Collab Summit 2016

Accurate time keeping is critical to the safe operation of many Internet systems.  A vast number of Internet systems use the Network Time Protocol (NTP) to synchronize their system clocks making the NTP reference implementation de facto critical infrastructure.

In late 2014 and early 2015, the disclosure of several serious vulnerabilities in the Network Time Protocol daemon (ntpd) raised awareness of potential problems with NTP.  As a member of the Linux Foundation Core Infrastructure Initiative (CII) Steering Group, Cisco
contributed to the CII effort by performing a security evaluation of ntpd.

In this talk, we'll discuss the results of our evaluation: the vulnerabilities we found, areas of strength and weakness, recommendations for hardening your NTP infrastructure, and possible directions for future work.