The NTP server is not compliant with the OS STIG

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17848	NET0815	SV-19123r1_rule	DCCS-1 DCCS-2	Low

Description
NTP provides an efficient and scalable method for managed network elements to actively synchronize to an accurate time source. Insuring that there are always NTP servers available to provide time is critical. It is imperative that all single points of failure for the NTP infrastructure are eliminated. Knowing the correct time is not only crucial for proper network functioning but also for security. Compromising an NTP server opens the door to more sophisticated attacks that include NTP poisoning, replay attacks, and denial of service. To provide security through separation and isolation, the NTP server should only be connected to the management network. This enables the NTP server to provide time to the managed devices using a secured as well as a preferred path. If the NTP server is not an appliance, it is critical that the system is secured by maintaining compliance with the appropriate OS STIG as well as implementing an HIDS.

Description

NTP provides an efficient and scalable method for managed network elements to actively synchronize to an accurate time source. Insuring that there are always NTP servers available to provide time is critical. It is imperative that all single points of failure for the NTP infrastructure are eliminated. Knowing the correct time is not only crucial for proper network functioning but also for security. Compromising an NTP server opens the door to more sophisticated attacks that include NTP poisoning, replay attacks, and denial of service. To provide security through separation and isolation, the NTP server should only be connected to the management network. This enables the NTP server to provide time to the managed devices using a secured as well as a preferred path. If the NTP server is not an appliance, it is critical that the system is secured by maintaining compliance with the appropriate OS STIG as well as implementing an HIDS.

STIG	Date
Network Devices Security Technical Implementation Guide	2013-10-08

Details

Check Text ( C-19349r1_chk )
Interview the IAO and administrator to determine if the server is compliant with respective OS STIG.

Fix Text (F-17785r1_fix)
If the NTP server is not an appliance, configure the platform hosting the NTP server in accordance with the appropriate OS STIG.