{"stig":{"title":"Tanium 7.3 Security Technical Implementation Guide","version":"2","release":"3"},"checks":[{"vulnId":"V-234031","ruleId":"SV-234031r960918_rule","severity":"medium","ruleTitle":"Tanium must centrally review and analyze audit records from multiple components within the system.","description":"Successful incident response and auditing relies on timely, accurate system information and analysis in order to allow the organization to identify and respond to potential incidents in a proficient manner. If the application does not provide the ability to centrally review the application logs, forensic analysis is negatively impacted.\n\nSegregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system or application has multiple logging components written to different locations or systems.\n\nAutomated mechanisms for centralized reviews and analyses include, for example, Security Information Management products.","checkContent":"Using a web browser on a system that has connectivity to Tanium, access the Tanium web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources under \"Configured Sources and Destinations\" section.\n\nIf an \"Audit Log\" source does not exist, this is a finding.","fixText":"Using a web browser on a system that has connectivity to Tanium, access the Tanium web UI.\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nClick \"Create Connection\".\n\nIn the \"Source and Destination\" section, select \"Audit Log\" as the source from the drop-down menu.\n\nIn the \"Destination\" section, select the desired Destination and fill in the respective fields.\n\nIn the \"Format\" section, select the desired file format type.\n\nIn the \"Schedule\" section, select the desired schedule.\n\nClick \"Create Connection\".","ccis":["CCI-000154"]},{"vulnId":"V-234032","ruleId":"SV-234032r961458_rule","severity":"medium","ruleTitle":"Tanium must implement organization-defined automated security responses if baseline configurations are changed in an unauthorized manner.","description":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the system. Changes to information system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the application. Examples of security responses include, but are not limited to the following: halting application processing; halting selected application functions; or issuing alerts/notifications to organizational personnel when there is an unauthorized modification of a configuration item.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on the module \"Integrity Monitor\".\n\nClick on \"Monitors\" from the left menu.\n\nEnsure \"Monitors\" are deployed with applicable Watchlists and Endpoints.\n\nRecord any that have a number greater than \"0\" otherwise, this is a finding.\n\nIf using third party integrity monitoring tools, this is Not Applicable.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on the module \"Integrity Monitor\".\n\nClick \"Watchlist\" from the left menu.\n\n \"Create a New Watchlist\" in the upper right corner.\n\nAdd Name and Description of the new Watchlist.\n\nSelect \"Path Style\" that fits your enterprise needs.\n\nSelect \"Create\".\n\nClick on the new Watchlist.\n\nSelect \"Add Paths\".\n\nAdd paths to be monitored (Work with your TAM to determine correct paths).\n\nClick \"Monitor\" from the left menu.\n \n \"Create a New Monitor\" in the upper right corner.\n\nAdd \"Name\"\n\nAdd \"Description\".\n\nAdd computers for the new Monitor along with Watchlist.\n\nClick \"Create\".\n\nSelect \"Deploy Monitors\".","ccis":["CCI-001744"]},{"vulnId":"V-234033","ruleId":"SV-234033r961479_rule","severity":"medium","ruleTitle":"Tanium must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.","description":"Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities.\n\nThe organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.\n\nVerification of whitelisted software can occur either prior to execution or at system startup.\n\nThis requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with CAC.\n\nClick on the navigation button (menu) on the top left of the console.\n\nClick on the \"Protect Workbench\".\n\nSelect the arrow on the left-hand side to expand the menu.\n\nClick on \"Policies\".\n\nClick on the Policy with Policy Type named \"AppLocker\".\n\nIf there is no policy type defined for \"AppLocker\", this is a finding.\n\nEnsure the computer group containing the Tanium server is showing as online and enforced.\n\nIf the \"AppLocker\" policy enforcement does not contain the Tanium Server, then this is a finding.\n\nUnder Policy Details ensure the Mode is set to \"Blocking\".\n\nIf Mode is not set to \"Blocking\", this is a finding.\n\nUnder \"Policy Details\" expand the arrow next to \"Everyone\".\n\nIf all files are allowed, this is a finding.\n\nIf additional paths are found, such as %PROGRAMFILES%\\\", \"%WINDIR%\" and \"?:\\Program Files\\Tanium Server\\\", they must be documented.\n\nIf additional file paths are found and have not been documented, this is a finding.\n\nIf Tanium Protect is not available, this is not applicable.","fixText":"Using a web browser on a system, which has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with CAC.\n\nClick on the navigation button (menu) on the top left of the console.\n\nClick on the \"Protect Workbench\".\n\nSelect the arrow on the left-hand side to expand the menu.\n\nClick on \"Policies\".\n\nClick on \"New Policy\".\n\nSelect \"Create\".\n\nProvide a name to the policy.\n\nSelect \"AppLocker\" from the Policy Type menu.\n\nWithin the policy, ensure the \"Blocking\" radio button is selected.\n\nIn the \"Allow\" section, ensure the default rules for \"All files located in the Program Files Folder\" and \"All Files located in the Windows folder\" are present.\n\nIf the Tanium Server is installed in a non-default location, then a rule needs to be created to allow that file path.\n\nAll rules need Windows user set to \"Everyone\".\n\nSave the Policy.\n\nClick on \"Add Enforcement\".\n\nFrom the dropdown, select the computer group, which contains the Tanium Server.\n\nSelect \"enforce\".","ccis":["CCI-001774"]},{"vulnId":"V-234034","ruleId":"SV-234034r961563_rule","severity":"medium","ruleTitle":"The vulnerability scanning application must implement privileged access authorization to all Tanium information systems and infrastructure components for selected organization-defined vulnerability scanning activities.","description":"In certain situations, the nature of the vulnerability scanning may be more intrusive, or the information system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates more thorough vulnerability scanning and also protects the sensitive nature of such scanning.\n\nThe vulnerability scanning application must utilize privileged access authorization for the scanning account.","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium users.\n\nIf any users have access to Tanium Comply and are not on the list of documented users, this is a finding.\n\nIf Tanium Comply is not installed, this check is Not Applicable.","fixText":"Prepare and maintain documentation identifying the Tanium Comply users and their respective User Roles and AD security groups.","ccis":["CCI-001067"]},{"vulnId":"V-234035","ruleId":"SV-234035r960762_rule","severity":"medium","ruleTitle":"The Tanium endpoint must have the Tanium Servers public key in its installation.","description":"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.\n\nSatisfies: SRG-APP-000015, SRG-APP-000158, SRG-APP-000394","checkContent":"The Tanium endpoint makes a connection to the Tanium Server; the endpoint's copy of the Tanium Server's public key is used to verify the validity of the registration day coming from the Tanium Server.\n\nIf any endpoint systems do not have the correct Tanium Server public key in its configuration, they will not perform any instructions from the Tanium Server and a record of those endpoints will be listed in the Tanium Server's System Status.\n\nTo validate, Click on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"System Status\" tab.\n\nChange \"Show systems that have reported in the last:\", enter \"7\" in the first field. \n\nSelect \"Days\" from the drop down menu in the second field to determine if any endpoints connected with an invalid key.\n\nIf any systems are listed with \"No\" in the \"Valid Key\" column, this is a finding.","fixText":"For systems which do not have a valid key for the Tanium Server, redeploy the client software from Tanium using the Tanium Client Deployment Tool or work with the Tanium System Administrator to accomplish this.","ccis":["CCI-000778","CCI-001453","CCI-001958"]},{"vulnId":"V-234036","ruleId":"SV-234036r960933_rule","severity":"medium","ruleTitle":"Access to Tanium logs on each endpoint must be restricted by permissions.","description":"For the Tanium Client software to run without impact from external negligent or malicious changes, the permissions on the Tanium log files and their directory must be restricted.\n\nTanium is deployed with a Client Hardening Solution. This solution, when applied, will ensure directory permissions are in place.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Actions\".\n\nClick on \"Scheduled Actions\".\n\nLook for a scheduled action titled \"Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory\".\n\nIf a scheduled action titled \"Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory\" does not exist, or there is a Scheduled Action contradicting the \"Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory\" scheduled action, this is a finding.\n\nIf the scheduled action exists, select it and if it is not approved (the \"Approve\" button at the top of the section will be displayed if not approved), this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nOn the Dashboard, select \"Client Service Hardening\".\n\nSelect the \"Set Client Directory Permissions\".\n\nTanium will parse the script and return a row for \"Restricted\" and a row for \"Not Restricted\", with their respective client counts.\n\nClick on the \"Not Restricted\" row.\n\nSelect \"Deploy Action\".\n\nIn the \"Deploy Action\" dialog box, the package \"Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory\" will be selected.\n\nThe clients, which have their Tanium Client directory \"Not Restricted\" will be displayed in the bottom window.\n\nChoose a schedule to deploy the hardening.\n\nUnder \"Targeting Criteria\", in the Action Group, select \"All Computers\" from the drop-down.\n\nClick on \"Deploy Action\".\n\nVerify settings.\n\nClick on \"Show Client Status Details\".","ccis":["CCI-000163"]},{"vulnId":"V-234037","ruleId":"SV-234037r960954_rule","severity":"medium","ruleTitle":"The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.","description":"All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct Man in the Middle (MitM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium.\n\nTanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. before execution will be enforced by Tanium.\n\nSigning will prevent MitM remote code execution attacks and will protect data element in transit. Tanium also supports object level signing for content within the Tanium platform.\n\nSatisfies: SRG-APP-000131, SRG-APP-000219","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"AllQuestionsRequireSignatureFlag\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"AllQuestionsRequireSignatureFlag\" but the value is not \"1\", this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"AllQuestionsRequireSignatureFlag\" for \"Setting Name:\".\n\nEnter \"1\" for \"Setting Value:\".\n\nSelect \"Client\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".","ccis":["CCI-001967","CCI-001749","CCI-001184"]},{"vulnId":"V-234038","ruleId":"SV-234038r1043177_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Endpoints for Client-to-Server communications.","description":"In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology--endpoints in California will form one ring while endpoints in Germany will form a separate ring.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Note: This check is performed for the Tanium Endpoints and must be validated against the HBSS desktop firewall policy applied to the Endpoints.\n\nConsult with the HBSS administration for assistance.\n\nValidate a rule exists within the HBSS HIPS firewall policies for managed clients for the following:\n\nPort Needed: Tanium Clients or Zone Clients over TCP port 17472, bi-directionally.\n\nIf a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\n\nAllow TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network.\n\nIf a network firewall rule does not exist to allow TCP port 17472 from any managed computer to any other managed computer on the same local area network, this is a finding.","fixText":"Configure host-based and network firewall rules as required.","ccis":["CCI-000382"]},{"vulnId":"V-234039","ruleId":"SV-234039r961317_rule","severity":"medium","ruleTitle":"Control of the Tanium Client service must be restricted to SYSTEM access only for all managed clients.","description":"The reliability of the Tanium client's ability to operate depends upon controlling access to the Tanium client service. By restricting access to SYSTEM access only, the non-Tanium system administrator will not have the ability to impact operability of the service.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Scheduled Actions\" tab.\n\nLook for a scheduled action titled \"Client Service Hardening - Allow Only Local SYSTEM to Control Service\".\n\nIf a scheduled action titled \"Client Service Hardening - Allow Only Local SYSTEM to Control Service\" does not exist, this is a finding.\n\nIf the scheduled action exists, select it and if it is not approved (the \"Approve\" button at the top of the section will be displayed if not approved), this is a finding.\n\nIf the scheduled action exists and has been approved but does not restrict control of the Tanium Client service to Allow Only Local SYSTEM to Control Service, this is a finding.\n\nIf the action is not configured to repeat at least once every 24 hours, this is a finding.\n\nIf the scheduled action is not targeted at an \"All Computers\" Action Group, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nFrom the Dashboard, under \"Client Service Hardening\", click on \"Control Service State Permissions\".\n\nThe results will show a \"Count\" of clients matching the \"Service Control is set to default permissions\" query.\n\nSelect the result line for \"Service Control is set to default permissions\".\n\nChoose \"Deploy Action\".\n\nDeployment Package drop-down select \"Client Service Hardening - Allow Only Local SYSTEM to Control Service\".\n\nConfigure the schedule to repeat at least every 24 hours for the requested action.\n\nUnder \"Targeting Criteria\", in the Action Group, select \"All Computers\" from the drop-down.\n\nClick on \"Show preview to continue\".\n\nNon-compliant systems will be displayed at the bottom.\n\nClick on \"Deploy Action\".\n\nVerify settings.\n\nClick on \"Show Client Status Details\".","ccis":["CCI-002165"]},{"vulnId":"V-234040","ruleId":"SV-234040r961317_rule","severity":"medium","ruleTitle":"The ability to uninstall the Tanium Client service must be disabled on all managed clients.","description":"By default, end users have the ability to uninstall software on their clients. In the event the Tanium Client software is uninstalled, the Tanium Server is unable to manage the client and must redeploy to the client. Preventing the software from being displayed in the client's Add/Remove Programs will lessen the risk of the software being uninstalled by non-Tanium System Administrators.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Scheduled Actions\" tab.\n\nLook for a scheduled action titled \"Client Service Hardening - Hide Client from Add-Remove Programs\".\n\nIf a scheduled action titled \"Client Service Hardening - Hide Client from Add-Remove Programs\" does not exist, this is a finding.\n\nIf the scheduled action exists, select it and if it is not approved (the \"Approve\" button at the top of the section will be displayed if not approved), this is a finding.\n\nIf the scheduled action exists and has been approved but does not disable the visibility of the client in Add-Remove Programs, this is a finding.\n\nIf the action is not configured to repeat at least every hour, this is a finding.\n\nIf the scheduled action is not targeted at an \"All Computers\" Action Group, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nFrom the Dashboard, under \"Client Service Hardening\", click on \"Hide From Add-Remove Programs\".\n\nThe results will show a \"Count\" of clients matching the \"Tanium Client Visible in Add-Remove Programs\" query.\n\nSelect the result line.\n\nChoose \"Deploy Action\".\n\nThe \"Deploy Action\" dialog box will display \"Client Service Hardening - Hide Client from Add-Remove Programs\" as the package. The computer names comprising the \"Count\" of non-compliant systems will be displayed in the bottom.\n\nDeployment Package drop-down select \"Client Service Hardening - Hide Client from Add-Remove Programs\".\n\nConfigure the schedule to repeat at least every hour for the requested action.\n\nUnder \"Targeting Criteria\", in the Action Group, select \"All Computers\" from the drop-down.\n\nClick on \"Show preview to continue\". Non-compliant systems will be displayed in the bottom.\n\nClick on \"Deploy Action\".\n\nVerify settings.\n\nClick on \"Show Client Status Details\".","ccis":["CCI-002165"]},{"vulnId":"V-234041","ruleId":"SV-234041r961317_rule","severity":"medium","ruleTitle":"The permissions on the Tanium Client directory must be restricted to only the SYSTEM account on all managed clients.","description":"By restricting access to the Tanium Client directory on managed clients, the Tanium client's ability to operate and function as designed will be protected from malicious attack and unintentional modifications by end users.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Scheduled Actions\" tab.\n\nLook for a scheduled action titled \"Client Service Hardening - Set SYSTEM only permissions on the Tanium Client directory\".\n\nIf a scheduled action titled \"Client Service Hardening - Set SYSTEM only permissions on the Tanium Client directory\" does not exist, this is a finding.\n\nIf the scheduled action exists, select it and if it is not approved (the \"Approve\" button at the top of the section will be displayed if not approved), this is a finding.\n\nIf the scheduled action exists and has been approved but does not disable the visibility of the client in Add-Remove Programs, this is a finding.\n\nIf the action is not configured to repeat at least every hour, this is a finding.\n\nIf the scheduled action is not targeted at an \"All Computers\" Action Group, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nFrom the Dashboard, under \"Client Service Hardening\", click on \"Set Client Directory Permissions\".\n\nThe results will show a \"Count\" of clients' compliant and non-compliant hardening for the \"Tanium Client Directory Permissions\".\n\nNon-compliant clients will have a count other than \"0\" for \"Not Restricted\" or \"Error: No Permissions\".\n\nSelect each of the \"Not Restricted\" or \"Error: No Permissions\" statuses.\n\nSelect \"Deploy Action\".\n\nIn the \"Deploy Action\" dialog box, change the package to \"Client Service Hardening - Set SYSTEM only permissions on the Tanium Client directory\" as the package.\n\nConfigure the schedule to repeat at least every hour for the requested action.\n\nUnder \"Targeting Criteria\", in the Action Group, select \"All Computers\" from the drop-down.\n\nClick on \"Show preview to continue\". Non-compliant systems will be displayed in the bottom.\n\nClick on \"Deploy Action\".\n\nVerify settings.\n\nClick on \"Show Client Status Details\".","ccis":["CCI-002165"]},{"vulnId":"V-234042","ruleId":"SV-234042r961863_rule","severity":"medium","ruleTitle":"Tanium endpoint files must be excluded from on-access antivirus actions.","description":"Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. That is to say that Antivirus, IPS, Encryption, or other security and management stack software may disallow the Client from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the antivirus used on the Tanium clients.\n\nReview the settings of the antivirus software.\n\nValidate exclusions exist which exclude the Tanium program files from being scanned by antivirus on-access scans.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement exclusion policies within the antivirus software solution to exclude the on-access scanning of Tanium client program files.","ccis":["CCI-000366"]},{"vulnId":"V-234043","ruleId":"SV-234043r961863_rule","severity":"medium","ruleTitle":"The Tanium Client Deployment Tool (CDT) must not be configured to use the psexec method of deployment.","description":"When using the Tanium Client Deployment Tool (CDT), using psexec represents an increased vulnerability as the NTLM hash and clear text passwords of the authenticating user is exposed in the memory of the remote system.\n\nTo mitigate this vulnerability, the psexec method of deployment must not be used.","checkContent":"Access the Tanium Module Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nNavigate to Program Files(x86) >> Tanium >> Tanium Client Deployment Tool.\n\nIf the file \"psexec.exe\" exists, this is a finding.","fixText":"Access the Tanium Module Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nNavigate to Program Files(x86) >> Tanium >> Tanium Client Deployment Tool.\n\nRemove the file \"psexec.exe\".","ccis":["CCI-000366"]},{"vulnId":"V-234044","ruleId":"SV-234044r961863_rule","severity":"medium","ruleTitle":"Tanium endpoint files must be protected from file encryption actions.","description":"Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. That is to say that Antivirus, Encryption, or other security and management stack software may disallow the Client from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the file-based encryption software used on the Tanium clients.\n\nReview the settings for the file-based encryption software.\n\nValidate exclusions exist which exclude the Tanium program files from being encrypted by the file-based encryption software.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement excluding policies within the file-based encryption software solution to exclude the file level encryption of the Tanium client program files.","ccis":["CCI-000366"]},{"vulnId":"V-234045","ruleId":"SV-234045r961152_rule","severity":"medium","ruleTitle":"The Tanium application must restrict the ability of individuals to place too much impact upon the network, which might result in a Denial of Service (DoS) event on the network by using RandomSensorDelayInSeconds.","description":"DoS is a condition where a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nIndividuals of concern can include hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyberattacks on third-parties.\n\nApplications and application developers must take the steps needed to ensure users cannot use an authorized application to launch DoS attacks against other systems and networks. For example, applications may include mechanisms that throttle network traffic so users are not able to generate unlimited network traffic via the application. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks.\n\nThe methods employed to counter this risk will be dependent upon the application layer methods that can be used to exploit it.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI). \n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"RandomSensorDelayInSeconds\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"RandomSensorDelayInSeconds\", but do not match the defined value in the system documentation, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"RandomSensorDelayInSeconds\" for \"Setting Name:\".\n\nConsult with a Tanium TAM for an appropriate value for a given network.\n\nEnter the value for \"Setting Value:\".\n\nSelect \"Clients\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nDocument the value for later use.","ccis":["CCI-001094"]},{"vulnId":"V-234046","ruleId":"SV-234046r961863_rule","severity":"medium","ruleTitle":"Tanium endpoint files must be excluded from host-based intrusion prevention intervention.","description":"Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. Antivirus, IPS, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the HIPS software used on the Tanium Clients.\n\nReview the settings of the HIPS software.\n\nValidate exclusions exist which exclude the Tanium program files from being restricted by HIPS.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement exclusion policies within the HIPS software solution to exclude the Tanium client program files from HIPS intervention.","ccis":["CCI-000366"]},{"vulnId":"V-234047","ruleId":"SV-234047r960738_rule","severity":"medium","ruleTitle":"The Tanium application must retain the session lock until the user reestablishes access using established identification and authentication procedures.","description":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system, but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined. This is typically determined and performed at the operating system-level, but in some instances it may be at the application-level.\n\nRegardless of where the session lock is determined and implemented, once invoked the session lock shall remain in place until the user re-authenticates. No other system or application activity aside from re-authentication shall unlock the system.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the value for REG_DWORD \"ForceSOAPSSLClientCert\" is set to \"1\".\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the following keys exist and are configured:\nREG_SZ \"ClientCertificateAuthField\"\n\nFor example: \nX509v3 Subject Alternative Name.\n\nREG_SZ \"ClientCertificateAuthRegex\"\n\nFor example-DoD:\n.*\\:\\s*([^@]+)@.*\n$Note: This regedit should be valid for any Subject Alternative Name entry.\n\nREG_SZ \"ClientCertificateAuth\"\nNote: This registry value defines which certificate file to use for authentication.\n\nFor example:\nC:\\Program Files\\Tanium\\Tanium Server\\dod.pem\n\nREG_SZ \"cac_ldap_server_url\"\n\nNote: This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging in. It must use the syntax similar to LDAP://<AD instance FQDN>\n\nIf the value for REG_DWORD \"ForceSOAPSSLClientCert\" is not set to \"1\" and the remaining registry values are not configured, this is a finding.","fixText":"Use the vendor documentation titled \"Reference: Smartcard authentication\" to implement correct configuration settings for this requirement. If assistance is required, contact the Tanium Technical Account Manager (TAM).\n\nVendor documentation can be downloaded from the following URL: https://docs.tanium.com/platform_install/platform_install/reference_smart_card_authentication.html.","ccis":["CCI-000060"]},{"vulnId":"V-234048","ruleId":"SV-234048r961131_rule","severity":"medium","ruleTitle":"The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions.","description":"By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational responsibility of the System Administrator for the Windows Operation System Active Directory.\n\nSatisfies: SRG-APP-000233, SRG-APP-000317","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console, then click on \"Configuration\".\n\nClick the down arrow to view Apps.\n\nFind \"LDAP Sync\".\n\nVerify a sync exists under \"Enabled Servers\".\n\nIf no sync exists, this is a finding.\n\nIf sync exists under \"Disabled Servers\", this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console, then click on \"Configuration\".\n\nClick the down arrow to view Apps.\n\nFind \"LDAP Sync\".\n\nClick \"Add Server\".\n\nComplete the settings using guidance from https://docs.tanium.com/platform_user/platform_user/console_using_ldap.html.\n\nClick \"Show Preview to Continue\".\n\nReview the users and groups to be imported.\n\nSave the configuration.","ccis":["CCI-001084","CCI-002142"]},{"vulnId":"V-234049","ruleId":"SV-234049r1043176_rule","severity":"medium","ruleTitle":"The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.","description":"By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational responsibility of the System Administrator for the Windows Operation System Active Directory.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nConsult with the Tanium System Administrator to review the documented list of Tanium users.\n\nCompare the list of Tanium users versus the users found in the appropriate Active Directory security groups for the User Roles.\n\nIf there are any console users who are listed in the Tanium console that are not found in a synced Active Directory security group, this is a finding.\n\nAlternatively, the ISSO can document the non-synced Active Directory security group users and accept the risk for the users.\n\nIf this is the case, this would no longer be a finding.","fixText":"Consult with the Tanium System Administrator to review the documented list of Tanium users.\n\nCompare the list of Tanium users versus the users found in the appropriate Active Directory security groups for the User Roles.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nAny users populated manually, select the user's name, and then click on the \"\"trashcan\"\" icon at the top of the console to delete this user.\n\nNote: Consult with the Tanium System Administrator before deleting any user accounts to ensure any scheduled actions or other content is reassigned to another user. This will prevent any potential issues arising from the deletion of a user.","ccis":["CCI-000015"]},{"vulnId":"V-234050","ruleId":"SV-234050r960792_rule","severity":"medium","ruleTitle":"Tanium Computer Groups must be used to restrict console users from affecting changes to unauthorized computers.","description":"Computer Groups allow a site running Tanium to assign responsibility of specific Computer Groups to specific Tanium console users. By doing so, a desktop administrator, for example, will not have the ability to enforce an action against a high visibility server.\n\nFor large sites, it is crucial to have the Computer Groups and while a smaller site might not seem to require Computer Groups, creating them provides for a cleaner implementation. All sites will be required to have some kind of Computer Groups configured other than the default \"All Computers\".","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Computer Groups\" tab.\n\nUnder the \"Name\" column, verify specific groups exist other than the default \"All Computers\" and \"No Computers\".\n\nIf site or organization specific computer groups do not exist, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Server, access the Tanium Server web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Computer Groups\" tab.\n\nConfigure specific Computer Groups in order to facilitate the management of computers by authorized individuals for those computers.\n\nNote: Tanium offers two ways to define computer groups. Refer to documentation for explanation found here: https://docs.tanium.com/platform_user/platform_user/console_computer_groups.html#Computer_Group_types.\n\nNote: Active Directory Computer Groups may also be used to sync with Tanium Computer Groups as a means to satisfy this requirement.","ccis":["CCI-000213"]},{"vulnId":"V-234051","ruleId":"SV-234051r960792_rule","severity":"medium","ruleTitle":"Documentation identifying Tanium console users, their respective functional roles, and computer groups must be maintained.","description":"System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate functional role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.\n\nWhen using Active Directory synchronization, as is required by this STIG, User Roles assignments are via the LDAP Sync.\n\nTo change a Tanium user's functional role, their Active Directory account needs to be assigned to the AD security group, which correlates with the applicable functional role.","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium users. The users' functional roles, computer groups, and correlated Active Directory security groups must be documented.\n\nIf the site does not have the Tanium users and their respective functional roles, computer groups, and correlated Active Directory security groups documented, this is a finding.","fixText":"Prepare and maintain documentation identifying the Tanium console users and their respective User Roles and AD security groups.","ccis":["CCI-000213"]},{"vulnId":"V-234052","ruleId":"SV-234052r960792_rule","severity":"high","ruleTitle":"Role-based system access must be configured to least privileged access to Tanium Server functions through the Tanium interface.","description":"User accessibility to various Tanium Server functions performed via the console can be restricted by functional roles, a combination of User Role(s), and Content Set(s) assigned through User Group membership. Functional roles are assigned to users via Active Directory Group membership.\n\nSystem access should be reviewed periodically to verify that all Tanium users are assigned the appropriate functional role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Consider removing users that have not logged onto the system within a predetermined time frame.","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium users.\n\nAnalyze the users configured in the Tanium interface.\n\nReview the users' respective approved roles, as well as the correlated Active Directory Group for the Tanium functional roles.\n\nValidate Active Directory Groups/Tanium functional roles are documented to assign least privileged access to the functions of the Tanium Server through the Tanium interface.\n\nIf the documentation does not reflect a granular, least privileged access approach to the Active Directory Groups/Tanium functional roles assignment, this is a finding.","fixText":"Analyze the users configured in the Tanium interface.\n\nDetermine least privileged access required for each user to perform their respective duties.\n\nMove users to the appropriate Active Directory Group in order to ensure the user is synced to the appropriate Tanium functional role.\n\nIf appropriate Active Directory Groups are not already configured, create the Groups and add the appropriate users.\n\nEnsure LDAP sync repopulates the Tanium Users' associated functional roles accordingly.","ccis":["CCI-000213"]},{"vulnId":"V-234053","ruleId":"SV-234053r960792_rule","severity":"medium","ruleTitle":"Tanium console users User Roles must be validated against the documentation for User Roles.","description":"System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.\n\nWhen using Active Directory synchronization, as is required by this STIG, User Roles assignments are via the LDAP Sync, AD security groups correlate, one to one, to Tanium User Roles.\n\nTo change a Tanium user's User Role, their Active Directory account needs to be moved to the AD security group, which correlates with the applicable User Role.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nVerify each user against the Tanium-approved users list.\n\nReview the assigned roles for each user against the \"User Functional Role\" column.\n\nIf any user exists in Tanium but is not on the Tanium-approved users list and/or if any user exists in Tanium at a more elevated User Functional Role than that documented on the list, this is a finding.","fixText":"When using Active Directory synchronization, as is required by this STIG, User Roles assignments are assigned by LDAP sync. AD security groups correlate, one to one, to Tanium User Roles.\n\nTo change a Tanium user's User Functional Role, their Active Directory account needs to be moved to the AD security group, which correlates with the applicable User Functional Role.\n\nAccess the Active Directory server.\n\nLocate the account(s), which have been determined to have the incorrect User Functional Roles in Tanium.\n\nReview the Tanium-related AD Security Groups to which the user account(s) belong that directly correlate to the incorrect Tanium User Functional Roles.\n\nRemove the user account(s) from the incorrect Tanium User Roles, ensuring the user account(s) are still members of the Tanium-related AD Security Groups for which they have been documented to be authorized.","ccis":["CCI-000213"]},{"vulnId":"V-234054","ruleId":"SV-234054r960792_rule","severity":"medium","ruleTitle":"Documentation identifying Tanium console users and their respective Computer Group rights must be maintained.","description":"System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium users and their respective, approved Computer Group rights.\n\nIf the documented list does not have the Tanium users and their respective, approved Computer Group rights documented, this is a finding.","fixText":"Prepare and maintain documentation identifying the Tanium console users and their respective Computer Group rights.","ccis":["CCI-000213"]},{"vulnId":"V-234055","ruleId":"SV-234055r960792_rule","severity":"medium","ruleTitle":"Tanium console users Computer Group rights must be validated against the documentation for Computer Group rights.","description":"System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nVerify each user against the approved users list.\n\nReview the assigned Computer Groups for each user by selecting the user then clicking view user.\n\nView Computer Groups for the user.\n\nIf any user exists in Tanium but is not on the Tanium-approved users list and/or if any user exists in Tanium with more Computer Groups than documented, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nFor any user(s) in Tanium, which is not on the approved, documented Tanium user list, access Microsoft Windows Active Directory Management.\n\nRemove, the respective user(s) from the AD Security Group in which those user(s) are members.\n\nFor any user in Tanium which has not been assigned one or more Computer Groups as has been documented in the Computer Groups list, access the Microsoft Windows Active Directory Management.\n\nAdd the respective user(s) to the AD Security Groups applicable for the functional roles for which the user(s) have been documented to be authorized.\n\nClick \"Save\".","ccis":["CCI-000213"]},{"vulnId":"V-234056","ruleId":"SV-234056r960972_rule","severity":"high","ruleTitle":"Common Access Card (CAC)-based authentication must be enabled on the Tanium Server for network access with privileged accounts.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following:\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\n\nThis not only meets a common requirement in the Federal space but adds a critical layer of security to the user authentication process.\n\nSatisfies: SRG-APP-000149, SRG-APP-000151","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the value for REG_DWORD \"ForceSOAPSSLClientCert\" is set to \"1\".\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the following keys exist and are configured:\n\nREG_SZ \"ClientCertificateAuthField\"\n\nFor example:\n\nX509v3 Subject Alternative Name.\n\nREG_SZ \"ClientCertificateAuthRegex\"\n\nFor example-DoD:\n\n.*\\:\\s*([^@]+)@.*\n\n$Note: This regedit should be valid for any Subject Alternative Name entry.\n\nREG_SZ \"ClientCertificateAuth\"\n\nNote: This registry value defines which certificate file to use for authentication.\n\nFor example:\n\nC:\\Program Files\\Tanium\\Tanium Server\\dod.pem\n\nREG_SZ \"cac_ldap_server_url\"\n\nNote: This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging on. It must use the syntax similar to LDAP://<AD instance FQDN>.\n\nIf the value for REG_DWORD \"ForceSOAPSSLClientCert\" is not set to \"1\" and the remaining registry values are not configured, this is a finding.","fixText":"Use the vendor documentation titled \"Reference: Smart card authentication\" to implement correct configuration settings for this requirement.\n\nIf assistance is required, contact the Tanium Technical Account Manager (TAM).\n\nVendor documentation can be downloaded from the following URL:\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_smart_card_authentication.html.","ccis":["CCI-000765","CCI-000767"]},{"vulnId":"V-234057","ruleId":"SV-234057r961470_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Server for Console-to-Server communications.","description":"An HTML5 based application, the Tanium Console runs from any device with a browser that supports HTML5. For security, the HTTP and SOAP communication to the Tanium Server is SSL encrypted, so the Tanium Server installer configures the server to listen for HTTP and SOAP requests on port 443. Without a proper connection to the Tanium Server, access to the system capabilities could be denied.\n\nPort Needed: To Tanium Server over TCP port 443.\n\nNetwork firewall rules:\n\nAllow HTTP traffic on TCP port 443 from any computer on the internal network to the Tanium Server device.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server.\n\nAccess the host-based firewall configuration on the Tanium Server.\n\nValidate a rule exists for the following:\nPort Needed: From only designated Tanium console user clients to Tanium Server over TCP port 443.\n\nIf a host-based firewall rule does not exist to allow only designated Tanium console user clients to Tanium Server over TCP port 443, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\nAllow TCP traffic from only designated Tanium console user clients to Tanium Server over TCP ports 443.\n\nIf a network firewall rule does not exist to allow traffic from only designated Tanium console user clients to Tanium Server over TCP port 443, this is a finding.","fixText":"Configure host-based firewall rules on the Tanium Server to include the following required traffic:\n\nAllow TCP traffic on port 433 to the Tanium Server from designated Tanium console user clients.\n\nConfigure the network firewall to allow the above traffic.","ccis":["CCI-001762"]},{"vulnId":"V-234058","ruleId":"SV-234058r960849_rule","severity":"medium","ruleTitle":"The publicly accessible Tanium application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.","description":"Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreem't.\"\n\nSatisfies: SRG-APP-000070, SRG-APP-000068, SRG-APP-000069","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nIf a DoD-approved use notification banner does not display prior to logon, this is a finding.","fixText":"Create an .html file composed of the DoD-authorized warning banner verbiage.\n\nName the file \"warning_banner.html\".\n\nCopy the .html file to the Tanium Server’s http folder.\n\nUsing a web browser on a system that has connectivity to the Tanium Server, access the Tanium Server web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"console_PreLoginBannerHTML\" for \"Setting Name:\".\n\nEnter \"warning_banner.html\" for \"Setting Value:\".\n\nEnter Server for \"Affects:\".\n\nEnter Text for \"Value Type:\".\n\nClick \"Save\".","ccis":["CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388","CCI-000048","CCI-000050"]},{"vulnId":"V-234059","ruleId":"SV-234059r960912_rule","severity":"medium","ruleTitle":"Tanium must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Sources.\n\nIf no \"Sources\" exist to send audit logs from the Tanium SQL Server to a SIEM tool, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure \"Sources\" to send audit logs from the Tanium SQL Server to a SIEM tool.\n\nWork with the SIEM administrator to configure an alert when no audit data is received from Tanium based on the defined schedule of connections.","ccis":["CCI-000139"]},{"vulnId":"V-234060","ruleId":"SV-234060r961176_rule","severity":"medium","ruleTitle":"Flaw remediation Tanium applications must employ automated mechanisms to determine the state of information system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).","description":"Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the system components may remain vulnerable to the exploits presented by undetected software flaws.\n\nTo support this requirement, the flaw remediation application may have automated mechanisms that perform automated scans for security-relevant software updates (e.g., patches, service packs, and hot fixes) and security vulnerabilities of the information system components being monitored. For example, a method of compliance would be an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools as specified in the requirement.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Scheduled Actions\" tab.\n\nLook for a scheduled action targeting all machines that is titled either \"Patch - Distribute Scan Configuration\" or \"Patch Management - Run Patch Scan\".\n\nIf there is no Scheduled Action for patching or the Scheduled Action is less frequent than every \"30\" days, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Scheduled Actions\" tab.\n\nLook for a scheduled action targeting all machines that is titled either \"Patch - Distribute Scan Configuration\" or \"Patch Management - Run Patch Scan\".\n\nMake sure the action is enabled, and configure it to reissue at a minimum, every \"30\" days.","ccis":["CCI-001233"]},{"vulnId":"V-234061","ruleId":"SV-234061r961209_rule","severity":"medium","ruleTitle":"Tanium must notify SA and ISSO when accounts are created.","description":"Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail, which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources.\n\nIf no sources exists to send audit logs from Tanium to a SIEM tool or Email Destination, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when accounts are created.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure sources to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination.\n\nWork with Email administrator to configure Email destination.\n\nWork with the SIEM administrator to configure an alert when accounts are created.","ccis":["CCI-001683"]},{"vulnId":"V-234062","ruleId":"SV-234062r961212_rule","severity":"medium","ruleTitle":"Tanium must notify SA and ISSO when accounts are modified.","description":"Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. Notification of account modification is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail, which documents the creation of application user accounts and notifies administrators and Information System Security Officers (ISSO) exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources.\n\nIf no sources exists to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when accounts are modified.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure a source to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination.\n\nWork with Email administrator to configure Email destination.\n\nWork with the SIEM administrator to configure an alert when accounts are modified.","ccis":["CCI-001684"]},{"vulnId":"V-234063","ruleId":"SV-234063r961293_rule","severity":"medium","ruleTitle":"The Tanium application must notify SA and ISSO of account enabling actions.","description":"Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure the existence of an audit trail, which documents the creation of application user accounts and notifies administrators and ISSOs. Such a process greatly reduces the risk that accounts will be surreptitiously enabled and provides logging that can be used for forensic purposes.\n\nIn order to detect and respond to events that affect user accessibility and application processing, applications must audit account enabling actions and, as required, notify the appropriate individuals so they can investigate the event.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources.\n\nIf no sources exists to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when account-enabling actions are performed.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure sources to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination.\n\nWork with Email administrator to configure Email destination.\n\nWork with the SIEM administrator to configure an alert when account-enabling actions are performed.","ccis":["CCI-002132"]},{"vulnId":"V-234064","ruleId":"SV-234064r961398_rule","severity":"medium","ruleTitle":"The Tanium application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.","description":"If security personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion.","checkContent":"Consult with the Tanium system administrator or database administrator to determine the volume on which the Tanium SQL databases are installed.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Sources.\n\nIf none exist to send Disk Free Space of the Tanium SQL Server, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when Disk Free Space of the Tanium SQL Server reaches below 25%.\n\nIf there is no alert configured, this is a finding.","fixText":"Consult with the Tanium system administrator or database administrator to determine the volume on which the Tanium SQL databases are installed.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Interact\".\n\nEnter \"Get Disk Free Space from all machines with Computer Name containing \"[Your SQL Computer Name].\n\nPress \"Enter\".\n\nSelect \"Save this question\" located under the Question box.\n\nEnter a name (e.g., SQL Disk Free Space).\n\nSelect \"Create Saved Question\".\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nSelect \"Create Connection\".\n\nIn the Sources and Destination section, select \"Saved Question\" from the drop-down menu.\n\nEnter the \"Saved Question Name\" created above or select from the drop-down menu.\n\nSelect the \"Computer Group\" name from the drop-down menu.\n\nSelect the desired destination from the drop-down menu (must be a SIEM tool).\n\nIn the General Information section, provide a name and description.\n\nSelect \"Create Connection\" at bottom of the page.\n\nWork with the SIEM administrator to configure an alert when Disk Free Space of the Tanium SQL Server reaches below 25% of maximum.","ccis":["CCI-001855"]},{"vulnId":"V-234065","ruleId":"SV-234065r961401_rule","severity":"medium","ruleTitle":"The Tanium enterprise audit log reduction option must be configured to provide alerts based off Tanium audit data.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\n\nAlerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Tanium Sources listed.\n\nIf an \"Audit Log\" source does not exist, this is a finding.\n\nSelect the \"Audit Log\" source.\n\nSelect the audit connection found in the lower half of the screen.\n\nVerify the \"Destination Type\" is a SIEM tool.\n\nIf the \"Destination Type\" is not a SIEM tool, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nClick \"Create Connection\".\n\nIn the Source and Destination Section, select \"Audit Log\" as the Event Source from the drop-down menu.\n\nIn the \"Destination\" section, select \"Socket Receiver\" from the drop-down menu.\n\nEnter \"Destination Name\".\n\nEnter \"Host\".\n\nEnter \"Network Protocol\".\n\nEnter \"Port\".\n\nConsult documentation located at https://docs.tanium.com/connect/connect/index.html for reference on configuring other applicable SIEM connections.\n\nWork with the SIEM administrator to configure alerts based on audit failures.","ccis":["CCI-001858"]},{"vulnId":"V-234066","ruleId":"SV-234066r1051115_rule","severity":"medium","ruleTitle":"Common Access Card (CAC)-based authentication must be enabled and enforced on the Tanium Server for all access and all accounts.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following:\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\n\nSatisfies: SRG-APP-000148, SRG-APP-000005, SRG-APP-000150, SRG-APP-000152, SRG-APP-000080, SRG-APP-000156, SRG-APP-000177, SRG-APP-000185, SRG-APP-000186, SRG-APP-000190, SRG-APP-000315, SRG-APP-000316, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the value for REG_DWORD \"ForceSOAPSSLClientCert\" is set to \"1\".\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the following keys exist and are configured:\n\nREG_SZ \"ClientCertificateAuthField\"\n\nFor example:\n\nX509v3 Subject Alternative Name\n\nREG_SZ \"ClientCertificateAuthRegex\"\n\nFor example-DoD:\n\n.*\\:\\s*([^@]+)@.*\n\n$Note: This regedit should be valid for any Subject Alternative Name entry.\n\nREG_SZ \"ClientCertificateAuth\"\n\nNote: This registry value defines which certificate file to use for authentication.\n\nFor example:\n\nC:\\Program Files\\Tanium\\Tanium Server\\dod.pem\n\nREG_SZ \"cac_ldap_server_url\"\n\nNote: This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging on. It must use the syntax similar to LDAP://<AD instance FQDN>.\n\nIf the value for REG_DWORD \"ForceSOAPSSLClientCert\" is not set to \"1\" and the remaining registry values are not configured, this is a finding.","fixText":"Use the vendor documentation titled \"Reference: Smart card authentication\" to implement correct configuration settings for this requirement.\n\nIf assistance is required, contact the Tanium Technical Account Manager (TAM).\n\nVendor documentation can be downloaded from the following URL:\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_smart_card_authentication.html.","ccis":["CCI-000056","CCI-000166","CCI-000187","CCI-000768","CCI-000766","CCI-000767","CCI-000764","CCI-000765","CCI-001133","CCI-000877","CCI-000879","CCI-001941","CCI-001953","CCI-001954","CCI-002009","CCI-002010","CCI-002314","CCI-002322"]},{"vulnId":"V-234067","ruleId":"SV-234067r961215_rule","severity":"medium","ruleTitle":"Tanium must notify SA and ISSO for account disabling actions.","description":"When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying the application processes themselves.\n\nIn order to detect and respond to events that affect user accessibility and application processing, applications must audit account disabling actions and, as required, notify the appropriate individuals so they can investigate the event. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources.\n\nIf no sources exists to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when accounts are disabled.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure sources to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination.\n\nWork with Email administrator to configure Email destination.\n\nWork with the SIEM administrator to configure an alert when accounts are disabled.","ccis":["CCI-001685"]},{"vulnId":"V-234068","ruleId":"SV-234068r961218_rule","severity":"medium","ruleTitle":"Tanium must notify SA and ISSO for account removal actions.","description":"When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying individual application users or for identifying the application processes themselves.\n\nIn order to detect and respond to events that affect user accessibility and application processing, applications must audit account removal actions and, as required, notify the appropriate individuals so they can investigate the event. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured sources.\n\nIf no sources exists to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination, this is a finding.\n\nWork with the SIEM administrator to determine if an alert is configured when accounts are deleted.\n\nIf there is no alert configured, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nConfigure sources to send audit logs from the Tanium SQL Server to a SIEM tool or Email Destination.\n\nWork with Email administrator to configure Email destination.\n\nWork with the SIEM administrator to configure an alert when accounts are deleted.","ccis":["CCI-001686"]},{"vulnId":"V-234069","ruleId":"SV-234069r961455_rule","severity":"medium","ruleTitle":"The Tanium application must prohibit user installation of software without explicit privileged status.","description":"Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.\n\nApplication functionality will vary, and while users are not permitted to install unapproved applications, there may be instances where the organization allows the user to install approved software packages such as from an approved software repository.\n\nThe application must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization.\n\nThis requirement applies, for example, to applications that provide the ability to extend application functionality (e.g., plug-ins, add-ons) and software management applications.\n\nSatisfies: SRG-APP-000378, SRG-APP-000380, SRG-APP-000121, SRG-APP-000122, SRG-APP-000123","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium users.\n\nReview the users' respective approved roles, as well as the correlated Active Directory security group for the User Roles.\n\nValidate Active Directory security groups/Tanium roles are documented to assign least privileged access to the functions of the Tanium Server through the Tanium interface.\n\nIf the documentation does not reflect a granular, least privileged access approach to the Active Directory Groups/Tanium Roles assignment, this is a finding.","fixText":"Analyze the users configured in the Tanium interface.\n\nDetermine least privileged access required for each user to perform their respective duties.\n\nMove users to the appropriate Active Directory security group in order to ensure the user is synced to the appropriate Tanium User Role.\n\nIf the appropriate Active Directory security groups are not already configured, create the groups and add the appropriate users.\n\nEnsure LDAP sync repopulates the Tanium Users' associated Roles accordingly.","ccis":["CCI-001493","CCI-001494","CCI-001495","CCI-001812","CCI-001813"]},{"vulnId":"V-234070","ruleId":"SV-234070r960792_rule","severity":"medium","ruleTitle":"Documentation defining Tanium functional roles must be maintained.","description":"System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.","checkContent":"Consult with the Tanium System Administrator to review the documented list of Tanium functional roles. \n\nIf the documentation does not define functional roles, this is a finding.","fixText":"Consult with the Tanium System Administrator to review the documented list of Tanium functional roles. \n\nIf the documentation does not define functional roles, this is a finding.","ccis":["CCI-000213"]},{"vulnId":"V-234071","ruleId":"SV-234071r961302_rule","severity":"medium","ruleTitle":"The Tanium database(s) must be installed on a separate system.","description":"Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries, limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases, and notifying organizational personnel when atypical database queries or accesses occur.","checkContent":"Consult with the Tanium System Administrator to determine the server to which the database has been installed and is configured.\n\nIf the customer is using a Tanium Appliance, this is Not Applicable.\n\nIf the database is installed on the same server as the Tanium Server or Tanium Module Server, this is a finding.","fixText":"Move the Tanium database from the Tanium Server or Tanium Module Server to a separate server.","ccis":["CCI-002346"]},{"vulnId":"V-234072","ruleId":"SV-234072r961302_rule","severity":"medium","ruleTitle":"The Tanium application database must be dedicated to only the Tanium application.","description":"Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.","checkContent":"With the Tanium System Administrator's assistance, access the server on which the Tanium database(s) is installed.\n\nReview the Tanium database(s).\n\nIf databases related to products other than Tanium exist in the Tanium database, this is a finding.","fixText":"Move the Tanium database from the server hosting multiple databases for products other than Tanium or remove other product databases co-located with Tanium database(s).","ccis":["CCI-002346"]},{"vulnId":"V-234073","ruleId":"SV-234073r961464_rule","severity":"medium","ruleTitle":"The access to the Tanium SQL database must be restricted. Only the designated database administrator(s) can have elevated privileges to the Tanium SQL database.","description":"After the Tanium Server has been installed and the Tanium databases created, only the Tanium Receiver, Tanium Module, and Tanium connection manager (ad sync) service needs to access the SQL Server database.","checkContent":"Access the Tanium SQL server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen SQL Server Management Studio.\n\nConnect to a Tanium instance of SQL Server.\n\nIn the left pane, click \"Databases\". \n\nSelect the Tanium database. \n\nClick \"Security\". \n\nClick \"Users\".\n\nIn the \"Users\" pane, review the roles assigned to the user accounts. (Note: This does not apply to service accounts.)\n\nIf any user account has an elevated privilege role other than the assigned database administrators, this is a finding.","fixText":"Access the Tanium SQL server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen SQL Server Management Studio.\n\nConnect to a Tanium instance of SQL Server.\n\nIn the left pane, click \"Databases\". \n\nSelect the Tanium database. \n\nClick \"Security\". \n\nClick \"Users\".\n\nIn the \"Users\" pane, review the roles assigned to the user accounts.\n\nFor any user accounts with elevated privileges, reduce the role assigned to a least privileged role.","ccis":["CCI-001814"]},{"vulnId":"V-234074","ruleId":"SV-234074r961464_rule","severity":"medium","ruleTitle":"The Tanium Server installers account database permissions must be reduced to an appropriate level.","description":"Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have been created, the Tanium Server and Apache services must be configured to execute under an account that holds at least the dbo role on both databases.\n\nPost-installation, if the account used to configure the Tanium Server services to access the remote SQL database server holds only the Database Owner role, rather than the sysadmin role, consider granting this account the View Server State permission on the SQL Server. While not strictly necessary, this dynamic management view enables the Tanium Server to access data faster than the dbo role alone.","checkContent":"Access the Tanium SQL server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen SQL Server Management Studio.\n\nConnect to Tanium instance of SQL Server.\n\nIn the left pane, click \"Databases\". \n\nSelect the Tanium database. \n\nClick \"Security\". \n\nClick \"Users\".\n\nIn the \"Users\" pane, review the role assigned to the Tanium Server service user account.\n\nIf the role assigned to the Tanium Server service account is not \"db_owner\", this is a finding.\n\nIf using Postgres:\n\nOnly owners of objects can change them. To view all functions, triggers, and trigger procedures, their ownership and source, as the database administrator (shown here as \"postgres\") run the following SQL:\n\n$ sudo su - postgres\n$ psql -x -c \"\\df+\"","fixText":"Access the Tanium SQL server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen SQL Server Management Studio.\n\nConnect to Tanium instance of SQL Server.\n\nIn the left pane, click \"Databases\". \n\nSelect the Tanium database. \n\nClick \"Security\". \n\nClick \"Users\". \n\nIn the \"Users\" pane, right-click the Tanium Server service user account.\n\nOn the shortcut menu, click \"Properties\".\n\nUnder Database role membership, change role from \"sysadmin\" to \"db_owner\".\n\nClick \"OK\".\n\nIf using Postgres:\n\nConfigure PostgreSQL to enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).\n\nUse ALTER ROLE to remove accesses from roles:\n\n$ psql -c \"ALTER ROLE <role_name> NOSUPERUSER\"","ccis":["CCI-001814"]},{"vulnId":"V-234075","ruleId":"SV-234075r961470_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Server for Server-to-Database communications.","description":"The Tanium Server can use either a SQL Server RDBMS installed locally to the same device as the Tanium Server application or a remote dedicated or shared SQL Server instance. Using a local SQL Server database typically requires no changes to network firewall rules since all communication remains on the Tanium application server device. To access database resources installed to a remote device, however, the Tanium Server service communicates over the port reserved for SQL, by default port 1433, to the database.\n\nPort Needed: Tanium Server to Remote SQL Server over TCP port 1433.\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 1433 from the Tanium Server device to the remote device hosting the SQL Server RDBMS.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server.\n\nAccess the host-based firewall configuration on the Tanium Server.\n\nValidate a rule exists for the following:\nPort Needed: Tanium Server to Remote SQL Server over TCP port 1433.\n\nIf a host-based firewall rule does not exist to allow Tanium Server to Remote SQL Server over TCP port 1433, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\nAllow traffic from Tanium Server to Remote SQL Server over TCP port 1433.\n\nIf a network firewall rule does not exist to allow traffic from Tanium Server to Remote SQL Server over TCP port 1433, this is a finding.","fixText":"Configure host-based firewall rules on the Tanium Server to include the following required traffic:\n\nAllow TCP traffic on port 1433 from the Tanium Server to the Remote SQL Server.\n\nConfigure the network firewall to allow the above traffic.","ccis":["CCI-001762"]},{"vulnId":"V-234076","ruleId":"SV-234076r961677_rule","severity":"medium","ruleTitle":"SQL stored queries or procedures installed during Tanium installation must be removed from the Tanium Server.","description":"Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nIf any SQL stored queries (.sql files) or procedures are found, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nRemove the SQL stored queries (.sql files) or procedures from the folder.","ccis":["CCI-002617"]},{"vulnId":"V-234077","ruleId":"SV-234077r961602_rule","severity":"medium","ruleTitle":"The Tanium Server must protect the confidentiality and integrity of transmitted information, in preparation to be transmitted and data at rest, with cryptographic signing capabilities enabled to protect the authenticity of communications sessions when making requests from Tanium Clients.","description":"Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.\n\nSatisfies: SRG-APP-000429, SRG-APP-000440, SRG-APP-000441","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"ReportingTLSMode\". Enter.\n\nIf no results are returned, this is a finding.\n\nIn the \"Show Settings Containing:\" search box type \"StateProtectedFlag\". Enter.\n\nIf no results are returned or \"StateProtectedFlag = 0\", this is a finding.\n\nIf results are returned for \"ReportingTLSMode\" but the value is \"0\", this is a finding.","fixText":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog window to the right, enter \"ReportingTLSMode\" for \"Setting Name:\".\n\nEnter \"2\" for \"Setting Value:\".\n\nSelect \"Client\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".   \nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog window to the right, enter \"StateProtectedFlag\" for \"Setting Name:\".\n\nEnter \"1\" for \"Setting Value:\".\n\nSelect \"Client\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".","ccis":["CCI-002420","CCI-002421","CCI-002476"]},{"vulnId":"V-234078","ruleId":"SV-234078r960741_rule","severity":"medium","ruleTitle":"The Tanium Application Server console must be configured to initiate a session lock after a 15-minute period of inactivity.","description":"The Tanium Console, when CAC is enabled, will initiate a session lock based upon the ActivClient or other Smart Card software.\n\nBy initiating the session lock, the console will be locked and not allow unauthorized access by anyone other than the original user.\n\nAlthough this setting does not apply when CAC is enabled, it should be explicitly disabled in the event CAC authentication is ever broken or removed.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nAfter logging in, in the top right corner of the UI select the drop down arrow and click on \"Preferences\".\n\nVerify the \"Suspend console automatically if no activity detected for:\" is configured to a value of \"15\" minutes or less.\n\nIf the \"Suspend console automatically if no activity detected for:\" is not configured to a value of \"15\" minutes or less, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with CAC.\n\nAfter logging in, in the top right corner of the UI, select the drop down arrow and click on \"Preferences\".\n\nFor \"Suspend console automatically if no activity detected for:\" select a value of \"15\" minutes or less.\n\nClick \"Save\".","ccis":["CCI-000057"]},{"vulnId":"V-234079","ruleId":"SV-234079r960762_rule","severity":"medium","ruleTitle":"Tanium Trusted Content providers must be documented.","description":"A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console.\n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.","checkContent":"Note: If only using Tanium provided content and not accepting content from any other content providers, this is Not Applicable.\n\nConsult with the Tanium System Administrator to review the documented list of trusted content providers along with the Hash for their respective public keys.\n\nIf the site does not have the Tanium trusted content providers documented along with the SHA-256 Hash for their respective public keys, this is a finding.","fixText":"Prepare and maintain documentation identifying the Tanium trusted content providers along with the SHA-256 Hash from their respective public keys.","ccis":["CCI-001453"]},{"vulnId":"V-234080","ruleId":"SV-234080r960762_rule","severity":"medium","ruleTitle":"Content providers must provide their public key to the Tanium administrator to import for validating signed content.","description":"A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console.\n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.","checkContent":"Note: If only using Tanium provided content and not accepting content from any other content providers, this is Not Applicable.\n\nObtain documentation from the Tanium System Administrator that contains the public key validation data.\n\nAccess the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to the following folder: Program Files >> Tanium >> Tanium Server >> content_public_keys >> content folder.\n\nIf the Tanium default content-release.pub key is the only key in the folder, this is not a finding.\n\nIf there are documented content provider keys in the content folder, this is not a finding.\n\nIf non-documented content provider keys are found in the content folder, this is a finding.","fixText":"Obtain the public key from the content providers and validate the keys are present in the Tanium folders.\n\nIf the public keys are found for non-trusted content providers, remove the associated signing key and remove any content imported by that provider.\n\nAccess the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to the following folder: Program Files >> Tanium >> Tanium Server >> content_public_keys >> content folder.\n\nCopy any Trusted Source's .pub key into the folder and document them.\n\nRemove any non-Trusted Source's .pub keys from the folder.","ccis":["CCI-001453"]},{"vulnId":"V-234081","ruleId":"SV-234081r960762_rule","severity":"medium","ruleTitle":"Tanium public keys of content providers must be validated against documented trusted content providers.","description":"A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console.\n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.","checkContent":"Note: If only using Tanium provided content and not accepting content from any other content providers, this is Not Applicable.\n\nObtain documentation from the Tanium System Administrator that contains the public key validation data.\n\nAccess the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an \"Explorer\" window.\n\nNavigate to the following folder: Program Files >> Tanium >> Tanium Server >> content_public_keys >> content folder.\n\nEnsure the public keys listed in the content folder are documented.\n\nIf a public key, other than the default Tanium public key, resides in the content folder and is not documented, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an \"Explorer\" window.\n\nNavigate to the following folder: Program Files >> Tanium >> Tanium Server >> content_public_keys >> content folder.\n\nIf a public key, other than the default Tanium public key, resides in the content folder, use a hashing utility (e.g., TaniumFileInfo.exe) to determine the hash of the public key.\n\nDocument the owner, the name of the key, and the associated hash of the public key.","ccis":["CCI-001453"]},{"vulnId":"V-234082","ruleId":"SV-234082r960792_rule","severity":"medium","ruleTitle":"The Tanium Action Approval feature must be enabled for two-person integrity when deploying actions to endpoints.","description":"The Tanium Action Approval feature provides a \"four eyes\" control mechanism designed to achieve a high-level of security and reduce the possibility of error for critical operations.\n\nWhen this feature is enabled, an action configured by one Tanium console user will require a second Tanium console user with a role of Action Approver (or higher) to approve the action before it is deployed to targeted computers.\n\nWhile this system slows workflow, the reliability of actions deployed will be greater on the Packaging and Targeting.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console then click on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"require_action_approval\".\n\nClick “Enter”.\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"require_action_approval\", but the value is not \"1\", this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console then click on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIf \"require_action_approval\" does not exist: click on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"require_action_approval\" for \"Setting Name:\".\n\nEnter \"1\" for \"Setting Value:\".\n\nSelect \"Server\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".","ccis":["CCI-000213"]},{"vulnId":"V-234083","ruleId":"SV-234083r960804_rule","severity":"medium","ruleTitle":"The Tanium documentation identifying recognized and trusted Intel streams must be maintained.","description":"An IOC stream is a series or stream of IOCs that are imported from a vendor based on a subscription service. An IOC stream can be downloaded manually or on a scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.","checkContent":"Consult with the Tanium System Administrator to determine if the \"Tanium Detect\" module is being used, if not this is Not Applicable.\n\nReview the documented list of IOC trusted stream sources.\n\nIf the site does use an external source for IOCs and the IOC trusted stream source is not documented, this is a finding.","fixText":"Consult with the Tanium System Administrator to determine if the \"Tanium Detect\" module is being used, if not this is Not Applicable.\n\nPrepare and maintain documentation identifying the Tanium Detect IOC trusted stream sources.","ccis":["CCI-001414"]},{"vulnId":"V-234084","ruleId":"SV-234084r960804_rule","severity":"medium","ruleTitle":"The Tanium Detect must be configured to receive IOC streams only from trusted sources.","description":"An IOC stream is a series or stream of intel that are imported from a vendor based on a subscription service or manually downloaded and placed in a folder. Detect can be configured to retrieve the IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.","checkContent":"Consult with the Tanium System Administrator to determine if the \"Tanium Detect\" module is being used, if not this is Not Applicable.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Detect\".\n\nExpand the left menu.\n\nClick the \"Management\" tab.\n\nSelect \"Sources\".\n\nVerify all configured Detect Streams are configured to a documented trusted source.\n\nIf any configured Detect Stream is configured to a stream that has not been documented as trusted, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Detect\".\n\nExpand the left menu.\n\nClick the \"Management\" tab.\n\nSelect \"Sources\".\n\nClick \"New Source\".\n\nSelect the specified Source from the list.\n\nFill out the specified information. \n\nSelect \"Create\".","ccis":["CCI-001414"]},{"vulnId":"V-234085","ruleId":"SV-234085r960924_rule","severity":"medium","ruleTitle":"The Tanium Connect module must be configured to forward Tanium Detect events to identified destinations.","description":"Indicators of Compromise (IOC) are artifacts, which are observed on the network or system that indicates computer intrusion. The Tanium Detect module detects, manages, and analyzes systems intrusion in real time. The module also responds to those detections.\n\nBy forwarding Detect events using Tanium Connect, the necessary forensic evidence supporting a compromise is retained.","checkContent":"Consult with the Tanium System Administrator to determine if the \"Tanium Detect\" module is being used.\n\nIf it is not, this is Not Applicable.\n\nUsing a web browser on a system that has connectivity to Tanium, access the Tanium web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nClick \"Events\" under \"Sources\".\n\nVerify the \"Tanium IOC Detect\" event is being sent to an identified destination.\n\nIf there is no \"Tanium IOC Detect\" event source, this is a finding.","fixText":"Consult with the Tanium System Administrator to determine if the \"Tanium Detect\" module is being used.\n\nIf not this is Not Applicable.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nClick \"New Connection\".\n\nClick \"Create\" or if importing \"Import\".\n\nGive the \"Connection\" a name and description.\n\nSelect \"Events\" as the source.\n\n\"Event Group\" should be \"Tanium Detect\".\n\nSelect the appropriate events to send.\n\nConsult with the Tanium System Administrator for the Destination.\n\nClick \"Create Connection\".","ccis":["CCI-000158"]},{"vulnId":"V-234086","ruleId":"SV-234086r960954_rule","severity":"medium","ruleTitle":"The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.","description":"All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct Man in the Middle (MitM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium.\n\nTanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. before execution will be enforced by Tanium.\n\nSigning will prevent MitM remote code execution attacks and will protect data element in transit. Tanium also supports object level signing for content within the Tanium platform.\n\nSatisfies: SRG-APP-000131, SRG-APP-000233, SRG-APP-000317","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"sign_all_questions_flag\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"sign_all_questions_flag\" but the value is not \"1\", this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"sign_all_questions_flag\" for \"Setting Name:\".\n\nEnter \"1\" for \"Setting Value:\".\n\nSelect \"Server\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".","ccis":["CCI-001749"]},{"vulnId":"V-234087","ruleId":"SV-234087r960954_rule","severity":"medium","ruleTitle":"The Tanium Server must be configured to only allow signed content to be imported.","description":"Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate that is recognized and approved by the organization ensures the software has not been tampered with and that it has been provided by a trusted vendor.\n\nAccordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization.\n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.","checkContent":"Note: This requirement only applies to Tanium implementations in production. If implementation being evaluated is in development, this requirement is Not Applicable.\n\nAccess the Tanium Server through interactive logon.\n\nDrill to Program Files >> Tanium >> Tanium Server.\n\nOpen the \"tanium.license\" in Notepad and search for \"allow_unsigned_import\".\n\nIf \"allow unsigned_import\" is followed by \":true\", this is a finding.","fixText":"Contact Tanium for a corrected license file.","ccis":["CCI-001749"]},{"vulnId":"V-234088","ruleId":"SV-234088r960960_rule","severity":"medium","ruleTitle":"All installation files originally downloaded to the Tanium Server must be configured to download to a location other than the Tanium Server directory.","description":"Typically, the Tanium Server stores the Package Source Files that it downloads from the Internet and server shares or files uploaded through the Tanium Console in a subdirectory of the server's installation directory called Downloads. To ensure package files are not accessible to non-authorized functions, the files must be re-located to outside of the server's installation directory.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nValidate the \"DownloadPath REG_SZ\" value does not point to a location within the Tanium Server directory.\n\nIf the \"DownloadPath REG_SZ\" value points to a location within the Tanium Server directory, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nConfigure a directory elsewhere on the server to relocate the installation package files.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nChange the \"DownloadPath REG_SZ\" value to point to the location of the relocated installation package files.\n\nMove the files from the original directory to the location created for the installation package files.","ccis":["CCI-001499"]},{"vulnId":"V-234089","ruleId":"SV-234089r1043177_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Server for Client-to-Server communications.","description":"In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology--endpoints in California will form one ring while endpoints in Germany will form a separate ring.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html","checkContent":"Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server.\n\nAccess the host-based firewall configuration on the Tanium Server.\n\nValidate rules exist, as required, to include:\n\nBetween Tanium Clients or Zone Clients over TCP port 17472, bi-directionally.\n\nIf a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\n\nAllow TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network.\n\nIf a network firewall rule does not exist to allow TCP port 17472 from any managed computer to any other managed computer on the same local area network, this is a finding.","fixText":"Configure host-based and network firewall rules as required, to include Tanium Clients or Zone Clients over TCP port 17472, bi-directionally.\n\nAllow TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network.","ccis":["CCI-000382"]},{"vulnId":"V-234090","ruleId":"SV-234090r1043177_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.","description":"In customer environments using the Tanium Zone Server, a Tanium Client may be configured to point to a Zone Server instead of a Tanium Server. The communication requirements for these Clients are identical to the Server-to-Client requirements.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html","checkContent":"Note: If a Zone Server is not being used, this is Not Applicable.\n\nConsult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Zone Server.\n\nAccess the host-based firewall configuration on the Tanium Zone Server.\n\nValidate a rule exists for the following:\n\nPort Needed: Tanium Clients to Zone Server over TCP port 17472.\n\nIf a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, from Tanium Clients to the Tanium Zone Server, this is a finding.","fixText":"Configure host-based firewall rules as required, to include Tanium Clients to Zone Server over TCP port 17472.","ccis":["CCI-000382"]},{"vulnId":"V-234091","ruleId":"SV-234091r1043177_rule","severity":"medium","ruleTitle":"The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.","checkContent":"Review the PPSM CAL to ensure Tanium has been registered with all of the TCP ports required for functionality to include (but not limited to) TCP 17472, 17477, 17440, 17441, 443, and 1433.\n\nIf any TCP ports are being used on the Tanium Server that have been deemed as restricted by the PPSM CAL, this is a finding.","fixText":"Submit a formal request to have the Tanium communication ports evaluated and added to the PPSM CAL.","ccis":["CCI-000382"]},{"vulnId":"V-234092","ruleId":"SV-234092r961038_rule","severity":"medium","ruleTitle":"The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication.","description":"Information can be either unintentionally or maliciously disclosed or modified during reception including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When receiving data, applications need to leverage protection mechanisms, such as TLS, SSL VPNs, or IPsec.","checkContent":"Access the Tanium Application server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nLocate the \"SOAPServer.crt\" file.\n\nDouble-click on the file to open the certificate.\n\nSelect the \"Details\" tab.\n\nScroll down through the details to find and select the \"Enhanced Key Usage\" field.\n\nIf there is no \"Enhanced Key Usage\" field, this is a finding.\n\nIn the bottom screen, verify \"Server Authentication\" and \"Client Authentication\" are both identified.\n\nIf \"Server Authentication\" and \"Client Authentication\" are not both identified, this is a finding.","fixText":"Request or regenerate the certificate being used to include both the \"Server Authentication\" and \"Client Authentication\" objects.","ccis":["CCI-000185"]},{"vulnId":"V-234093","ruleId":"SV-234093r961041_rule","severity":"high","ruleTitle":"The Tanium Server certificate and private/public keys directory must be protected with appropriate permissions.","description":"If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\n\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information.\n\nIf the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user.\n\nBoth the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to >> Program Files >> Tanium >> Tanium Server.\n\nRight-click on the \"Certs\" folder.\n\nChoose \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read Only\" permissions.\n\nValidate the [Tanium service account] has \"Read Only\" permissions.\n\nValidate [Tanium Admins group] has Full permissions.\n\nIf the owner of the directory is not the [Tanium service account] and/or System and the [Tanium service account] has more privileges than \"Read Only\" and/or the [Tanium Admins group] has less than Full permissions, this is a finding.\n\nNavigate to Program Files >> Tanium >> Tanium Server >> Certs.\n\nRight-click on each of the following files:\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nInstalledcacert.crt\nInstalled-server.crt\nInstalled-server.key\nSOAPServer.crt\nSOAPServer.key\n\nValidate System and the [Tanium service account] have \"Read-Only\" permissions to each of the individual files, and the [Tanium Admin group] has Full permissions to each of the individual files.\n\nIf System and the [Tanium service account] have more than \"Read-Only\" permissions to any of the individual files and/or the [Tanium Admin group] has less than Full permissions to any of the individual files, this is a finding.\n\nNavigate to Program Files >> Tanium >> Tanium Server >> content_public_keys.\n\nRight-click on each of the following files:\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate System has \"Read-Only\" permissions and is applied to child objects.\n\nValidate [Tanium service account] has \"Read-Only\" permissions and is applied to child objects.\n\nValidate [Tanium Admin Group] has Full permissions and is applied to child objects.\n\nIf the [Tanium service account] and system permissions to the \\content_public_keys folder is greater than \"Read-Only\" and/or the \"Read-Only\" permissions have not been applied to child objects and/or the [Tanium Admin Group] has less than Full permissions, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on with an account with administrative privileges to the server.\n\nOpen an Explorer window.\n\nNavigate to >> Program Files >> Tanium >> Tanium Server.\n\nRight-click on \"Certs\" folder.\n\nChoose \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nChange the owner of the directory to the [Tanium service account].\n\nReduce System and the [Tanium service account] to \"Read-Only\" permissions.\n\nProvide the [Tanium Admin group] with Full permissions.\n\nNavigate to >> Program Files >> Tanium >> Tanium Server >> Certs.\n\nRight-click on each of the following files:\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nFor the following files, reduce System and the [Tanium service account] to \"Read-Only\":\n\nInstalledcacert.crt\nInstalled-server.crt\nInstalled-server.key\nSOAPServer.crt\nSOAPServer.key\n\nEnsure the [Tanium Admin group] has Full permissions for those same files.\n\nNavigate to >> Program Files >> Tanium >> Tanium Server >> content_public_keys.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nReduce System to \"Read-Only\" permissions. – apply to child objects.\n\nReduce [Tanium service account] to \"Read-Only\" permissions. – apply to child objects.\n\nProvide [Tanium Admin group] with Full permissions - apply to child objects.","ccis":["CCI-000186"]},{"vulnId":"V-234094","ruleId":"SV-234094r961095_rule","severity":"medium","ruleTitle":"The Tanium Module server must be installed on a separate system.","description":"Unauthorized access to the Tanium Server is protected by disabling the Module Server service on the Tanium Server and by configuring the Module Server on a separate system.\n\nWhen X509 smartcard certificates (CAC or PIV tokens) are used for access to the Tanium Server, the Tanium Module server must be on a separate system.\n\nIn order to restrict access to the Tanium Server resulting from an attack on the Module Server, it is recommended that the Tanium Module Server be installed on a separate system or VM from the Tanium Server. Adding to this recommendation, if the Tanium Server is configured to accept X509 Smartcard certificates (also referred to as CAC or PIV tokens) in lieu of username/password logon, the requirement becomes explicit and the Tanium Module Server must be installed on a separate system or VM.","checkContent":"Note: If the server being validated is the Module server, this check is Not Applicable.\n\nAccess the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nClick \"Start\".\n\nAccess the Server Manager.\n\nSelect Local Server.\n\nIn upper right corner, click \"Tools\".\n\nSelect \"Services\".\n\nIf the Tanium Module Server service is \"Running\", this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nClick \"Start\".\n\nAccess the Server Manager.\n\nSelect \"Local Server\".\n\nIn the upper right corner, click \"Tools\".\n\nSelect \"Services\".\n\nDisable the Tanium Module Server service.","ccis":["CCI-001082"]},{"vulnId":"V-234095","ruleId":"SV-234095r961317_rule","severity":"medium","ruleTitle":"The Tanium Server directory must be restricted with appropriate permissions.","description":"Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium.\n\nRight-click on the \"Tanium Server\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button. \n\nValidate the owner of the \"Tanium Server\" folder is the service account [Tanium service account].\n\nValidate the [Tanium service account] has full permissions to the \"Tanium Server\" folder.\n\nValidate the [Tanium Admins] group has full permissions to the \"Tanium Server\" folder.\n\nValidate Users have no permissions to the \"Tanium Server\" folder.\n\nIf any accounts other than the [Tanium service account] and the [Tanium Admins] group have any permission to the \"Tanium Server\" folder, this is a finding.\n\nIf the [Tanium service account] is not the owner of the \"Tanium Server\" folder, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium.\n\nRight-click on the \"Tanium Server\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nDisable folder inheritance.\n\nChange the owner of the directory to the service account [Tanium service account].\n\nRemove User permissions.\n\nGive [Tanium service account] full permissions.\n\nGive [Tanium Admins] group full permissions.","ccis":["CCI-002165"]},{"vulnId":"V-234096","ruleId":"SV-234096r961317_rule","severity":"medium","ruleTitle":"The Tanium Server http directory and sub-directories must be restricted with appropriate permissions.","description":"Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nRight-click on the \"Tanium Server\\http\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate the [Tanium Admins] group has full permissions.\n\nValidate System has Read-Only permissions.\n\nRight-click on the \"Tanium Server\\http\\libraries\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button. \n\nValidate Folder Inheritance is disabled. \n\nValidate the owner of the directory is the [Tanium service account]. \n\nValidate System has Read-Only permissions. \n\nValidate the [Tanium service account] has Read-Only permissions. \n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\taniumjs\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read-Only\" permissions.\n\nValidate the [Tanium service account] has \"Read-Only\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\tux\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read-Only\" permissions.\n\nValidate the [Tanium service account] has \"Read Only\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\tux-console\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read-Only\" permissions.\n\nValidate the [Tanium service account] has \"Read-Only\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\Logs\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate the [Tanium Service Account] has only \"Modify\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\TDL_Logs\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate the [Tanium Service Account] has only \"Modify\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\Certs\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read-Only\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nNavigate to Tanium Server >> Certs.\n\nFor the following files verify System and [Tanium Service Account] have \"Read-Only\" permissions:\n\ninstalledcacert.crt\ninstalled-server.crt\ninstalled-server.key\nSOAPServer.crt\nSOAPServer.key\n\nRight-click on the \"Tanium Server\\content_public_keys\" folder.\n\nSelect \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate Folder Inheritance is disabled.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate System has \"Read-Only\" permissions.\n\nValidate the [Tanium Service Account] has \"Read-Only\" permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nIf any of the above permissions are not configured correctly, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nRight-click on the \"Tanium Server\\http folder.\n\nSelect \"Properties\". \n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nReduce System to \"Read-Only\" permissions.\n\nRight-click on the \"Tanium Server\\http\\libraries\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions.\n\nReduce [Tanium service account] to \"Read-Only\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\taniumjs\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions.\n\nReduce [Tanium service account] to \"Read-Only\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\tux\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions.\n\nReduce [Tanium service account] to \"Read-Only\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\tux-console\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions.\n\nReduce [Tanium service account] to \"Read-Only\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\Logs\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce [Tanium service account] to \"Modify\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\http\\TDL_Logs\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce [Tanium service account] to \"Modify\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nRight-click on the \"Tanium Server\\Certs\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions.\n\nChange/verify the [Tanium Admins] group has full permissions.\n\nNavigate to Tanium Server >> Certs.\n\nFor the following files verify/reduce System and [Tanium Service Account] to \"Read-Only\" permissions:\n\ninstalledcacert.crt\ninstalled-server.crt\ninstalled-server.key\nSOAPServer.crt\nSOAPServer.key\n\nRight-click on the \"Tanium Server\\content_public_keys\" folder.\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nVerify/Disable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce System to \"Read-Only\" permissions - apply to child objects.\n\nReduce [Tanium service account] to \"Read-Only\" permissions - apply to child objects.\n\nChange/verify the [Tanium Admins] group has full permissions.","ccis":["CCI-002165"]},{"vulnId":"V-234097","ruleId":"SV-234097r961317_rule","severity":"medium","ruleTitle":"The permissions on the Tanium Server registry keys must be restricted to only the Tanium service account and the [Tanium Admins] group.","description":"Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nRight-click on \"Tanium Server\".\n\nSelect \"Permissions\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate the [Tanium service account] has full permissions.\n\nValidate the [Tanium Admins] group has full permissions.\n\nValidate the SYSTEM account has full permissions.\n\nValidate the User accounts do not have any permissions.\n\nIf any other account has full permissions and/or the User account has any permissions, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nRun regedit as Administrator.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nRight-click on \"Tanium Server\".\n\nSelect \"Properties\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nProvide the [Tanium service account] with full permissions.\n\nProvide the [Tanium Admins] group with full permissions.\n\nReduce permissions for any other accounts with full permissions.\n\nRemove permissions for User accounts.","ccis":["CCI-002165"]},{"vulnId":"V-234098","ruleId":"SV-234098r961317_rule","severity":"medium","ruleTitle":"The Tanium Server Logs and TDL_Logs directories must be restricted with appropriate permissions.","description":"Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nRight-click on the \"Logs\" folder.\n\nSelect \"Properties\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate the [Tanium service account] privileges is only account with modify permissions on the directory.\n\nValidate the [Tanium Administrators] group has full permissions on the directory.\n\nRight-click on the \"TDL_Logs\" folder.\n\nSelect \"Properties\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button. \n\nValidate the owner of the directory is the [Tanium service account].\n\nValidate the [Tanium service account] privileges is the only account with modify permissions on the directory.\n\nValidate the [Tanium Administrators] group has full permissions on the directory.\n\nIf any of the specified permissions are not set as required, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to their server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Server.\n\nRight-click on the \"Logs\" folder.\n\nSelect \"Properties\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nDisable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce [Tanium service account] privileges to modify permissions on the directory.\n\nEnsure [Tanium Admins] group has full permissions on the directory.\n\nRight-click on the \"TDL_Logs\" folder.\n\nSelect \"Properties\".\n\nClick on the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nDisable folder inheritance.\n\nChange/verify the owner of the directory to the [Tanium service account].\n\nReduce [Tanium service account] privileges to modify permissions on the directory.\n\nEnsure [Tanium Admins] group has full permissions on the directory.","ccis":["CCI-002165"]},{"vulnId":"V-234099","ruleId":"SV-234099r961353_rule","severity":"medium","ruleTitle":"All Active Directory accounts synchronized with Tanium for non-privileged functions must be non-privileged domain accounts.","description":"Tanium has the ability to synchronize with Active Directory for Tanium account management. Tanium advises that all replicated accounts for non-privileged level functions should be non-privileged domain accounts. In doing so, should a vulnerability in the industry standard OpenSSL libraries used by Tanium ever come to light, no privileged account information could be gained by an attacker. This is simply good housekeeping and should be exercised with any such platform product.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Users\" tab.\n\nReview each of the users listed and determine their Active Directory synced account.\n\nAccess one of the domain's Active Directory Domain Controller servers with a Domain Administrator account.\n\nReview each of the Users for which a synced account is in the Tanium console as a user.\n\nValidate whether any of the users are considered to be non-privileged in Active Directory, yet have privileged capabilities in Tanium.\n\nIf any of the non-privileged Active Directory accounts have elevated privileges and are synced as a Tanium privileged account, this is a finding.","fixText":"Access Active Directory with appropriate credentials.\n\nFor each User, where a synced account is in the Tanium console as a privileged user, adjust the user to an appropriate security group in Active Directory.\n\nVerify, after syncing with Tanium, the non-privileged user account is no longer in a privileged role within Tanium.","ccis":["CCI-002235"]},{"vulnId":"V-234100","ruleId":"SV-234100r961395_rule","severity":"medium","ruleTitle":"A Tanium connector must be configured to send log data to an external audit log reduction capable system.","description":"While the Tanium Server records audit log entries to the Tanium SQL database, retrieval and aggregation of log data through the Tanium console is not efficient.\n\nThe Tanium Connect module allows for SIEM connectors in order to facilitate forensic data retrieval and aggregation efficiently. Consult documentation at https://docs.tanium.com/connect/connect/index.html for supported Connections.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Tanium Sources listed.\n\nIf an \"Audit Log\" source does not exist, this is a finding.\n\nSelect the \"Audit Log\" source.\n\nSelect the audit connection found in the lower half of the screen.\n\nVerify the \"Destination Type\" is a SIEM tool.\n\nIf the \"Destination Type\" is not a SIEM tool, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nClick \"Create Connection\".\n\nIn the Source and Destination Section, select \"Audit Log\" as the Event Source from the drop-down menu.\n\nIn the \"Destination\" section, select \"Socket Receiver\" from the drop-down menu.\n\nEnter \"Destination Name\".\n\nEnter \"Host\".\n\nEnter \"Network Protocol\".\n\nEnter \"Port\".\n\nConsult documentation located at https://docs.tanium.com/connect/connect/index.html for reference on configuring other applicable SIEM connections.","ccis":["CCI-001851"]},{"vulnId":"V-234101","ruleId":"SV-234101r961452_rule","severity":"medium","ruleTitle":"File integrity monitoring of critical executables that Tanium uses must be configured.","description":"Tanium inherently watches files and their respective hash values for change but while Tanium can do file integrity checks of critical executables, it is important to conduct File Integrity Monitoring (FIM) via an outside service such as Host Based Security System (HBSS) or similar security suites with FIM capability. These technologies provide independent monitoring of critical Tanium and system binaries.","checkContent":"If the site is using Tanium Integrity Monitor, Tanium Integrity Monitor should be used to monitor the file integrity of Tanium critical files.\n\nIf Tanium Integrity Monitor is not installed, a third-party file integrity-monitoring tool must be used to monitor Tanium critical executables, defined files within the Tanium Server directory path.\n\nIf the file integrity of Tanium critical executables is not monitored, this is a finding.","fixText":"Implement a file integrity monitoring system to monitor the Tanium critical executable files.","ccis":["CCI-001811"]},{"vulnId":"V-234102","ruleId":"SV-234102r961470_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium module server to allow Server-to-Module Server communications from the Tanium Server.","description":"The Tanium Module Server is used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477. Without a proper connection from the Tanium Server to the Tanium Module Server, access to the system capabilities could be denied.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Module Server.\n\nAccess the host-based firewall configuration on the Tanium Module Server.\n\nValidate a rule exists for the following:\nPort Needed: Tanium Server to Tanium Module Server over TCP port 17477.\n\nIf a host-based firewall rule does not exist to allow TCP port 17477, from the Tanium Server to the Tanium Module Server, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\nAllow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server.\n\nIf a network firewall rule does not exist to allow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server, this is a finding.","fixText":"Configure host-based firewall rules on the Tanium Module Server to include the following required traffic:\n\nAllow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server.\n\nConfigure the network firewall to allow the above traffic.","ccis":["CCI-001762"]},{"vulnId":"V-234103","ruleId":"SV-234103r961470_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Server for Server-to-Module Server communications.","description":"The Tanium Module Server is used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477.  Without a proper connection from the Tanium Server to the Tanium Module Server, access to the system capabilities could be denied.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server.\n\nAccess the host-based firewall configuration on the Tanium Server.\n\nValidate a rule exists for the following:\n\nPort Needed: Tanium Server to Tanium Module Server over TCP port 17477.\n\nIf a host-based firewall rule does not exist to allow TCP port 17477, from the Tanium Server to the Tanium Module Server, this is a finding.\n\nConsult with the network firewall administrator and validate rules exist for the following:\n\nAllow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server.\n\nIf a network firewall rule does not exist to allow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server, this is a finding.","fixText":"Configure host-based firewall rules on the Tanium Server to allow the following required traffic:\n\nAllow TCP traffic on port 17477 to the Tanium Module Server from the Tanium Server.\n\nConfigure the network firewall to allow the above traffic.","ccis":["CCI-001762"]},{"vulnId":"V-234104","ruleId":"SV-234104r961470_rule","severity":"medium","ruleTitle":"Firewall rules must be configured on the Tanium Server for Server-to-Zone Server communications.","description":"If you are using the Tanium Zone Server to proxy traffic from Tanium-managed computers on less trusted network segments to the Tanium Server on the core network, then the Tanium Zone Server Hub, typically installed to the Tanium Server device, must be able to connect to the Zone Server(s) in the DMZ. This is the only configuration that requires you to allow outbound traffic on port 17472 from the Tanium Server device. The ZoneServerList.txt configuration file located in the Tanium Zone Server Hub's installation folder identifies the addresses of the destination Zone Servers. See the Zone Server Configuration page for more details.\n\nPort Needed: Tanium Server to Zone Server over TCP port 17472.\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 17472 from the Zone Server Hub, usually the Tanium Server device, to the destination DMZ devices(s) hosting the Zone Server(s).\n\nEndpoint firewall rules - for additional security, configure the following endpoint firewall rules:\n\nAllow TCP traffic outbound on port 17472 from only the Zone Server Hub process running on the Tanium Server device.\n\nAllow TCP traffic inbound on port 17472 to only the Zone Server process running on the designated Zone Server device(s).\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_network_ports.html.","checkContent":"Note: If a Zone Server is not being used, this is Not Applicable.\n\nConsult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Server.\n\nAccess the host-based firewall configuration on the Tanium Server.\n\nValidate a rule exists for the following:\n\nPort Needed: Tanium Server to Zone Server over TCP port 17472.\n\nIf a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, from Tanium Server to the Tanium Zone Server, this is a finding.","fixText":"Configure host-based firewall rules on the Tanium Zone server to include the following required traffic:\n\nAllow Tanium Server to Zone Server over TCP port 17472.\n\nConfigure the network firewall to allow the above traffic.","ccis":["CCI-001762"]},{"vulnId":"V-234105","ruleId":"SV-234105r962034_rule","severity":"medium","ruleTitle":"The SSLHonorCipherOrder must be configured to disable weak encryption algorithms on the Tanium Server.","description":"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nVerify the existence of a DWORD \"SSLHonorCipherOrder\" with a value of \"0x00000001\" (hex).\n\nIf the DWORD \"SSLHonorCipherOrder\" does not exist with a value of \"0x00000001\" (hex), this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nAdd or modify the DWORD \"SSLHonorCipherOrder\" to have a value of 0x00000001 (hex).","ccis":["CCI-002450"]},{"vulnId":"V-234106","ruleId":"SV-234106r961596_rule","severity":"medium","ruleTitle":"The Tanium Server certificate must be signed by a DoD Certificate Authority.","description":"The Tanium Server has the option to use a \"self-signed\" certificate or a Trusted Certificate Authority signed certificate for SSL connections. During evaluations of Tanium in Lab settings, customers often conclude that a \"self-signed\" certificate is an acceptable risk. However, in production environments it is critical that a SSL certificate signed by a Trusted Certificate Authority be used on the Tanium Server in lieu of an untrusted and insecure \"self-signed\" certificate.","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nWhen connected, review the Certificate for the Tanium Server:\n\nIn Internet Explorer, right-click on the page.\n\nSelect \"Properties\".\n\nClick on the \"Certificates\" tab.\n\nOn the \"General\" tab, validate the Certificate shows as issued by a DOD Root CA.\n\nOn Certification \"Path\" tab, validate the path top-level is a DoD Root CA.\n\nIf the certificate authority is not DoD Root CA, this is a finding.","fixText":"Request or regenerate the certificate from a DoD Root Certificate Authority.","ccis":["CCI-002470"]},{"vulnId":"V-234107","ruleId":"SV-234107r961641_rule","severity":"medium","ruleTitle":"Any Tanium configured EMAIL RESULTS connectors must be configured to enable TLS/SSL to encrypt communications.","description":"Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec.\n\nAn example of this would be the SMTP queue. The SMTP mail protocol places email messages into a centralized queue prior to transmission. If someone were to modify an email message contained in the queue and the SMTP protocol did not check to ensure the email message was not modified while it was stored in the queue, a modified email could be sent.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Destinations listed.\n\nIf an \"Email\" Destination does not exist, this is not a finding.\n\nSelect \"Email\" destination.\n\nSelect each Connection found in the lower half of the screen.\n\nVerify \"Enable TLS\" is \"true\".\n\nIf \"Enable TLS\" is \"false\", this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Connect\".\n\nReview the configured Destinations listed.\n\nSelect \"Email\" destination.\n\nSelect the Connection found in the lower half of the screen.\n\nClick \"Edit\" on the top right of the summary page.\n\nUnder the \"Source and Destination\" section, select the \"Enable TLS\" checkbox under the \"Mail Configuration\".\n\nConfirm the rest of the data is correct.\n\nClick \"Save\" at the bottom of the page.\n\nDo this for all Connections configured with an \"Email\" destination.","ccis":["CCI-002422"]},{"vulnId":"V-234108","ruleId":"SV-234108r961863_rule","severity":"medium","ruleTitle":"Tanium Server files must be excluded from on-access antivirus actions.","description":"Similar to any other host-based applications, the Tanium Server is subject to the restrictions other System-level software may place on an operating environment. Antivirus, IPS, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the antivirus software used on the Tanium Server.\n\nReview the settings of the antivirus software.\n\nValidate exclusions exist which exclude the Tanium program files from being scanned by antivirus on-access scans.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement exclusion policies within the antivirus software solution to prevent on-access scanning of Tanium Server program files.","ccis":["CCI-000366"]},{"vulnId":"V-234109","ruleId":"SV-234109r961863_rule","severity":"medium","ruleTitle":"Tanium Server files must be protected from file encryption actions.","description":"Similar to any other host-based applications, the Tanium Server is subject to the restrictions other System-level software may place on an operating environment. Antivirus, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the file-level encryption software used on the Tanium Server.\n\nReview the settings for the file-level encryption software.\n\nValidate exclusions exist which exclude the Tanium program files from being encrypted by the file-level encryption software.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement excluding policies within the file-level encryption software solution to exclude encryption of the Tanium Server program files.","ccis":["CCI-000366"]},{"vulnId":"V-234110","ruleId":"SV-234110r962034_rule","severity":"medium","ruleTitle":"The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server.","description":"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nClick \"Enter\".\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nVerify the existence of a String \"SSLCipherSuite\" with a value of:\n\nECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK\n\nIf the String \"SSLCipherSuite\" does not exist with the appropriate list values, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nAdd or modify the String \"SSLCipherSuite\" to have a value of:\n\nECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK","ccis":["CCI-002450"]},{"vulnId":"V-234111","ruleId":"SV-234111r960735_rule","severity":"medium","ruleTitle":"The Tanium max_soap_sessions_total setting must be explicitly enabled to limit the number of simultaneous sessions.","description":"Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\n\nThis requirement may be met via the application or by utilizing information system, session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application.\n\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"max_soap_sessions_total\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"max_soap_sessions_total\", but the value is not the value defined in the system documentation, this is a finding.","fixText":"Using a web browser on a system, which has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box enter \"max_soap_sessions_total\" for \"Setting Name:\".\n\nWork with a Tanium Technical Account Manager (TAM) for a proper value and enter this for the \"Setting Value:\".\n\nSelect \"Server\" from \"Affects drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nAdd this setting to the system documentation for validation.","ccis":["CCI-000054"]},{"vulnId":"V-234112","ruleId":"SV-234112r960735_rule","severity":"medium","ruleTitle":"The Tanium max_soap_sessions_per_user setting must be explicitly enabled to limit the number of simultaneous sessions.","description":"Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\n\nThis requirement may be met via the application or by utilizing information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application.\n\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"max_soap_sessions_per_user\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"max_soap_sessions_per_user\", but the value is not the value defined in the system documentation, this is a finding.","fixText":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box enter \"max_soap_sessions_per_user\" for \"Setting Name:\".\n\nWork with a Tanium Technical Account Manager (TAM) for a proper value, and enter this for the \"Setting Value:\".\n\nSelect \"Server\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nAdd this setting to the system documentation for validation.","ccis":["CCI-000054"]},{"vulnId":"V-234113","ruleId":"SV-234113r960735_rule","severity":"medium","ruleTitle":"The Tanium soap_max_keep_alive setting must be explicitly enabled to limit the number of simultaneous sessions.","description":"Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to DoS attacks.\n\nThis requirement may be met via the application or by utilizing information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application.\n\nThis requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.","checkContent":"Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box type \"soap_max_keep_alive\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"soap_max_keep_alive \", but the value is not the value defined in the system documentation, this is a finding.","fixText":"Using a web browser on a system, which has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box enter \"soap_max_keep_alive\" for \"Setting Name:\".\n\nWork with a Tanium Technical Account Manager (TAM) for a proper value, and enter this for the \"Setting Value:\".\n\nSelect \"Server\" from \"Affects\" drop-down list.\n\nSelect \"Numeric\" from \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nAdd this setting to the system documentation for validation.","ccis":["CCI-000054"]},{"vulnId":"V-234114","ruleId":"SV-234114r960804_rule","severity":"medium","ruleTitle":"The Tanium documentation identifying recognized and trusted folders for Detect Local Directory Source must be maintained.","description":"An IOC stream is a series or \"stream\" of IOCs that are imported from a vendor based on a subscription service or manually downloaded and placed in a folder. Detect can be configured to retrieve the IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.","checkContent":"Consult with the Tanium System Administrator to review the documented list of folder maintainers for Detect Local Directory Source.\n\nIf the site does not leverage Local Directory Source to import IOCs, this finding is Not Applicable.\n\nIf the site does use Local Directory Source to import IOCs and the folder maintainers are not documented, this is a finding.","fixText":"Prepare and maintain documentation identifying the Tanium IOC Local Directory Source maintainers.","ccis":["CCI-001414"]},{"vulnId":"V-234115","ruleId":"SV-234115r960804_rule","severity":"medium","ruleTitle":"The Tanium Detect Local Directory Source must be configured to restrict access to only authorized maintainers of Intel.","description":"An IOC stream is a series or \"\"stream\"\" of intel that are imported from a vendor based on a subscription service or manually downloaded and placed in a folder. Detect can be configured to retrieve the IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.","checkContent":"Consult with the Tanium System Administrator to determine if the Tanium Detect module is being used, if not then this finding is Not Applicable.\n\nIf being used then determine where they get their IOC Stream.\n\nAccess the Tanium Module Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Module Server >> services >> detect3-files\n\nRight-click on the folder and choose \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nIf the accounts listed in the \"Security\" tab do not match the list of accounts found in the Tanium documentation, this is a finding.","fixText":"Consult with the Tanium System Administrator to determine if the \"Detect\" module is being used, if not then this is Not Applicable.\n\nAccess the Tanium Module Server interactively.\n\nLog on to their server with an account that has administrative privileges.\n\nOpen an Explorer window.\n\nNavigate to Program Files >> Tanium >> Tanium Module Server >> services >> detect3-files\n\nRight-click on the folder and choose \"Properties\".\n\nSelect the \"Security\" tab.\n\nClick on the \"Advanced\" button.\n\nIf the accounts listed in the \"Security\" tab do not match the list of accounts, with the exception of SYSTEM, remove the additionally listed accounts.\n\nIf the accounts listed in the \"Security\" tab are missing accounts from the documentation, with the exception of SYSTEM, add the additionally listed accounts with a minimum of READ permissions.","ccis":["CCI-001414"]},{"vulnId":"V-234116","ruleId":"SV-234116r960804_rule","severity":"medium","ruleTitle":"The Tanium documentation identifying recognized and trusted SCAP sources must be maintained.","description":"NIST validated SCAP XML documents are provided from several possible sources such as DISA, NIST, and the other non-government entities. These documents are used as the basis of compliance definitions leveraged to automate compliance auditing of systems. These documents are updated on different frequencies and must be manually downloaded on regular intervals and imported in order to be current. Non-approved SCAP definitions lead to a false sense of security when evaluating an enterprise environment.","checkContent":"Consult with the Tanium System Administrator to review the documented list of trusted SCAP sources.\n\nIf the site does not have \"Tanium Comply\" module, or does not use \"Tanium Comply\" for compliance validation, this finding is Not Applicable.\n\nIf the site does use \"Tanium Comply\" and the source for SCAP content is not documented, this is a finding.","fixText":"If the site does not have \"Tanium Comply\" module, or does not use \"Tanium Comply\" for compliance validation, this finding is Not Applicable.\n\nPrepare and maintain documentation identifying the source of SCAP sources that will be used by \"Tanium Comply\" module.","ccis":["CCI-001414"]},{"vulnId":"V-234117","ruleId":"SV-234117r960804_rule","severity":"medium","ruleTitle":"The Tanium documentation identifying recognized and trusted OVAL feeds must be maintained.","description":"OVAL XML documents are provided from several possible sources such as the CIS open source repository, or any number of vendor/3rd party paid repositories. These documents are used to automate the passive validation of vulnerabilities on systems and therefore require a reasonable level of confidence in their origin. Non-approved OVAL definitions lead to a false sense of security when evaluating an enterprise environment.","checkContent":"Consult with the Tanium System Administrator to review the documented list of trusted OVAL feeds.\n\nIf the site does not have \"Tanium Comply\" module, or does not use \"Tanium Comply\" for passive vulnerability scanning, this finding is Not Applicable.\n\nOtherwise, if the site does use \"Tanium Comply\" and the source for OVAL content is not documented, this is a finding.","fixText":"If the site does not have \"Tanium Comply\" module, or does not use \"Tanium Comply\" for passive vulnerability scanning, this finding is Not Applicable.\n\nPrepare and maintain documentation identifying the source of OVAL feeds that will be used by \"Tanium Comply\" module.","ccis":["CCI-001414"]},{"vulnId":"V-234118","ruleId":"SV-234118r960804_rule","severity":"medium","ruleTitle":"Tanium Comply must be configured to receive SCAP content only from trusted sources.","description":"NIST-validated SCAP XML documents are provided from several possible sources such as DISA, NIST, and the other non-government entities. These documents are used as the basis of compliance definitions leveraged to automate compliance auditing of systems. These documents are updated on different frequencies and must be manually downloaded on regular intervals and imported in order to be current. Non-approved SCAP definitions lead to a false sense of security when evaluating an enterprise environment.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Comply\".\n\nAlong the left side of the interface, click on \"Benchmarks\".\n\nSelect \"Configuration Compliance\".\n\nVerify all imported compliance benchmarks are from a documented trusted source.\n\nIf any compliance benchmark is found that does not come from a documented trusted source, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Comply\".\n\nAlong the left side of the interface, click on \"Benchmarks\".\n\nSelect \"Configuration Compliance\".\n\nDelete any compliance benchmarks that come from non-trusted sources.","ccis":["CCI-001414"]},{"vulnId":"V-234119","ruleId":"SV-234119r960804_rule","severity":"medium","ruleTitle":"Tanium Comply must be configured to receive OVAL feeds only from trusted sources.","description":"OVAL XML documents are provided from several possible sources such as the CIS open source repository, or any number of vendor/3rd party paid repositories. These documents are used to automate the passive validation of vulnerabilities on systems and therefore require a reasonable level of confidence in their origin. Non-approved OVAL definitions lead to a false sense of security when evaluating an enterprise environment.","checkContent":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Comply\".\n\nAlong the left side of the interface, click on \"Benchmarks\".\n\nSelect \"Vulnerability\".\n\nVerify all imported vulnerability sources are from a documented trusted source.\n\nIf any vulnerability sources found do not match a documented trusted source, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Comply\".\n\nAlong the left side of the interface, click on \"Benchmarks\".\n\nSelect \"Vulnerability\".\n\nDelete any vulnerability sources, which are configured to non-trusted sources, or reconfigured to point to trusted sources.","ccis":["CCI-001414"]},{"vulnId":"V-234120","ruleId":"SV-234120r961125_rule","severity":"medium","ruleTitle":"The Tanium application must be configured in a High-Availability (HA) setup to ensure minimal loss of data and minimal disruption to mission processes in the event of a system failure.","description":"Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving application state information helps to facilitate application restart and return to the operational mode of the organization with less disruption to mission-essential processes.","checkContent":"If the system is not considered mission critical, this is Not Applicable.\n\nUsing a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI).\n\nLog on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Packages\".\n\nBrowse to the package called \"Distribute Tanium Standard Utilities\".\n\nSelect it.\n\nPress \"Status\".\n\nObserve the text underneath a package file indicating the file cache status.\n\nIf the cache status represents only one Tanium Server, this is a finding.","fixText":"If the system is not considered mission critical, this is Not Applicable.\n\nWork with the Tanium System Administrator to configure Tanium in a HA Active-Active setup based on the process outlined in the Tanium documentation found at:\n\nhttps://docs.tanium.com/platform_install/platform_install/installing_an_ha_active_active_cluster.html.","ccis":["CCI-001665"]},{"vulnId":"V-234121","ruleId":"SV-234121r961155_rule","severity":"medium","ruleTitle":"The bandwidth consumption for the Tanium Application server must be limited.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nIn the case of application DoS attacks, care must be taken when designing the application to ensure the application makes the best use of system resources. SQL queries have the potential to consume large amounts of CPU cycles if they are not tuned for optimal performance. Web services containing complex calculations requiring large amounts of time to complete can bog down if too many requests for the service are encountered within a short period of time.\n\nThe methods employed to meet this requirement will vary depending upon the technology the application utilizes. However, a variety of technologies exist to limit or, in some cases, eliminate the effects of application related DoS attacks. Employing increased capacity and bandwidth combined with specialized application layer protection devices and service redundancy may reduce the susceptibility to some DoS attacks.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nVerify the existence of a DWORD \"DownloadBytesPerSecondLimit\".\n\nIf the DWORD \"DownloadBytesPerSecondLimit\" does not exist with a value equal to the value recorded in the system documentation, this is a finding.\n\nConsult with your TAM for an appropriate value and record this in the system documentation.\n\nIf this setting is not documented, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nAdd or modify the DWORD \"DownloadBytesPerSecondLimit\" to have a value that matches the value recorded in the system documentation.","ccis":["CCI-001095"]},{"vulnId":"V-234122","ruleId":"SV-234122r961392_rule","severity":"medium","ruleTitle":"The Tanium SQL Server RDBMS must be configured with sufficient free space to ensure audit logging is not impacted.","description":"In order to ensure Tanium has sufficient storage capacity in which to write the audit logs, the SQL Server RDMBS must be configured with sufficient free space.\n\nConsult the server sizing documents located at https://docs.tanium.com/platform_install/platform_install/reference_host_system_sizing_guidelines.html to determine how much free space should be allocated.","checkContent":"Access the Tanium SQL Server interactively.\n\nLog on to their server with an account that has administrative privileges.\n\nConsult server sizing documentation at https://docs.tanium.com/platform_install/platform_install/reference_host_system_sizing_guidelines.html and the Tanium system administrator to determine the recommended disk space sizing for the size of the Tanium deployment.\n\nLaunch File Explorer.\nCheck the total disk space allocated to the hard drive allocated for the Tanium SQL databases.\n\nCompare the allocated size against the recommended disk space sizing for the size of the Tanium deployment.\n\nIf the allocated size is less than the recommended disk space, this is a finding.","fixText":"Work with the Tanium System Administrator and/or database administrator to allocate additional disk space for the volume hosting the Tanium SQL databases.","ccis":["CCI-001849"]},{"vulnId":"V-234123","ruleId":"SV-234123r961620_rule","severity":"medium","ruleTitle":"The Tanium application must limit the bandwidth used in communicating with endpoints to prevent a Denial of Service (DoS) condition at the server.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nThis requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nVerify the existence of a DWORD \"DownloadBytesPerSecondLimit\" with a value matching what is in the system documentation.\n\nIf the DWORD \"DownloadBytesPerSecondLimit\" does not exist with the correct value, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: regedit <enter>.\n\nNavigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nAdd or modify the DWORD \"DownloadBytesPerSecondLimit\" to have a value consistent with the value found in the system documentation.","ccis":["CCI-002385"]},{"vulnId":"V-234124","ruleId":"SV-234124r1067646_rule","severity":"high","ruleTitle":"The Tanium Application Server must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).","description":"Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously.\n\nOrganization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw).\n\nThis requirement will apply to software patch management solutions that are used to install patches across the enclave and to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the information assurance vulnerability management (IAVM) process.\n\nThe application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).","checkContent":"This STIG is sunset and no longer maintained.\n\nCheck that the version in use is still supported by the vendor.\n\nIf the version in use is not supported by the vendor, this is a finding.\n\nConsult with the Tanium system administrator to review the documented time window designated for updates.\n\nIf a window of time is not defined, or does not specify a reoccurring frequency, this is a finding.\n\nUsing a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI).\n\nLog on with CAC.\n\nClick the navigation button (hamburger menu) on the top left of the console.\n\nClick \"Tanium Solutions\".\n\nIf any module has the text \"Upgrade to\" a newer (greater) version number compared to the Installed version number in the Tanium Modules section of the page, this is a finding.\n\nIf the Tanium install is an air gap install, work with the Tanium technical account manager (TAM) to determine if the modules are up to date.","fixText":"Upgrade to a supported version.\n\nWork with the Tanium system administrator to define the reoccurring time window designated for updates.\n\nUpdate the system documentation to reflect this window of time.\n\nUsing a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI.\n\nLog on with CAC.\n\nClick the navigation button (hamburger menu) on the top left of the console.\n\nClick \"Tanium Solutions\".\n\nSelect any modules that indicate \"Upgrade to\" and proceed with importing the modules.","ccis":["CCI-002605"]},{"vulnId":"V-234125","ruleId":"SV-234125r961863_rule","severity":"medium","ruleTitle":"Tanium Server files must be excluded from host-based intrusion prevention intervention.","description":"Similar to any other host-based applications, the Tanium Server is subject to the restrictions other System-level software may place on an operating environment. Antivirus, IPS, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://docs.tanium.com/platform_install/platform_install/reference_host_system_security_exceptions.html.","checkContent":"Consult with the Tanium System Administrator to determine the HIPS software used on the Tanium Server.\n\nReview the settings of the HIPS software.\n\nValidate exclusions exist which exclude the Tanium program files from being restricted by HIPS.\n\nIf exclusions do not exist, this is a finding.","fixText":"Implement exclusion policies within the HIPS software solution to exclude the Tanium Server program files from HIPS intervention.","ccis":["CCI-000366"]},{"vulnId":"V-234126","ruleId":"SV-234126r1043182_rule","severity":"medium","ruleTitle":"The Tanium application must set an absolute timeout for sessions.","description":"Automatic session termination addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions.\n\nSession termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.\n\nConditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use.\n\nThis capability is typically reserved for specific application system functionality where the system owner, data owner, or organization requires additional assurance. Based upon requirements and events specified by the data or application owner, the application developer must incorporate logic into the application that will provide a control mechanism that disconnects users upon the defined event trigger. The methods for incorporating this requirement will be determined and specified on a case-by-case basis during the application design and development stages.\n\nLeaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate, guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active.","checkContent":"Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box, type \"session_expiration_seconds\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"session_expiration_seconds\", but the value is not \"900\" or less, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn the \"New System Setting\" dialog box, enter \"session_expiration_seconds\" for \"Setting Name:\".\n\nEnter \"900\" or less for \"Setting Value:\".\n\nSelect \"Server\" from the \"Affects\" drop-down list.\n\nSelect \"Numeric\" from the \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nIf \"session_expiration_seconds\" exists but is not \"900\" or less, select the box beside the value and click on \"Edit\".\n\nEnter \"900\" or less for \"Setting Value:\".\n\nClick \"Save\".","ccis":["CCI-002361"]},{"vulnId":"V-234127","ruleId":"SV-234127r1043182_rule","severity":"medium","ruleTitle":"The Tanium application must set an inactive timeout for sessions.","description":"Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that sessions that are not closed through the user logging out of an application are eventually closed.\n\nAcceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.","checkContent":"Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web user interface (UI) and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console. \n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nIn the \"Show Settings Containing:\" search box, type \"max_console_idle_seconds\".\n\nClick \"Enter\".\n\nIf no results are returned, this is a finding.\n\nIf results are returned for \"max_console_idle_seconds\", but the value is not \"900\" or less, this is a finding.","fixText":"Using a web browser on a system that has connectivity to the Tanium application, access the Tanium application web UI and log on with CAC.\n\nClick on the navigation button (hamburger menu) on the top left of the console.\n\nClick on \"Administration\".\n\nSelect the \"Global Settings\" tab.\n\nClick on \"New Setting\".\n\nIn \"New System Setting\" dialog box, enter \"max_console_idle_seconds\" for \"Setting Name:\".\n\nEnter \"900\" for \"Setting Value:\".\n\nSelect \"Server\" from the \"Affects\" drop-down list.\n\nSelect \"Numeric\" from the \"Value Type\" drop-down list.\n\nClick \"Save\".\n\nIf \"max_console_idle_seconds\" exists but is not \"900\" or less, select the box beside the value and click \"Edit\".\n\nEnter \"900\" or less for \"Setting Value:\".\n\nClick \"Save\".","ccis":["CCI-002361"]},{"vulnId":"V-234128","ruleId":"SV-234128r961620_rule","severity":"medium","ruleTitle":"The Tanium application service must be protected from being stopped by a non-privileged user.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nThis requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.\n\nA web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.","checkContent":"Verify that to prevent a non-privileged user from affecting the Tanium Server's ability to operate, the control of the service is restricted to the Local Administrators.\n\nLog on interactively to the Tanium Server.\n\nOpen the CMD prompt as admin.\n\nRun \"sc sdshow \"Tanium Server\"\".\n\nIf the string does not match \"D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)\", this is a finding.\n\nRun the above on all other Tanium Servers, to include Tanium Servers in an Active-Active pair.","fixText":"Log on interactively to the Tanium Server.\n\nOpen the CMD prompt as admin.\n\nRun \"sc sdset \"Tanium Server\" D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)\".\n\nRun the above on all other Tanium Servers, to include Tanium Servers in an Active-Active pair.","ccis":["CCI-002385"]},{"vulnId":"V-234129","ruleId":"SV-234129r961620_rule","severity":"medium","ruleTitle":"The Tanium web server must be tuned to handle the operational requirements of the hosted application.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.\n\nThis requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.\n\nAn attacker has at least two reasons to stop a web server. The first is to cause a Denial of Service (DoS), and the second is to put in place changes the attacker made to the web server configuration. \n\nTo prohibit an attacker from stopping the web server, the process ID (pid) of the web server and the utilities used to start/stop the web server must be protected from access by non-privileged users. By knowing the pid and having access to the web server utilities, a non-privileged user has a greater capability of stopping the server, whether intentionally or unintentionally.","checkContent":"As part of any Tanium install, Tanium has a tuning process that takes into account customer-provided inputs on the size of the deployment as well as characteristics of the network.\n\nObtain from Tanium the document that states the tuning settings for the particular installation.\n\nIf the organization cannot provide a server-tuning document from the vendor, this is a finding.","fixText":"Obtain the vendor tuning documentation for the deployment.\n\nInclude it in the system's documentation as proof of tuning.","ccis":["CCI-002385"]},{"vulnId":"V-234130","ruleId":"SV-234130r961632_rule","severity":"medium","ruleTitle":"The Tanium application, SQL and Module servers must all be configured to communicate using TLS 1.2 Strict Only.","description":"Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 defines the approved TLS versions for government applications.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.","checkContent":"Access the Tanium Servers (Application, SQL and Module) interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> SYSTEM >> CurrentControlSet >> Control >> SecurityProviders >> SCHANNEL >> Protocols >> SSL 2.0 >> Client for Module server.\nNavigate to: HKEY_LOCAL_MACHINE >> SYSTEM >> CurrentControlSet >> Control >> SecurityProviders >> SCHANNEL >> Protocols >> SSL 2.0 >> Server for Application server and SQL server.\n\nName: DisabledByDefault\nType: REG_DWORD\nData: 0x0000001 (hex)\n\nIf the value for \"DisabledByDefault\" is not set to \"1\" and \"Type\" is not configured to \"REG_DWORD\" or does not exist, this is a finding.\n\nName: Enabled\nType: REG_DWORD\nData: 0x00000000 (hex)\n\nIf the value for \"Enabled\" is not set to \"0\" and \"Type\" is not configured to \"REG_DWORD\" or does not exist, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> SYSTEM >> CurrentControlSet >> Control >> SecurityProviders >> SCHANNEL >> Protocols >> SSL 2.0 >> Client.\n\nRight-click in the right window pane.\n\nSelect: New >> DWORD (32-bit) Value.\n\nIn the \"Name\" field, enter \"DisabledByDefault\".\n\nPress \"Enter\".\n\nRight-click on the newly created \"Name\".\n\nSelect \"Modify...\".\n\nEnter \"1\" in \"Value data:\" and ensure that under \"Base\" the \"Hexadecimal\" radio button is selected.\n\nClick \"OK\".\n\nRight-click in the right window pane.\n\nSelect: New >> DWORD (32-bit) Value.\n\nIn the \"Name\" field, enter \"Enabled\".\n\nPress \"Enter\".\n\nRight-click on the newly created \"Name\".\n\nSelect \"Modify...\".\n\nLeave default value of \"0\" in \"Value data:\".\n\nEnsure that under \"Base\" the \"Hexadecimal\" radio button is selected.\n\nClick \"OK\".","ccis":["CCI-002418"]},{"vulnId":"V-234131","ruleId":"SV-234131r961632_rule","severity":"medium","ruleTitle":"The Tanium application must be configured to communicate using TLS 1.2 Strict Only.","description":"Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 defines the approved TLS versions for government applications.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.","checkContent":"Access the Tanium Server, Tanium Module Server and Tanium SQL Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium Application Server.\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium SQL Server.\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium Module Server.\n\nName: SchUseStrongCrypto\nType: REG_DWORD\nData: 0x0000001 (hex)\n\nIf the value for \"SchUseStrongCrypto\" is not set to \"0x00000001\" (hex) and \"Type\" is not configured to \"REG_DWORD\" or does not exist, this is a finding.","fixText":"Access the Tanium Server, Tanium SQL Server, and Tanium Module Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium Application Server.\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium SQL Server.\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> .NETFramework >> v4.0.xxxxx (the sub-version number may vary, but it is a 4.0 version; example: 4.0.30319) for Tanium Module Server.\nRight-click in the right window pane.\n\nSelect: New >> DWORD (32-bit) Value.\n\nIn the \"Name\" field, enter \"SchUseStrongCrypto\".\n\nPress \"Enter\".\n\nRight-click on the newly created \"Name\".\n\nSelect \"Modify...\".\n\nEnter \"1\" in \"Value data:\".\n\nEnsure that under \"Base\" the \"Hexadecimal\" radio button is selected.\n\nClick \"OK\".","ccis":["CCI-002418"]},{"vulnId":"V-234132","ruleId":"SV-234132r961632_rule","severity":"medium","ruleTitle":"The Tanium application must be configured to communicate using TLS 1.2 Strict Only.","description":"Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 defines the approved TLS versions for government applications.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.","checkContent":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.\n\nName: SSLCipherSuite\nType: String\nValue:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSAAES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK\n\nIf the String \"SSLCipherSuite\" does not exist with the appropriate list values, this is a finding.","fixText":"Access the Tanium Server interactively.\n\nLog on to the server with an account that has administrative privileges.\n\nAccess the server's registry by typing: \"regedit\".\n\nPress \"Enter\".\n\nNavigate to: HKEY_LOCAL_MACHINE >> Software >> Wow6432Node >> Tanium >> Tanium Server.\n\nRight-click in the right window pane.\n\nSelect: New >> String Value.\n\nIn the \"Name\" field, enter \"SSLCipherSuite\".\n\nPress \"Enter\".\n\nRight-click on the newly created \"Name\".\n\nSelect \"Modify...\".\n\nAdd the following: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSAAES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK\n\nClick \"OK\".","ccis":["CCI-002418"]}]}