Title

The application server must compare internal application server clocks at least every 24 hours with an authoritative time source. (Cat II impact)

Discussion

Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronization of system clocks is needed in order to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization will define an authoritative time source and have each system compare its internal clock at least every 24 hours.

Check Content

Review application server documentation and confirm that the application server compares internal application server clocks at least every 24 hours with an authoritative time source. If the application server does not compare internal application server clocks to an authoritative source or if the frequency is greater than every 24 hours, this is a finding.

Fix Text

Configure the application server to compare internal application server clocks at least every 24 hours with an authoritative time source.

Additional Identifiers

Rule ID: SV-204792r879744_rule

Vulnerability ID: V-204792

Group Title: SRG-APP-000371

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.