QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
Treating trustworthy time as a security control at Kestrel Harbour Securities: investigation IR-2026-011 could not say whether a privileged login came before or after an EDR alert because the Windows domain, the PAM vault and the EDR cloud disagreed by up to 41.2 seconds; the time rail of eight stations — why time matters, architecture, NTP and PTP, authenticated time, log hygiene, failure tests, monitoring and evidence — along which the clock-offset spread across 1,240 hosts narrows from 41.3 seconds to 4 milliseconds; and the rebuilt timeline with error bars, placing the logon 15.0 seconds before the LSASS read, in a Standard signed on 2026-07-31.
CY-EXPERT-098Expert Level · Logging and Telemetry

Time Synchronisation Scenarios

An expert-level course on treating trustworthy time as a security control, and on designing the scenarios that prove an estate's clocks and timestamps can be relied on for detection, investigation and legal evidence. Ride the time rail - eight stations along which the offset spread across the estate narrows from 41.3 seconds to 4 milliseconds: why time matters to correlation, Kerberos, certificates, forensics and trading records; a time architecture that can outvote a bad source; NTP and PTP each where its accuracy is needed; authenticated time with NTS and symmetric keys; timestamp hygiene in logs; failure scenarios rehearsed in the lab with their signals named first; monitoring against thresholds drawn from accuracy budgets; and timelines with error bars in a Standard someone else can re-perform.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

  • Reconstruct a failed timeline from the organisation's own logs, measure offsets between sources from paired events, and baseline every in-scope clock by tier.
  • Map the real time hierarchy, identify falsetickers and wrong-timescale references, and design diverse sources that can outvote a bad one.
  • Measure NTP's limits on real paths, place PTP where the accuracy budget requires it, and tune Windows Time against an independent reference.
  • Authenticate time with NTS and scoped symmetric keys, record a trust state for every path, and close the side doors around the hierarchy.
Price:৳12,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.