time difference is greater than a defined time period with the authoritative time source.