Detections
Analytics

2.7 Host must have time synchronization services enabled and running

Information

Ensure the host has time synchronization services enabled and operational as many functions such as cryptography, audit logging, cluster operations, and incident response/forensics depend on synchronized time. Services like NTP or PTP should be configured to start with the host and remain running to maintain time synchronization.

Having accurate time synchronization is crucial for the correct operation and auditing of the system. This will assist in incident response, forensics, and ensure that cryptographic functions operate correctly.

Solution

- Configure approved NTP servers
 - Enable the NTP client firewall ruleset if required
 - Set the NTP service startup policy to start and stop with the host, and start the service.

Example: esxcli system ntp set --enabled true after configuring approved servers. Verify synchronization after remediation.

Impact:

Failure to maintain time synchronization can lead to inaccurate logging, which could complicate incident response and forensic analysis. It may also affect the functioning of cluster operations and cryptographic protocols.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-7, 800-53|AU-8, CSCv7|6.1

Plugin: Unix

Control ID: 9313d221a22b422c277e8b93264bf65f26f58e97b442c1fd199b6ab7c27af13c