Two independent sources of time reference are not being utilized.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17850	NET0817	SV-19125r1_rule	ECSC-1	Low

Description
NTP provides an efficient and scalable method for managed network elements to actively synchronize to an accurate time source. Insuring that there are always NTP servers available to provide time is critical. It is imperative that all single points of failure for the NTP infrastructure are eliminated. Knowing the correct time is not only crucial for proper network functioning but also for security. Compromising an NTP server opens the door to more sophisticated attacks that include NTP poisoning, replay attacks, and denial of service. Hence, it is imperative that at least two independent sources of time reference are used.

Description

NTP provides an efficient and scalable method for managed network elements to actively synchronize to an accurate time source. Insuring that there are always NTP servers available to provide time is critical. It is imperative that all single points of failure for the NTP infrastructure are eliminated. Knowing the correct time is not only crucial for proper network functioning but also for security. Compromising an NTP server opens the door to more sophisticated attacks that include NTP poisoning, replay attacks, and denial of service. Hence, it is imperative that at least two independent sources of time reference are used.

STIG	Date
Network Devices Security Technical Implementation Guide	2017-12-07

Details

Check Text ( C-19351r1_chk )
Review both NTP server configurations to determine that they are referencing two different reference clocks and that the NTP servers are peering with each other. An alternative configuration for management networks that have a gateway would be to implement two stratum-2 servers peering with each other and each referencing a different trusted external stratum 1 server. This is a less expensive solution that still provides redundancy, but not quite the same accuracy.

Check Text ( C-19351r1_chk )

Review both NTP server configurations to determine that they are referencing two different reference clocks and that the NTP servers are peering with each other.

An alternative configuration for management networks that have a gateway would be to implement two stratum-2 servers peering with each other and each referencing a different trusted external stratum 1 server. This is a less expensive solution that still provides redundancy, but not quite the same accuracy.

Fix Text (F-17787r1_fix)
Use at least two independent sources of time reference. The best practice is to deploy two stratum 1 servers, each connected to a different reference clock (GPS, NIST WWVB) and both peering with each other for redundancy.