Cyber Security

Adhering to security best practices is essential for building a secure and reliable system. An effective security approach needs to consider all components of the infrastructure.

Smart network clocks and similar devices deserve particular attention. They are often installed in publicly accessible or remote locations and may be more exposed to physical or network-based attacks than core infrastructure components.

This chapter outlines common threat scenarios, explains how the device mitigates risks by design, and provides recommendations for additional protective measures.

Note

Not all cybersecurity threats result from malicious attacks. For example, a forgotten password or an incorrectly configured output can also compromise system availability or security.

Protocols and Used Network Ports

The following table lists the network protocols and ports used by the device.

Port	Transport	Protocol	Can be Disabled	Comment
80	TCP	HTTP	✗	Redirects incoming requests to HTTPS. Not used for other services.
443	TCP	HTTPS	✗	Web interface, RESTCONF API, and file uploads.
123	UDP	NTP	✓	Time synchronization.
161, 162	UDP	SNMP	✓	SNMP read access (GET) and trap transmission.
1900	UDP, TCP	SSDP	✓	Service discovery.
1901	TCP	UPnP	✓	Provides device information for automatic discovery (e.g., Windows File Explorer).
57, 68	UDP	DHCPv4	✓	Automatic IPv4 address assignment.
546	UDP	DHCPv6	✓	Automatic IPv6 address assignment.
53, 853	UDP, TCP	DNS	✗	Name resolution
-	-	ICMP, ICMPv6	✓	Network diagnostics and error reporting.

Note

Ports used by external services may differ from their default values (for example, syslog may use a port other than 514).

Security Checklist

The security of an installation can be improved by taking the following measures.

Note

Many of these measures restrict functionality in order to improve security. For example, disabling ICMP prevents the device from responding to ping requests. While this may make troubleshooting more difficult for administrators, it also reduces network visibility for potential attackers.

Note

Security always involves balancing operational convenience against risk exposure.

Reduce the Attack Surface

Minimize the number of accessible services and entry points:

• Disable unused network protocols (e.g., ICMPv4, ICMPv6, SSDP, SNMP, Syslog).

• Install firmware and security updates as soon as they become available.

• Protect physical network ports from unauthorized access.

• Replace the default TLS certificate with a trusted certificate issued by your organization.

• Use strong, unique passwords for all user accounts.

• Disable unused user accounts.

• Disable the physical factory reset button if appropriate.

Network Segmentation and Access Control

Limit the device’s communication to only what is strictly necessary:

• Restrict outbound network access (e.g., allow communication only with required NTP servers or management systems).

• Do not expose the device directly to the public internet.

• Avoid configuring port forwarding to the device.

• Place the device in a dedicated VLAN or protected network segment where possible.

Monitoring and Incident Response

Ensure that suspicious activity can be detected and addressed quickly:

• Enable logging and forward logs to a central syslog server.

• Monitor network traffic for unusual behavior.

• Regularly review device logs and system status.

• Test supervision and alarm mechanisms (e.g., using the dummy error function).

Scenarios

The following key threat scenarios were considered during the development of the device. For each scenario, a brief description is provided along with:

• The mitigation measures implemented in the device hardware and software design

• Recommended actions to take if suspicious activity or an attack is detected

This structured approach helps ensure that potential risks are understood and that appropriate preventive and corrective measures are in place.

Denial of Service (Temporary)

This scenario covers situations in which the device temporarily stops operating normally but does not leak sensitive information and does not suffer permanent damage. The effects are noticeable (for example, a clock stops or displays an incorrect time), but normal operation resumes automatically once the disturbance ends.

Realistic attack vectors include:

• Flooding the device with excessive network traffic

• Triggering a manual reboot (if physical access is available)

• Interrupting the power supply

• Overloading or short-circuiting a physical output

Implemented Measures

The primary defense mechanisms against temporary denial-of-service conditions are logging, supervision, and automatic recovery features.

• The device logs significant events (e.g., reboots) and abnormal conditions (e.g., high CPU load, short circuits, or hardware faults).

• Supervision mechanisms allow these events to be reported to monitoring systems.

• Built-in reliability features are designed to ensure that the device automatically returns to normal operation after transient faults or abnormal operating conditions.

These measures enable administrators to determine when an incident occurred and assess its impact.

Recommended Recovery Actions

If a denial-of-service incident is suspected:

• Remove the attacker or the source of disruption from the network or physical environment.

• Identify the scope and duration of the incident.

• Verify that the device has returned to normal operation.

• Review logs and monitoring data for anomalies.

• Report any newly discovered vulnerabilities or attack patterns to the manufacturer.

This approach ensures both immediate recovery and continuous improvement of system security.

Denial of Service (Permanent)

A permanent denial-of-service occurs when an attacker destroys or irreversibly disables the device.

Possible causes include

• Mechanical damage: Physical damage that renders the device inoperable.

• Electrical damage: Intentional or accidental misuse (e.g., overvoltage, short circuits, reverse polarity) that damages internal components.

• Theft: Physical removal of the device from its installation site.

• Misconfiguration or lost credentials: Incorrect configuration or forgotten passwords that prevent access.

• Software vulnerabilities: Sophisticated attacks that leave the device in an unusable state.

Implemented Measures

• Continuous monitoring: Dedicated “heartbeat” mechanisms (e.g., via syslog or SNMP) indicate whether the device is operating normally.

• Electrical protection: Inputs and outputs are protected against common faults such as overload.

• Tamper detection: In certain cases, the device intentionally stops operating if severe tampering is detected (e.g., installation of unofficial software; Secure Boot enforcement).

• Reliability safeguards: Built-in mechanisms prevent common configuration errors from causing permanent damage. For example, the device can automatically recover from failed firmware updates and reject invalid network settings.

Recommended Recovery Actions

• Analyze the incident and ensure there is no ongoing hazard (e.g., electrical damage).

• Attempt recovery where possible:

  • Inspect and remove any physical issues (e.g., damaged or shorted wiring).

  • Perform a factory reset to eliminate potential misconfigurations.

• If recovery is not possible, return the device to the manufacturer for further analysis.

Data Extraction

The goal of a data extraction attack is to gain unauthorized access to sensitive information stored on the device.

Data of interest may include:

• Login credentials (e.g., passwords)

• Log files (e.g., usage patterns, potential vulnerabilities)

• Device configuration and operational state

• Private keys and certificates

• Environmental information (e.g., network topology)

Possible attack methods include:

• Password guessing or brute-force attacks

• Exploitation of insecure protocols or configuration weaknesses

• Physical access to analyze memory contents

• Social engineering

Implemented Measures

• Encryption at rest: User data (configuration, logs, TLS certificates, etc.) is fully encrypted when the device is powered off.

• Secure credential storage: Passwords are never stored in plain text.

• Software protection: Firmware is encrypted to hinder reverse engineering and data extraction.

• Access control: Device access requires authentication.

• Protocol control: Optional protocols (e.g., ICMP, SSDP) can be disabled if not required.

Recommended Recovery Actions

If data extraction is suspected:

• Assess the scope of the incident and identify compromised data.

• Mitigate further risk:

  • Revoke affected TLS certificates.

  • Change all potentially compromised passwords.

• Report the incident to the manufacturer.

Device Takeover

Device takeover refers to an attacker gaining control of the device and potentially executing malicious code.

Such attacks may aim to:

• Use the device as an entry point for broader network attacks.

• Enlist the device in a botnet to conduct distributed attacks.

Possible attack vectors include:

• Installing a tampered software update

• Exploiting software vulnerabilities

• Replacing the device entirely (e.g., unplugging it and installing a malicious substitute) when physical access is available

Implemented Measures

• Security updates: Known vulnerabilities are addressed through regular security updates. These should be installed promptly.

• Defense in depth: Multiple layers of protection are implemented:

  • Secure software updates: Only authenticated and untampered updates can be installed.

  • Secure Boot: If unauthorized software is detected (e.g., due to physical tampering), the device will not start.

  • Firewall: Unauthorized or unexpected connections are rejected.

• Monitoring and logging: Logs (e.g., web server access logs) provide evidence of potential tampering attempts.

Recommended Recovery Actions

• Immediately disconnect the device from the network.

• Analyze the system and assess the extent of the compromise.

• Revoke potentially affected TLS certificates and change all passwords.

• Report the incident to the manufacturer.