Defensive › Module 7 › Lesson 3
Time Integrity
NTP and clock sync — correlated timelines require trustworthy time on $LAB.
Visual · t16_time_integrity
Log correlation breaks when clocks lie. Original Cyberlium.
Opening
Two hosts ten minutes apart can make an innocent login look like teleportation.
Central logging assumes synchronized clocks: NTP/chrony on Linux, w32tm on Windows, consistent timezone in UTC for storage. Attackers may timestomp local files — central collectors with reliable NTP resist naive tampering. Verify time sync on $LAB Windows and Linux before forwarding logs; document offset if VM clock drifts. Never disable time sync to 'hide' lab actions on shared infrastructure.
1. Why sync matters
Multi-host incidents need ordered events — skew breaks causality.
Alerts on 'impossible travel' depend on accurate timestamps.
Command guide
Try these commands — Why sync matters
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Time sync — https://www.nist.gov/pml/time-and-frequency-division/time-realization/time-services NIST SP 800-92 — https://csrc.nist.gov/publications/detail/sp/800-92/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
timedatectl status 2>/dev/null || date -u; date journalctl -n 5 --no-pager -o short-iso-precise 2>/dev/null || journalctl -n 5 --no-pager
Primary tools to practice this lesson: timedatectl, journalctl. Reference sites: Time sync (https://www.nist.gov/pml/time-and-frequency-division/time-realization/time-services); NIST SP 800-92 (https://csrc.nist.gov/publications/detail/sp/800-92/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab verification
timedatectl status or chronyc tracking on Linux; w32tm /query /status on Windows.
Fix VM drift in hypervisor settings — common lab finding.
3. Defender note
Store UTC in SIEM; display local in UI. Note leap seconds and DST in runbooks.
Timestomp is an attacker technique — defenders detect via central time vs local mtime — literacy only, no offensive steps.
4. What you ship: time integrity checklist
NTP verified on $LAB pair + UTC storage note + skew impact sentence.
5. What you record before the next lesson
Time sync verification output redacted.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Turn off NTP on lab hosts to confuse a shared class SIEM.
Right
Verify time sync. Next: central lab.
Mission: time integrity check
1) Verify NTP/chrony on $LAB Linux. 2) Verify w32tm or Settings time on $LAB Windows. 3) Write why skew breaks correlation.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “VM clock drift fix?”
Knowledge Check
APPLY: Clock skew breaks:
Multiple choice
Knowledge Check
APPLY: True or False: Disable NTP to hide lab activity on shared infra.
True or False
Knowledge Check
APPLY: SIEM storage should prefer:
Multiple choice