Title

The application server must synchronize internal application server clocks to an authoritative time source when the time difference is greater than the organization-defined time period. (Cat II impact)

Discussion

Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronization of internal application server clocks is needed in order to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization will define an authoritative time source and have each system synchronize when the time difference is greater than a defined time period. The industry standard for the threshold is 1ms.

Check Content

Review application server documentation and configuration to determine if the application server is configured to reset internal information clocks when the difference is greater than a defined threshold with an authoritative time source. If the application server cannot synchronize internal application server clocks to the authoritative time source when the time difference is greater than the organization-defined time period, this is a finding.

Fix Text

Configure the application server to reset internal information system clocks when the time difference is greater than a defined time period with the authoritative time source.

Additional Identifiers

Rule ID: SV-204793r879745_rule

Vulnerability ID: V-204793

Group Title: SRG-APP-000372

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.