Server
Time Server
The authoritative time source (often GPS-disciplined NTP/PTP) for OT systems.
High criticalityLevel 3 – Level 2
What it does
Synchronises event timestamps across controllers, relays, servers and logs.
Typically locatedSite operations zone; GPS antenna on the roof or substation yard.
At a glance
PurdueLevel 3 – Level 2
CategoryServer
Protocols
Talks toNearly every OT device, Upstream reference clocks
Common vendorsMeinberg, SEL, Multiple
Why should I care?
Time Server sits at Level 3 – Level 2. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Devices pointed at internet time sources
- GPS antenna exposure
- No monitoring of offset
If it is compromised
- Log correlation and protection schemes degrade; forensics become unreliable
What to monitor
- Clock offset and stepping events
- Configuration changes to time sources
- Devices using unexpected servers
How to defend it
- Internal authoritative time hierarchy
- Alarm on offset thresholds
- Restrict time-source configuration
Hunting
Hunt ideas for this component
Related