Time synchronisation

Reconstructing an incident means putting events from many systems into order. If their clocks disagree, the order is wrong.

It sounds trivial and it repeatedly wrecks investigations. Servers drifting by minutes, devices in different time zones, logs recorded in local time with no offset. The result is a timeline where the response appears to precede the attack, and hours spent working out which machine is lying. Synchronised clocks and recording everything in UTC is dull preparation that quietly saves a great deal of time later.