[Autogenerated] There will be many systems and
components generating log entries,
so it's important that they're all synchronized to the same
time so you can reconstruct analyze events.
And that's what requirement 10.4 is all about.
It's important to remember now that the DSS is over 10 years
old on what we take for granted now that just about every
system will automatically wanted external time souls wasn't
really true when CSS was written.
And so this is quite involved that requirements to make sure that
time within the 100 is synchronized and protected.
Now,
although this is a top level requirement with the detail
to follow in the sub requirements,
the testing procedure wants to QoS A to make sure that doing time properly is
included in system build on the system update processes.
The first sub requirement, however,
looks like a restatement of the main requirement on this is one where you
have to dig deeply to understand what the standard wants,
because the requirement itself is really light on details just asking for
correct and consistent time across critical systems.
But the hard detail of the requirements error actually
hidden in the testing procedure,
which we need to look at and error two parts of the testing procedure.
The 1st 10.4 point one a.
Ask use A to check processes and procedures on the 2nd 10.4 point
one b to look at configuration settings to check for three time
related configuration requirements, which are this Firstly,
there's a central time server or servers that get time
from a reputable external source.
Secondly, if you've got multiple times servers,
they synchronized with each other.
And finally,
all the critical systems in the 500 get their time from your Central
time server on not directly from external time sources.
Again, with requirement 10.4 point two.
There's not much detail in the requirement.
It just asked that all time data is protected,
and you may have noticed that the guidance is the same
for all of the 10.4 requirements.
But again, the real detail of the requirement is in the testing procedure,
which I paraphrased here below the requirement so you can see what the
standard means when it says Time database protects did,
and that is the least privileged access and change controller.
What's really, really meant by this requirement.
So the things that the QoS A will look for to validate that these two aspects
of protecting time or in place of the system configurations,
settings and log files back for the last time search
requirement does actually say what it means,
which is that your Central time server or time servers
actually get time from industry accepted sources.
So that could be well known.
Protected NTP servers on the Internet or something like a GPS receiver
plugged into your own time server on to test this the QoS A is just going
to look at the configuration of your time servers.
Now.
I think we spent enough time on time servers,
so let's move on to the security of audit trails.