Flow records show a workstation sending steady UDP 123 traffic to an unknown external server, with packet sizes far larger than normal time requests. Corporate devices are supposed to use two internal time servers. What is the best response?
Select an answer to reveal the explanation.
Short Explanation
Time sync is supposed to be small and boring, like asking someone the time. Big, steady packets to a stranger's server mean somebody's using NTP as a hiding place. If you lock outbound NTP to your own servers, the hiding place disappears.
Full Explanation
NTP is often allowed outbound with little scrutiny, which makes it attractive as a covert channel: an attacker can encode data in NTP packet fields or extension data and send it to a server they control, using a protocol defenders rarely inspect. Indicators include NTP traffic to servers other than the approved time sources, packet sizes or rates inconsistent with normal client polling, and steady volumes from ordinary workstations. The right control is to restrict outbound UDP 123 so that only the internal time servers communicate with external sources and all clients sync internally, then investigate the host. Opening UDP 123 to all destinations widens the channel rather than closing it. Increasing the polling interval changes the behavior of a legitimate NTP client, but malware sending crafted packets ignores that setting, so volume would not change. Switching to ICMP timestamp requests replaces one weakly inspected protocol with another and is not a standard time synchronization approach. Exam caveat: the same allow-only-approved-servers principle applies to DNS, which is the most common covert channel of this kind. Operational check: confirm firewall logs show workstation NTP blocked to all destinations except the internal servers and that time synchronization still succeeds.