OpenControls Logo

STIG Viewer

STIGViewer Support

Before establishing a network connection with a Network Time Protocol (NTP) server, Dragos Platform must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271105DRAG-OT-002480SV-271105r1057958_ruleCCI-001967medium
Description
Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DOD requires the use of AES for bidirectional authentication since it is the only FIPS-validated AES cipher block algorithm. The NTP uses MD5 authentication keys. The MD5 algorithm is not approved for use in either the FIPS or NIST recommendation; thus, a CAT 1 finding is allocated in CCI-000803. However, the use of MD5 is preferred to no authentication at all and can be used to mitigate this requirement to a CAT II finding. The trusted-key statement permits authenticating NTP servers. The product must be configured to support separate keys for each NTP server. Severs should have PKI device certificate involved for use in the device authentication process. Server authentication is performed by the client using the server's public key certificate, which the server presents during the handshake. The exact nature of the cryptographic operation for server authentication is dependent on the negotiated cipher suite and extensions. In most cases (e.g., RSA for key transport, DH, and ECDH), authentication is performed explicitly through verification of digital signatures present in certificates and implicitly by the use of the server public key by the client during the establishment of the master secret. A successful "Finished" message implies that both parties calculated the same master secret and thus, the server must have known the private key corresponding to the public key used for key establishment.
STIGDate
Dragos Platform 2.x Security Technical Implementation Guide2025-05-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-04Identification & Authentication for Devices
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-4(17)Domain Authentication
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-8Time Stamps
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-001967
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
0.50
PR.AA-03
0.50
PR.AA-05
0.50

Details

Check Text (C-271105r1057958_chk)

Verify NTP Server. Log in to the Dragos Platform CLI. Execute the following command: config show If an NTP server is configured, the following will be in the output. If the following is not in the output, this is a finding. (Note: "servers" will be the configured server.) "system": { "ntp": { "enabled": true, "servers": [ "pool.ntp.org" ] } }

Fix Text (F-75049r1057957_fix)

Configure NTP Server. Log in to the Dragos Platform CLI. Execute the following command: config ntp server add ["SERVER_NAME"]