Tanium 7.0 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients, which will ensure the authenticity of communications sessions when answering requests from the Tanium Server.
All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries...Rule Medium Severity -
Tanium endpoint files must be excluded from on-access antivirus actions.
Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. That is to say that Antivirus, IPS,...Rule Medium Severity -
Tanium must restrict the ability of individuals to place too much impact upon the network, which might result in a denial-of-service (DoS) event on the network by using RandomSensorDelayInSeconds.
DoS is a condition where a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Individuals...Rule Medium Severity -
The Tanium Server must be configured with a connector to sync to Microsoft Active Directory for account management functions, must isolate security functions from non-security functions, and must terminate shared/group account credentials when members leave the group.
By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational resp...Rule Medium Severity -
Tanium console users User Roles must be validated against the documentation for User Roles.
System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recomm...Rule Medium Severity -
Common Access Card (CAC)-based authentication must be enforced and enabled on the Tanium Server for network and local access with privileged and non-privileged accounts.
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational user...Rule High Severity -
The publicly accessible Tanium application must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.
Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with appl...Rule Medium Severity -
Flaw remediation Tanium applications must employ automated mechanisms to determine the state of information system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).
Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the system components may remain vulnerable to the exploits presented by undetected softwar...Rule Medium Severity -
Tanium must notify system administrators and ISSO when accounts are modified.
Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simpl...Rule Medium Severity -
Tanium must notify the SA and ISSO of account enabling actions.
Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simpl...Rule Medium Severity -
Tanium must notify System Administrators and Information System Security Officers for account disabling actions.
When application accounts are disabled, user accessibility is affected. Accounts are used for identifying individual application users or for identifying the application processes themselves. In o...Rule Medium Severity -
The Tanium SQL server must be dedicated to the Tanium database.
Failure to protect organizational information from data mining may result in a compromise of information. Data storage objects include, for example, databases, database records, and database field...Rule Medium Severity -
The Tanium Server installers account SQL database permissions must be reduced from sysadmin to db_owner.
Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have be...Rule Medium Severity -
The Tanium Server console must be configured to initiate a session lock after a 15-minute period of inactivity.
The Tanium Console, when CAC is enabled, will initiate a session lock based upon the ActivClient or other Smart Card software. By initiating the session lock, the console will be locked and not al...Rule Medium Severity -
Tanium Trusted Content providers must be documented.
A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information ...Rule Medium Severity -
Tanium public keys of content providers must be validated against documented trusted content providers.
A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information ...Rule Medium Severity -
The Tanium Action Approval feature must be enabled for two person integrity when deploying actions to endpoints.
The Tanium Action Approval feature provides a "four eyes" control mechanism designed to achieve a high level of security and reduce the possibility of error for critical operations. When this feat...Rule Medium Severity -
The Tanium Server must protect audit tools from unauthorized access, modification, or deletion.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
The Tanium Server must be configured to only allow signed content to be imported.
Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate that is reco...Rule Medium Severity -
The Tanium Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.