[Autogenerated] Obviously logging depends on certainly consolidated
logging across lots of systems depends on every system Agreeing that
the time of day is the same time of day.
Yes.
Which is why we've got requirement 10 4.
Yeah.
On synchronizing time between devices, that's a lot of requirement in 10.4.
There's a lot of stuff in 10.4,
and and this is kind of my least favorite part of PC IDE s s,
uh,
because because there's a lot of stuff and a lot of it is kind of the minutia.
Yes.
You want time synchronization across all of your devices?
Uh, you know, like I mentioned in the requirement nine stuff.
I've encountered CCTV systems where the timestamp was wrong, right?
And and that's really problematic, right?
Or if you have differing time stamps across different system components,
um, now these requirements were written,
you know, in the earlier part of the last decade,
find large on, have stayed more or less the same over over this period of time.
So a lot of a lot of the requirement difficulty I find in the NTP
section is the idea that the organization has its own one or two
times servers that everything points to.
And then they go out to some internet time source the,
you know,
NIST or pool or the Navy Observatory or whatever to get some time source on.
Then propagate that back.
And that was intended so that you don't have,
you know, drift or like we don't care what PICO second it is.
We care that the time stamps error All consistent, right.
Uh, I think that is increasingly sort of a less relevant,
uh, in terms of preventing sort of drift problems.
And the need for an organization to have a couple of internal
time service that everybody points to is increasingly
problematic in a cloud based environment,
for example,
where spitting up your own time server than poking holes in
the VPC to point everything to it right,
rather than just getting the cloud providers time service,
you know that every host can point to directly,
uh, you know, sometimes causes problems.
And so I've had clients have to basically concoct a
compensating control for everybody goes out to,
you know, the one time service, right?
Every host, because as of the one time service,
rather than they have their own internal time server.
Right?
Because the notion of internal network in cloud
environment starts to break down.
Absolutely only.
And as you say,
if you if you have to start punching holes in your virtual
private networking or your CloudWatch for someone to go out to
get a time zone getting a little yeah, yeah,
I mean, I remember used to use that, you know.
In fact, actually, recently I have Did, you know,
make sure we had areas on the roof and we're picking up time from GPS,
which has got the easiest way to do it for a data center,
for example.
Yeah, but this whole thing about having to have these times services a bit,
okay, it can be, Yes.
The requirement should just be that everything has the same time.
I don't care how you do it, right?
Yeah, right.
In a more ideal world,
that would be how you would approach it and finally stuck in 10 for some reason.
That I don't really understand is fine integrity monitoring, isn't it?
Well, there's a part of on the audit log on the audit logs, right?
And I think that hearkens back to a day where the
centralized repository is a collection of files,
right?
Right now,
a very few clients where I don't mark 10.55 is not app
clickable because for the most part, when they collect and centralized blog data,
those log events are records in a database,
right?
And so file level integrity checking doesn't really
work in a relational database.
Uh, now it's still very possible to have, you know, files getting centralized.
In which case, yeah, you want some sort of file integrity monitoring there.
But that's that's not often the case,
because putting want to database doesn't really work.
No changes, No.
I mean,
if you want it to go off all the time and train
your staff to ignore the similar, it's absolutely then do that,
yeah.