Wrong clocks break security quietly
Logins, certificates, MFA codes and logs all depend on accurate time. Check that every machine syncs from a reliable source.
Time is one of those things nobody thinks about until it breaks. A server’s clock drifts five minutes and Kerberos logins start failing. A device boots with the wrong date and every TLS certificate looks invalid. Authenticator codes stop matching. And during an incident, logs from different machines can’t be lined up, because each one has its own idea of when things happened.
- Make sure every server, network device and camera syncs time over NTP, not just “set once”.
- In a Windows domain, the PDC emulator should sync from a reliable external source, and everything else from the domain.
- Use the same time zone in logs, ideally UTC, and include it in the timestamp.
- Monitor clock drift. Most monitoring tools can alert on it.
- Check devices that lose power: some forget the time and come back in 2000.