The Time is Now: The Convergence of Networks, Time Synchronization and Information SecurityBen Rothke, CISSP CISA | BT Professional Services | 27/10/08 | Session NET-105

2

About me

• Senior Security Consultant – BT Professional Services• Certifications: CISSP, CISM, PCI QSA, SITA• IT sector since 1988 / Information security since 1994• Frequent writer and speaker• Author of Computer Security: 20 Things Every

Employee Should Know (McGraw-Hill 2006)

Agenda

3

• Session is:– An overview of the need for time synchronization– Why time synchronization is critical for security software

and hardware to run effectively– An overview of NTP

• Session is not:– A comprehensive overview of setting up a corporate time

synchronization infrastructure– How to configure NTP– Which time synchronization product to purchase

• Feel free at any point today to make a correction, share a story, make a comment, etc.

Defining Time

• It is difficult to provide an uncontroversial and clear definition of the nature of time or even what time is.

• Time can be one of the following:– an instance or single occasion for some event– a period considered as a resource under your control and

sufficient to accomplish something– In physics - time is distance divided by velocity– Kant defines time as a determinate form in which alone the

intuition of inner state is possible and everything which belongs to that inner state is therefore represented in relations of time and space.

– Song on Dark Side of the Moon - Pink Floyd

4

Doing things on time is universal

Nearly every activity requires synchronized time to operate at peak levels:

– Plane departures

– Television

– Sporting events

– Day trading

– Job shifts

– FedEx / DHL / UPS

– Members of an orchestra

– Industrial processes

– Financial markets

– Point of sale

– IP telephony

– Arbitrage

5

– Criminal forensics– Factories– Cooking– Medical– GPS– Traffic signals– SWAT Teams– EDI– Digital forensics– Cron jobs / scripts– Police / Fire / Emergency Service

If we didn't have time, everything would happen all at once.

- Hoyt Kesterson

Real world examples - Enron

• Enron CFO and other members of the Enron executive team made it a habit to engage in time-based data manipulation– Andrew Fastow and team alter and change financial data

to suit whatever it was they wanted the investing public or government authorities to know, or not know.

– January 2004 - Fastow pleads guilty, sentenced to 10 years

– Agrees to help prosecutors build a case against former chairman Kenneth Lay and former CEO Jeffrey Skilling

More real world examples

• NextCard• Autotote• RiteAid• Sirena• Parmalot• Adelphia• In all of these cases, effective time synchronization

would have provided data integrity assurance of financial reports, grant letters, loan reports, securities transactions, letters of credit and much more.

Importance of time synchronization

• Allows events to occur at the proper time - event synchronization– Schedule a process and ensure that it starts or stops on

time or runs for a specified period regardless of when it starts or stops

• Provides proof when events occurred or did not occur - digital forensics– Ensure that cooperating processes can interoperate

correctly, so that if one process hands a task off to another process, the second process will in fact be ready to accept the handoff

8

Costs / ROI• Enterprise-level time servers cost approximately € 2,000

to € 10,000 depending on the level of accuracy required, and if redundancy is needed.

• Can be installed and running in a few hours • Benefits include:

– reduced downtime– prevent operational failure– avoid data loss– improve security– mitigate legal exposure

• ROI– Time services ROI often measured in weeks or months

Practical Example

• Attacker illegally infiltrates your system on Sunday July 9, 2006 between 14:42:39 and 15:21:57

• Your system logs show that these events occurred starting at 19:49:12

• Attacker has witnesses stating that he was watching the World Cup Final with them from 18:00 – 22:00

• Prosecutor won’t take the case as the logs can’t be admitted as evidence

• “A snafu such as seriously unsynchronized logs would be regarded by a defense layer as a providential gift” – Ronald Coleman, Esq.

Regulatory• Time synchronization is being added to numerous

regulations and industry standards:– 21 CFR Part 11– PCI– GLBA– Sarbanes-Oxley– HIPAA– ETSI– National Emergency Number Association– Public Safety Answering Point Master Clock Standard– National Fire Protection Association– Standard #1221 - Installation, Maintenance and Use of Emergency

Services Communication Systems

Regulatory – PCI version 1.2 October 2008

• Section 10.4 - Synchronize all critical system clocks and times.– 10.4 Obtain and review the process for acquiring and distributing the

correct time within the organization, as well as the time-related system-parameter settings for a sample of system components. Verify the following is included in the process and implemented:

– 10.4.a Verify that a known, stable version of NTP or similar technology, kept current is used for time synchronization.

– 10.4.b Verify that internal servers are not all receiving time signals from external sources

– 10.4.c Verify that specific external hosts are designated from which the timeservers will accept NTP time updates (to prevent a malicious individual from changing the clock).

12

Wrong time adds to conspiracy theories

Quiz: What’s the shortest measurable amount of time?

• Attosecond, nanosecond, femtosecond, yoctosecond, ohnosecond, picosecond, exasecond, zeptosecond, millisecond, petasecond, zettasecond or yottasecond?

• An ohnosecond• Defined as the amount of time between when you

realize that you have left your keys in the car and when the door actually locks.

• Real answer is yoctosecond which is 10-24 seconds• It takes a quark particle a little more than a yoctosecond

to circle the proton of an atomic nucleus

14

Absolute vs. Relative Time

• Since the 17th century time has been measured astronomically– The event of the sun reaching the highest point in the

sky is called the transit of the sun– The interval between two consecutive transits of the

sun is called a solar day

• In the 1940s, it was established that the earth’s rotation is not constant– The earth is spinning slower– 300 million years ago were about 400 days per year

Absolute vs. Relative Time

• Relative or astronomic time is based on the earths rotation.

• Earth’s rotation is not absolute, leap seconds are added to keep UTC synchronized with the astronomical timescale.

• 1967 - 13th General Conference on Weights and Measures defined the International System unit of time, the second, in terms of atomic, rather than motion of the Earth.

– www.bipm.fr/en/convention/cgpm

• Define second as duration of 9,192,631,770 cycles of microwave light absorbed via transition of cesium-133 atoms in their ground state.

16

Universal Coordinated Time (UTC)

• UTC provides operating systems and applications with a common index to synchronize events and prove that events happened when timestamps state they did.– Also known as Zulu time

• It is a 24-hour clock system and that any given moment, UTC is the same no matter where you are located.– Suppose the UTC is now 13:00:00– I know the UTC offset for Brussels is +2– Therefore, it is 15:00:00 in Brussels

• Time Scales - www.ucolick.org/~sla/leapsecs/timescales.html • UTC really stands for Coordinated Universal Time, but both

terms are used.

17

Atomic Clocks

• Atomic clock was invented in 1948– Thousands of worldwide cesium-133 clocks

– Periodically they are averaged to produce international atomic time (TAI)

– The Bureau International de l’Heure (BIH) maintains the official clock

– Accurate to roughly one second every million years

UK National Physical Laboratory atomic clock

• Based on an ensemble of hydrogen masers and caesium atomic clocks.

• Contributes to international atomic time and provides reference for time and frequency dissemination and monitoring within the UK. – http://www.npl.co.uk/server.php?show=nav.294

• Time & Frequency User Club– http://resource.npl.co.uk/docs/networks/time/reg_form.pdf

19

USNO Master Clock

• Time Service Department has an ensemble of– 60 Cesium standards

– 14 Hydrogen masers

• Clocks incorporated into International Atomic Time (TAI)– Over 11 billion network requests since January 1,

2001– http://tycho.usno.navy.mil/ntp.html– www.usno.navy.mil

International Bureau of Weights and Measures - BIPM• Creates two essential elements for time measurement -

realization of the unit of time and a continuous temporal reference.

• Reference used is International Atomic Time (TAI), using data from some 200 atomic clocks in over fifty national laboratories.

• Long-term stability of TAI is assured by a judicious way of weighting the participating clocks.

• Scale unit of TAI is kept as close as possible to the SI second by using data from those national laboratories which maintain the best primary caesium standards.

21

Network Time Protocol (NTP)

• RFC 1305 – NTP - Version 3– www.faqs.org/rfcs/rfc1305.html

• UDP port 123• Accurate to within 10 - 100 milliseconds• UDP is an unreliable protocol, but NTP architected to

sustain levels of accuracy and robustness; even when used over numerous gateways and delays.

• In use over 27 years and remains the longest running, continuously operating Internet application protocol.

Network Time Protocol (NTP)

• NTP is only the protocol – not an application• Implementing NTP requires separate client and

server applications• Developed at Univ. of Delaware by David Mills

– 1985 – version 1 – RFC 1059– 1989 – version 2 – RFC 1119– 1992 – version 3 – RFC 1305– 1997 – version 4 - adds some secure authentication features– 2008 – current production version is 4.2.4 – August 2008– Download from

http://ntp.isc.org/bin/view/Main/SoftwareDownloads#Current_versions_of_NTP_Download

23

NTP Time Sources

• Dedicated NTP server with access to an external UTC time source– Stratum-1 GPS-based hardware device

• Public server with or without direct access to UTC time– Internet-based stratum 1,2 or 3

• Local master clock time source on a local network– Set by a local network administrator

NTP Design – Step 1

• Choose your NTP time source– Internal – More control, more management– External – Less control, less management

• Time source will impact topology, configuration, and management aspect of the entire NTP infrastructure.

• Possible time sources include:• Dedicated internal stratum-1 hardware appliance• Public stratum-1 server• Public stratum-2 NTP server• Local master

NTP Design – Step 1• Public vs. Private time servers• If your desired accuracy is in:

– Microseconds – Don’t rely on public time servers. Purchase a stratum-1 primary time server.

– Milliseconds - you can likely rely on public time servers

– Seconds - you can rely on public time servers.

• Public time servers are administered on a voluntary basis and there is no guarantee of server availability, accuracy or security.– See www.pool.ntp.org

NTP Design – Step 1

NTP Time Server Feature Comparison

Time Source

Availability Accuracy Security Cost

Dedicated Server

High High High High

Public server

Medium Medium Low Low

Local master

High Low High Low

NTP Design – Step 2

• NTP topology at the deployment site– Determine the desired level of time accuracy

– Number of NTP clients

– Network infrastructure redundancy

– Network physical topology and geography

• How are the sites connected?

• Round trip delays can impact NTP and negatively affect time accuracy

NTP Design – Step 3

• Determine which NTP features to use– Basic

– Security

• Authentication

• Access control

– Redundancy

• Redundancy between peers

• Redundancy configuration on clients

NTP Design – Step 4• Management

• How much you need to manage your NTP infrastructure is dependant on how important synchronized time is to your organization– SNMP– Ping– Vendor tools

• Metrics and statistics– Averages– Clock skew– Clock drift

Time synchronization checklist

1. Manually ensure that all firewalls, routers, critical servers, etc. have the correct time.

2. Identify all critical network devices in your organization that require accurate time.

3. Appoint a responsible technical staff member to be the time services liaison and to manage time services.

4. Meet with vendors of time synchronization equipment to determine the solution that best fits your organization and specific needs.

5. Advise management of the security risk of non-synchronized time

6. Get management approval for the purchase of time synchronization equipment

7. Ensure that time synchronization is an enterprise policy

31

Network time distribution stratum levels

• Stratum 0 - Reference clock source– NPL, NIST, USNO, GPS

• Stratum 1 - Primary Time Servers• Stratum 2 - Secondary Time Servers; generally

application servers, NOS servers, routers• Stratum 3 - Workstations, servers, Controlled

Timed Device (CTD) • Stratum 4- x – Deeper into other workstations,

servers, and CTD

Corporate policy on time synchronization

• Time synchronization must be made part of the corporate IT systems and security policies

• Example:– “Time synchronization to an accurate time source is

required on all enterprise network devices”.

• Without a policy, there will be no impetus for staff to achieve the goal of accurate, synchronized time.

33

GPS as a trusted time source

• GPS is unique in that it offers a direct, accurate and secure connection from UTC to inside the security of the organization’s network firewall.

• No WAN or router delays• No need to keep NTP port 123 open on the

firewall• EU and ESA’s Galileo navigation satellite

system will be able to provide same services as GPS when it is operational in 2013.

Customized architecture

• Create a clocking architecture that defines the top-level clocking source and all the components in the downstream topology

• Architecture must accept time and deliver it to the clients and servers within the organization.

• Backup time servers• Support peak loads of time services requests

Audit

• Infrastructure must be able to prove that the time on any monitored system was correctly synchronized at a particular time and date with a specified time source.

• Often required by industry specific regulations• Audit logs must be used within the context of

digital forensics. – Follow the rules of evidence

Automated Computer Time Service (ACTS)

• ACTS systems requires only a computer, a modem and some simple software.

• When a computer connects to ACTS by telephone, it receives an ASCII time code.

• The information in the time code is then used to set the computer's clock.

• http://tf.nist.gov/service/acts.htm

37

NIST Internet Time Service (ITS)

• ITS allows you to synchronize computer clocks via the Internet. – http://tf.nist.gov/service/its.htm

• Time information provided by the service is directly traceable to UTC (NIST).

• Service responds to time requests from any Internet client in several formats including:– DAYTIME - RFC 867 – was used by MS-DOS– TIME - RFC 868– NTP protocols - RFC 1305

Windows Internal Clock

Spectracom

• Model 9283 NetClock/GPS– Stratum 1 NTP/SNTP Time Server via GPS – Stratum-2 via NTP servers with peering capabilities– Oven-stabilized crystal oscillator (OCXO) and Rubidium

oscillators maintain time standard if time reference is lost– Dial-out modem provides back up to GPS or functions as the

primary reference, such as for disaster recovery.– www.spectracomcorp.com

Symmetricom

• SyncServer S250 GPS Network Time Server– Stratum 1 Operation via GPS Satellites – Stratum 2 Operation via NTP Servers – Rubidium option– Maintains extremely accurate & reliable time to 50ns– Accuracy is +/- 10 microseconds with a load of 5000

packets per second– www.symmetricom.com

EndRun Technologies

• Tempus LX GPS Network Time Server• Stratum 1 NTP Time Server via GPS • High NTP bandwidth capability with an accuracy

of under 10 microseconds• Oven-stabilized crystal oscillator (OCXO) and

Rubidium oscillators maintain time standard if time reference is lost

• www.endruntechnologies.com

Products

• Chronos Technology– www.chronos.co.uk

• Sematron– www.sematron.com/enterprise_timing.html

• Bytefusion– www.bytefusion.com/products/ntm/ntm.htm

• TimeCertain– www.timecertain.com

43

RFC’s• RFC 1305 – NTP - Version 3

– www.faqs.org/rfcs/rfc1305.html

• RFC 3161 - x.509 PKI Time-Stamp Protocol – www.faqs.org/rfcs/rfc3161.html

• RFC 3628 - Policy Requirements for Time-Stamping Authorities– www.faqs.org/rfcs/rfc3628.html – based on ETSI TS-102-023 version 1.1.1 Jan. 2002

• PTPd (Precision Time protocol)– http://ptpd.sourceforge.net

Resources

• Physikalisch-Technische Bundesanstalt (PTB)

– www.ptb.de/en/org/q/q4/q42/index.htm

• National Physical Laboratory NPL, UK

– www.npl.co.uk/server.php?show=nav.348

• Royal Observatory

– www.nmm.ac.uk/places/royal-observatory/time-galleries

• Federal Office of Metrology (METAS)

– www.metas.ch/metasweb/Fachbereiche/Zeit_Frequenz

• Bureau International des Poids et Mesures

– http://www.bipm.org/static/gpst/

45

Resources

• NTP Home Page– www.ntp.org

• David Mills NTP page– http://www.eecis.udel.edu/~mills/ntp

• Computer Network Time Synchronization– www.eecis.udel.edu/~mills/exec.html

• Digital Signatures are Not Enough– Jeff Stapleton/Steve Teppler - ISSA Journal January 2006

• ISC NTP Public Services Project– http://ntp.isc.org

Books

• Expert Network Time Protocol: An Experience in Time with NTP - Peter Rybaczyk

• Computer Network Time Synchronization: The Network Time Protocol - David Mills

• NTP documentation repository– http://support.ntp.org/bin/view/Main/DocumentationIndex

Mailing lists

• Time-nuts– Discussion list on the topic of precise time and frequency

measurement and related topics

– https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts

• NTP – 12 mailing lists of various depth and complexity

– https://lists.ntp.isc.org/mailman/listinfo

Conclusions

• Need for synchronized time is a crucial business and technology need.

• Synchronized time is an integral part of an effective network and security architecture.

• Information security hardware and software is highly dependent on synchronized time.

• Ensuring accurate time is relatively inexpensive and offers a significant ROI.

49

Thank you for attending

• Any questions? comments?• Please remember to fill out your comments form

Ben Rothke, CISSP, QSASenior Security ConsultantBT Professional Services – http://bt.ins.com New York, NY USAben.rothke@bt.com