Tanium 7.x Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The Tanium Server installer's account database permissions must be reduced to an appropriate level.
Creating the "tanium" and "tanium_archive" databases through the Tanium Server installer program or using the database to create SQL scripts requires Sysadmin-level permissions. Once the databases ...Rule Medium Severity -
Firewall rules must be configured on the Tanium Server for server-to-database communications.
The Tanium Server can use either a SQL Server relational database management system (RDBMS) installed locally to the same device as the Tanium Server application or a remote dedicated or shared SQL...Rule Medium Severity -
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information ...Rule Medium Severity -
The Tanium applications must be configured to filter audit records for events of interest based on organization-defined criteria.
The ability to specify the event criteria that are of interest enables those reviewing the logs to quickly isolate and identify these events without having to review entries that are of little or n...Rule Medium Severity -
The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.
All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries...Rule Medium Severity -
Firewall rules must be configured on the Tanium Server for client-to-server communications.
In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. Without proper firewall co...Rule Medium Severity -
The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM Category Assurance List (CAL) and vulnerability assessments.
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restr...Rule Medium Severity -
The Tanium Server directory must be restricted with appropriate permissions.
Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which...Rule Medium Severity -
The SSLHonorCipherOrder must be configured to disable weak encryption algorithms on the Tanium Server.
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The application must implement cryptographic modules adhering to the higher standards appr...Rule Medium Severity -
The Tanium Server certificate must be signed by a DoD certificate authority (CA).
The Tanium Server has the option to use a "self-signed" certificate or a trusted CA signed certificate for SSL connections. During evaluations of Tanium in lab settings, customers often conclude th...Rule Medium Severity -
The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server.
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The application must implement cryptographic modules adhering to the higher standards appr...Rule Medium Severity -
The Tanium "max_soap_sessions_per_user" setting must be explicitly enabled to limit the number of simultaneous sessions.
Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in li...Rule Medium Severity -
The Tanium Threat Response Local Directory Source must be configured to restrict access to only authorized maintainers of threat intel.
Using trusted and recognized indicator of compromise (IOC) sources may detect and prevent systems from becoming compromised. An IOC stream is a series or stream of intel that is imported from a ven...Rule Medium Severity -
Tanium Comply must be configured to receive Security Content Automation Protocol (SCAP) content only from trusted sources.
SCAP XML documents validated by the National Institute of Standards and Technology (NIST) are provided from several possible sources such as DISA, NIST, and other nongovernment entities. These docu...Rule Medium Severity -
The Tanium application must limit the bandwidth used in communicating with endpoints to prevent a denial-of-service (DoS) condition at the server.
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This require...Rule Medium Severity -
The Tanium application service must be protected from being stopped by a nonprivileged user.
Denial of service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded cap...Rule Medium Severity -
The SchUseStrongCrypto registry value must be set.
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered. This requirement...Rule High Severity -
SRG-APP-000416
Group -
SRG-APP-000359
Group -
SRG-APP-000111
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.