Part of the DETECT Playbook ← Return to Hub
Phase: Detect All vessels
Satisfies: E26E27IEC 62443

Trusted Time (NTP) Management

This guide establishes accurate and tamper-resistant time synchronisation across all OT assets, ensuring audit trail integrity and preventing time-drift that could invalidate certificates or bypass logging.

In a maritime cyber incident, time is the most important variable. Network Time Protocol (NTP) ensures that every device on the vessel—from the Bridge ECDIS to the Engine Room PLC—shares a single, accurate timestamp. Without this, correlating logs during a failure becomes technically impossible.

The Danger of “Time Drift”

Time drift occurs when internal hardware clocks diverge. In OT environments, even a 5-minute difference can have catastrophic security implications:

Log Incoherence

During a breach, unsynchronized logs show events happening out of order. You cannot determine if the Engine Alarm caused the Network Failure or vice versa, leading to Forensic Dead-Ends.

Certificate Expiry

Modern encryption (SSL/TLS) and 2FA codes are time-sensitive. If an AMS server drifts, it will reject legitimate encrypted traffic, causing System-Wide Communication Loss.

Replay Attacks

Hackers can intercept and “replay” old commands if the system’s clock is lagging, as the device may believe a stale command is actually current and valid.

Zone-Based Time Architecture

To maintain E26 compliance, we utilize a tiered distribution model. This ensures that even if the IT network is compromised, the OT Zone maintains its “Trusted Time.”

Network Zone Component Technical Role
Mgmt / IT Zone Master Clock (GPS) Stratum 1 source. Pulls time from GNSS (Global Navigation Satellite System).
iDMZ OT NTP Relay Acts as a buffer. It pulls from the Master and serves the OT Zone. No direct IT-OT connection.
OT Zone PLCs & Sensors NTP clients that strictly sync from the iDMZ gateway only.
ETO Checklist: Trusted Time Audit
Verify GPS Sync

Ensure the primary NTP server is receiving a high-accuracy pulse (PPS) from the GNSS/GPS system.

Check VLAN Propagation

Verify that firewalls are allowing UDP Port 123 to pass from the iDMZ to isolated OT Zones.

Maximum Deviation Check

Compare the time on a PLC with the AMS Server. If they differ by more than 1000ms, your NTP polling interval is too slow.

Legacy Tip: On older ships without a central NTP server, ETOs often set time manually. Stop this practice. Manual clocks can drift 1 second per day, leading to total log failure within a month.

Next Section

Centralized Syslog Setup

Centralized Syslog Setup This guide implements centralised log aggregation across all in-scope systems, providing the un...

Scroll to Top