A rated company appealed Bitsight’s grading of the rdate protocol. Today, rdate is graded as a “Warn” issue and is a protocol designed to respond to requests for the current time. The rated company appealed on the grounds that (1) it felt that the time protocol posed no risk and (2) it has fewer known vulnerabilities compared to other services that are graded NEUTRAL, such as DNS or the alternative Network Time Protocol (NTP).
The Policy Review Board decided not to implement a change in grading policy at this time. This protocol has known security vulnerabilities; If the time is incorrect, it can be exploited by attackers to break secure connections and encryption certificates. This is in line with NIST recommendations, and NIST additionally points out that rdate “has poor error-handling capabilities in general, and many of the client programs that use this format are poorly written and may not handle network errors properly”. Implementations of obsolete protocols can also be a sign of poor overall configuration management.