The IDPS must be configured to use a minimum of two Network Time Protocol (NTP) servers to synchronize time.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000097-IDPS-000097	SRG-NET-000097-IDPS-000097	SRG-NET-000097-IDPS-000097_rule		Low

Description
The various components within the network infrastructure providing the log records must have their clocks synchronized using a common time reference so the events can be correlated in exact order of time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If sensor logs cannot be correlated with the routers, switches, and firewalls, it may not be possible to trace all the damage caused by a network breach. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.

Description

The various components within the network infrastructure providing the log records must have their clocks synchronized using a common time reference so the events can be correlated in exact order of time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If sensor logs cannot be correlated with the routers, switches, and firewalls, it may not be possible to trace all the damage caused by a network breach. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43227_chk )
Verify two NTP servers have been defined. If the system is not configured to use a minimum of two NTP servers to synchronize time, this is a finding.

Fix Text (F-43227_fix)
Specify two NTP server IP addresses on the device to be used to request time from.