OpenControls Logo

STIG Viewer

STIGViewer Support

The Dell OS10 Switch must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269794OS10-NDM-000750SV-269794r1051767_ruleCCI-001967medium
Description
If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.
STIGDate
Dell OS10 Switch NDM Security Technical Implementation Guide2024-12-11

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-04Identification & Authentication for Devices
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-4(17)Domain Authentication
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-8Time Stamps
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-001967
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
0.50
PR.AA-03
0.50
PR.AA-05
0.50

Details

Check Text (C-269794r1051767_chk)

Review the OS10 Switch configuration to determine if the network device authenticates NTP endpoints before establishing a local, remote, or network connection using authentication that is cryptographically based. Review the configuration to verify that NTP authentication is configured when communicating with the NTP servers with the following commands: OS10# show running-configuration ntp ! ntp authenticate ntp authentication-key 345 sha2-256 9 **** ntp server 192.0.2.1 key 345 prefer ntp server 192.0.2.5 key 345 ntp trusted-key 345 If the OS10 Switch not authenticate NTP sources using authentication that is cryptographically based, this is a finding.

Fix Text (F-73728r1051766_fix)

Configure the OS10 Switch to authenticate NTP sources using authentication that is cryptographically based: OS10(config)# ntp authenticate OS10(config)# ntp trusted-key 345 OS10(config)# ntp authentication-key 345 sha2-256 0 <key> OS10(config)# ntp server 192.0.2.1 key 345 preferred OS10(config)# ntp server 192.0.2.5 key 345