Tanium 7.x Application on TanOS Security Technical Implementation Guide

Version

TANS-AP-000040

Vuln IDs

V-254877

Rule IDs

SV-254877r1067684_rule

Without cryptographic integrity protections in the Tanium Client, information could be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of Tanium communications information include signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Checks: C-58490r1067682_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter Items" search box type "require_client_tls_315_flag". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "require_client_tls_315_flag" but the value is not "1", this is a finding.

Fix: F-58434r1067683_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. Click "Create Setting". 6. Select "Server" box for "Setting Type." 7. In "Create Platform Setting" dialog box, enter "require_client_tls_315_flag" for "Name". 8. Select "Numeric" radio button for "Value Type". 9. Enter "1" for "Value". 10. Click "Save".

b

Tanium Trusted Content providers must be documented.

AC-17 - Medium - CCI-001453 - V-254878 - SV-254878r960762_rule

RMF Control

AC-17

Severity

M

CCI

Version

TANS-AP-000045

Vuln IDs

V-254878

Rule IDs

SV-254878r960762_rule

A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique "ring" architecture for display in the Tanium Console. The language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors. Because errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.

Checks: C-58491r867532_chk

Note: If only using Tanium-provided content and not accepting content from any other content providers, this is Not Applicable. Consult with the Tanium System Administrator to review the documented list of trusted content providers along with the Hash for their respective public keys. If the site does not have the Tanium trusted content providers documented along with the SHA-256 Hash for their respective public keys, this is a finding.

Fix: F-58435r867533_fix

Prepare and maintain documentation identifying the Tanium trusted content providers along with the SHA-256 Hash from their respective public keys.

b

Content providers must provide their public key to the Tanium administrator to import for validating signed content.

AC-17 - Medium - CCI-001453 - V-254879 - SV-254879r960762_rule

RMF Control

AC-17

Severity

M

CCI

Version

TANS-AP-000050

Vuln IDs

V-254879

Rule IDs

SV-254879r960762_rule

A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique "ring" architecture for display in the Tanium Console. The language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors. Because errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.

Checks: C-58492r867535_chk

Note: If only using Tanium-provided content and not accepting content from any other content providers, this is Not Applicable. Obtain documentation from the Tanium System Administrator that contains the public key validation data. 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "5" for "Manage Custom Signing Keys," and then press "Enter". 5. Press "L" for "List Content Signing Keys," and then press "Enter". If signing keys not listed in the provided documentation are present, this is a finding.

Fix: F-58436r867536_fix

Note: If only using Tanium-provided content and not accepting content from any other content providers, this is Not Applicable. Obtain documentation from the Tanium System Administrator that contains the public key validation data. 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "5" for "Manage Custom Signing Keys," and then press "Enter". 5. Press "A" for "List Content Signing Keys," and then press "Enter". 6. Check the provided documentation and either update the document with the name and SHA-256 hash of the key or remove the key.

b

Tanium public keys of content providers must be validated against documented trusted content providers.

AC-17 - Medium - CCI-001453 - V-254880 - SV-254880r960762_rule

RMF Control

AC-17

Severity

M

CCI

Version

TANS-AP-000055

Vuln IDs

V-254880

Rule IDs

SV-254880r960762_rule

A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique "ring" architecture for display in the Tanium Console. The language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors. Because errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.

Checks: C-58493r867538_chk

Note: If only using Tanium-provided content and not accepting content from any other content providers, this is Not Applicable. Obtain documentation from the Tanium System Administrator that contains the public key validation data. 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "5" for "Manage Custom Signing Keys," and then press "Enter". 5. Press "L" for "List Content Signing Keys," and then press "Enter". If signing keys not listed in the provided documentation are present, this is a finding.

Fix: F-58437r867539_fix

Note: If only using Tanium-provided content and not accepting content from any other content providers, this is Not Applicable. Obtain documentation from the Tanium System Administrator that contains the public key validation data. 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "5" for "Manage Custom Signing Keys," and then press "Enter". 5. Press "A" for "List Content Signing Keys," and then press "Enter". 6. Check the provided documentation and either update the document with the name and SHA-256 hash of the key or remove the key.

b

The Tanium Application Server must be configured to only use LDAP for account management functions.

AC-2 - Medium - CCI-000015 - V-254881 - SV-254881r1043176_rule

RMF Control

AC-2

Severity

M

CCI

Version

TANS-AP-000065

Vuln IDs

V-254881

Rule IDs

SV-254881r1043176_rule

Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. To reduce risk, the Tanium Application Server must be configured to allow for LDAP to provide account management functions that immediately enforce the organization's current account policy.

Checks: C-58494r867541_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Ensure LDAP sync is enabled. If LDAP is not enabled, this is a finding.

Fix: F-58438r867542_fix

Vendor documentation can be downloaded from the following URL: https://docs.tanium.com/platform_user/platform_user/console_using_ldap.html?Highlight=LDAP 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Follow the vendor documentation titled "Integrating with LDAP Servers" to implement correct configuration settings for this requirement.

b

Tanium Computer Groups must be used to restrict console users from affecting changes to unauthorized computers.

AC-3 - Medium - CCI-000213 - V-254882 - SV-254882r960792_rule

RMF Control

AC-3

Severity

M

CCI

Version

TANS-AP-000100

Vuln IDs

V-254882

Rule IDs

SV-254882r960792_rule

Computer Groups allow a site running Tanium to assign responsibility of specific Computer Groups to specific Tanium console users. By doing so, a desktop administrator, for example, will not have the ability to enforce an action against a high visibility server. For large sites, it is crucial to have the Computer Groups. While a smaller site might not seem to require Computer Groups, creating them provides for a cleaner implementation. All sites will be required to have some kind of Computer Groups configured other than the default "All Computers".

Checks: C-58495r867544_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Select the "Computer Groups" tab. 4. Under the "Name" column, verify organization-specific computer groups match the organization-defined list in the system security plan (SSP). If site- or organization-specific computer groups do not match or exist, this is a finding.

Fix: F-58439r867545_fix

1. Using a web browser on a system that has connectivity to the Tanium Server, access the Tanium Server web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Select the "Computer Groups" tab. 4. Configure specific Computer Groups to facilitate the management of computers by authorized individuals for those computers. Note: Tanium offers two ways to define computer groups. Refer to documentation for explanation found here: https://docs.tanium.com/platform_user/platform_user/console_computer_groups.html#Computer_Group_types.

b

Documentation identifying Tanium console users, their respective User Groups, Computer Groups, and Roles must be maintained.

AC-3 - Medium - CCI-000213 - V-254883 - SV-254883r960792_rule

RMF Control

AC-3

Severity

M

CCI

Version

TANS-AP-000105

Vuln IDs

V-254883

Rule IDs

SV-254883r960792_rule

System access must be reviewed periodically to verify all Tanium users are assigned the appropriate functional role, with the least privileged access possible to perform assigned tasks being the recommended best practice to avoid unauthorized access.

Checks: C-58496r867547_chk

Consult with the Tanium System Administrator to review the documented list of Tanium users. User Groups, Roles, Computer Groups, and correlated LDAP security groups must be documented for users. If the documentation does not exist, or is missing any Tanium users and their respective User Groups, Roles, Computer Groups, and correlated LDAP security groups documentation, this is a finding.

Fix: F-58440r867548_fix

Prepare and maintain documentation identifying the Tanium console users and their respective User Groups, Roles, Computer Groups, and associated LDAP security groups.

b

The Tanium application must be configured to use Tanium User Groups in a manner consistent with the model outlined within the environment's system documentation.

AC-3 - Medium - CCI-000213 - V-254884 - SV-254884r960792_rule

RMF Control

AC-3

Severity

M

CCI

Version

TANS-AP-000110

Vuln IDs

V-254884

Rule IDs

SV-254884r960792_rule

It is important for information system owners to document authorized user groups for the Tanium application to avoid unauthorized access to systems. Misaligned implementation of user groups grants excessive access and results in potential compromise of "need-to-know" when it comes to information access.

Checks: C-58497r867550_chk

Consult with the Tanium System Administrator to review the documented list of Tanium User Groups. 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Permissions, select "User Groups". 4. Click each User Group and compare both the User Group name and the assigned Role(s) to the system documentation. If any users have access to Tanium and their User Group is not on the list of documented User Groups with the appropriate Role(s), this is a finding.

Fix: F-58441r867551_fix

Consult the documentation identifying the Tanium User Groups and their respective Role(s). 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Permissions, select "User Groups". 4. Click each User Group and add any missing Role(s). 5. For any missing User Groups, make the appropriate adjustments in LDAP.

b

Documentation identifying Tanium console users and their respective Computer Group rights must be maintained.

AC-3 - Medium - CCI-000213 - V-254885 - SV-254885r960792_rule

RMF Control

AC-3

Severity

M

CCI

Version

TANS-AP-000115

Vuln IDs

V-254885

Rule IDs

SV-254885r960792_rule

System access must be reviewed periodically to verify all Tanium users are assigned the appropriate computer groups, with the least privileged access possible to perform assigned tasks. Users who have been removed from the documentation should no longer be configured as a Tanium Console User.

Checks: C-58498r867553_chk

Consult with the Tanium System Administrator to review the documented list of Tanium users and their respective, approved Computer Group rights. If the documented list does not have the Tanium users and their respective approved Computer Group rights documented, this is a finding.

Fix: F-58442r867554_fix

Prepare and maintain documentation identifying the Tanium console users and their respective Computer Group rights.

b

The Tanium Action Approval feature must be enabled for two-person integrity when deploying actions to endpoints.

AC-3 - Medium - CCI-000213 - V-254886 - SV-254886r1067687_rule

RMF Control

AC-3

Severity

M

CCI

Version

TANS-AP-000120

Vuln IDs

V-254886

Rule IDs

SV-254886r1067687_rule

The Tanium Action Approval feature provides a two-person integrity control mechanism designed to achieve a high-level of security and reduce the possibility of error for critical operations. When this feature is enabled, an action configured by one Tanium console user will require a second Tanium console user with a role of Action Approver (or higher) to approve the action before it is deployed to targeted computers. While this system slows workflow, the reliability of actions deployed will be greater on the Packaging and Targeting. Satisfies: SRG-APP-000033, SRG-APP-000488

Checks: C-58499r1067685_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter items" search box type "require_action_approval". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "require_action_approval", but the value is not "1", this is a finding.

Fix: F-58443r1067686_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. If "require_action_approval" does not exist, click "Create Setting". 6. Select "Server" for "Setting Type". 7. In the "Create Platform Setting" dialog box, enter "require_action_approval" for "Name". 8. Select "Numeric" radio button from "Value Type". 9. Select "Value" and enter "1". 10. Click "Save".

b

The Tanium documentation identifying recognized and trusted IOC streams must be maintained.

AC-4 - Medium - CCI-001414 - V-254887 - SV-254887r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000130

Vuln IDs

V-254887

Rule IDs

SV-254887r960804_rule

Using trusted and recognized IOC sources may detect and prevent systems from becoming compromised. An IOC stream is a series or stream of IOCs that are imported from a vendor based on a subscription service. An IOC stream can be downloaded manually or on a scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.

Checks: C-58500r867559_chk

Consult with the Tanium System Administrator to determine if the Threat Response module is being used. If not, this is Not Applicable. Review the documented list of IOC trusted stream sources. If the site does use an external source for IOCs and the IOC trusted stream source is not documented, this is a finding.

Fix: F-58444r867560_fix

Prepare and maintain documentation identifying the Threat Response trusted stream sources.

b

Tanium Threat Response must be configured to receive IOC streams only from trusted sources.

AC-4 - Medium - CCI-001414 - V-254888 - SV-254888r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000135

Vuln IDs

V-254888

Rule IDs

SV-254888r960804_rule

Using trusted and recognized IOC sources may detect and prevent systems from becoming compromised. An IOC stream is a series or stream of intel that is imported from a vendor based on a subscription service or manually downloaded and placed in a folder. Threat Response can be configured to retrieve the IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.

Checks: C-58501r867562_chk

Consult with the Tanium System Administrator to determine if the Threat Response module is being used, if not this is Not Applicable. 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Threat Response". 4. Expand the left menu. 5. Click "Intel". 6. Select "Sources". 7. Verify all configured Threat Response Streams are configured to a documented trusted source. If Threat Response is configured to a stream that has not been documented as trusted, this is a finding.

Fix: F-58445r867563_fix

Consult the documentation on trusted intel subscription feeds. 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Threat Response". 4. Expand the left menu. 5. Click "Intel". 6. Select "Sources". 7. Click "New Source". 8. Select the specified Source from the list. 9. Fill out the specified information based on the documented trusted intel feeds. 10. Select "Create".

b

The Tanium documentation identifying recognized and trusted folders for Threat Response Local Directory Source must be maintained.

AC-4 - Medium - CCI-001414 - V-254889 - SV-254889r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000140

Vuln IDs

V-254889

Rule IDs

SV-254889r960804_rule

Using trusted and recognized IOC sources may detect and prevent systems from becoming compromised. An IOC stream is a series or stream of IOCs that are imported from a vendor based on a subscription service or manually downloaded and placed in a folder. Threat Response can be configured to retrieve the IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.

Checks: C-58502r867565_chk

Consult with the Tanium System Administrator to review the documented list of folder maintainers for Threat Response Local Directory Source. If the site does not leverage Local Directory Source to import IOCs, this finding is Not Applicable. If the site does use Local Directory Source to import IOCs and the folder maintainers are not documented, this is a finding.

Fix: F-58446r867566_fix

Prepare and maintain documentation identifying the Tanium Threat Response Local Directory Source maintainers.

b

The Tanium documentation identifying recognized and trusted SCAP sources must be maintained.

AC-4 - Medium - CCI-001414 - V-254891 - SV-254891r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000150

Vuln IDs

V-254891

Rule IDs

SV-254891r960804_rule

NIST validated SCAP XML documents are provided from several possible sources such as DISA, NIST, and the other nongovernment entities. These documents are used as the basis of compliance definitions leveraged to automate compliance auditing of systems. These documents are updated on different frequencies and must be manually downloaded on regular intervals and imported to be current. Nonapproved SCAP definitions lead to a false sense of security when evaluating an enterprise environment.

Checks: C-58504r867571_chk

Consult with the Tanium System Administrator to review the documented list of trusted SCAP sources. If the site does not have the "Tanium Comply" module, or does not use Tanium Comply for compliance validation, this finding is Not Applicable. If the site does use Tanium Comply and the source for SCAP content is not documented, this is a finding.

Fix: F-58448r867572_fix

If the site does not have the Tanium Comply module, or does not use Tanium Comply for compliance validation, this finding is Not Applicable. Prepare and maintain documentation identifying the source of SCAP sources that will be used by the Tanium Comply module.

b

The Tanium documentation identifying recognized and trusted OVAL feeds must be maintained.

AC-4 - Medium - CCI-001414 - V-254892 - SV-254892r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000155

Vuln IDs

V-254892

Rule IDs

SV-254892r960804_rule

OVAL XML documents are provided from several possible sources such as the CIS open source repository, or any number of vendor/third-party paid repositories. These documents are used to automate the passive validation of vulnerabilities on systems and therefore require a reasonable level of confidence in their origin. Nonapproved OVAL definitions lead to a false sense of security when evaluating an enterprise environment.

Checks: C-58505r867574_chk

Consult with the Tanium System Administrator to review the documented list of trusted OVAL feeds. If the site does not have Tanium Comply module, or does not use Tanium Comply for passive vulnerability scanning, this finding is Not Applicable. Otherwise, if the site does use Tanium Comply and the source for OVAL content is not documented, this is a finding.

Fix: F-58449r867575_fix

If the site does not have Tanium Comply module, or does not use Tanium Comply for passive vulnerability scanning, this finding is Not Applicable. Prepare and maintain documentation identifying the source of OVAL feeds that will be used by Tanium Comply module.

b

Tanium Comply must be configured to receive SCAP content only from trusted sources.

AC-4 - Medium - CCI-001414 - V-254893 - SV-254893r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000160

Vuln IDs

V-254893

Rule IDs

SV-254893r960804_rule

NIST-validated SCAP XML documents are provided from several possible sources such as DISA, NIST, and the other nongovernment entities. These documents are used as the basis of compliance definitions leveraged to automate compliance auditing of systems. These documents are updated on different frequencies and must be manually downloaded on regular intervals and imported to be current. Nonapproved SCAP definitions lead to a false sense of security when evaluating an enterprise environment.

Checks: C-58506r867577_chk

1. Using a web browser on a system, that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top banner of the console. 3. Click "Comply". 4. Click the menu on the left side of the interface and then click "Compliance" under "Standards". Verify all imported compliance benchmarks are from a documented trusted source. If any compliance benchmark is found that does not come from a documented trusted source, this is a finding.

Fix: F-58450r867578_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top banner of the console. 3. Click "Comply". 4. Click the menu on the left side of the interface and then click "Compliance" under "Standards". 5. Delete any compliance benchmarks that come from nontrusted sources.

b

Tanium Comply must be configured to receive OVAL feeds only from trusted sources.

AC-4 - Medium - CCI-001414 - V-254894 - SV-254894r960804_rule

RMF Control

AC-4

Severity

M

CCI

Version

TANS-AP-000165

Vuln IDs

V-254894

Rule IDs

SV-254894r960804_rule

OVAL XML documents are provided from several possible sources such as the CIS open source repository, or any number of vendor/third party paid repositories. These documents are used to automate the passive validation of vulnerabilities on systems and therefore require a reasonable level of confidence in their origin. Nonapproved OVAL definitions lead to a false sense of security when evaluating an enterprise environment.

Checks: C-58507r867580_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Comply". 4. Expand the left menu. 5. Under "Standards," click "Vulnerability". 6. Verify all imported vulnerability sources are from a documented trusted source. If any vulnerability sources are found that do not come from a documented trusted source, this is a finding.

Fix: F-58451r867581_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Comply". 4. Expand the left menu. 5. Under "Standards," click "Vulnerability". 6. Delete any vulnerability sources configured to nontrusted sources, or reconfigure to point to trusted sources.

b

The publicly accessible Tanium application must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application.

AC-8 - Medium - CCI-000048 - V-254895 - SV-254895r1067691_rule

RMF Control

AC-8

Severity

M

CCI

CCI-000048

Version

TANS-AP-000175

Vuln IDs

V-254895

Rule IDs

SV-254895r1067691_rule

Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Satisfies: SRG-APP-000068, SRG-APP-000070

Checks: C-58508r1067689_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Verify DOD use notification is displayed prior to login. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If a DOD-approved use notification banner does not display prior to logon, this is a finding.

Fix: F-58452r1067690_fix

For Tanium Server versions greater than or equal to 7.5.6.1108: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Configuration, select "Settings". 4. Click "Advanced Settings". 5. In the Filter Items box on the top right, search for "console_PreLoginBannerHTMLText" and select it. 6. In the "Value" field, enter the statement below: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 9. Click "Save". Note: An html file can be uploaded in place of the above similar to previous versions of Tanium as shown below. Tanium Server versions below 7.5.6.110: 1. Create an .html file composed of the DOD-authorized warning banner verbiage. "<html>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.</html>" 2. Name the file "banner.html". 3. Use SFTP to upload the HTML banner file to the /incoming folder. 4. Log on to the TanOS server with the tanadmin user role. 5. Enter 2: Tanium Operations >> X: Advanced Operations >> 4: Manage HTML Banner and follow the prompts to copy the HTML banner file to the appropriate location. 6. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 7. Click "Administration" on the top navigation banner. 8. Under Configuration, select "Settings". 9. Select "Advanced Settings". 10. Search for "console_PreLoginBannerHTML". 11. Confirm "console_PreLoginBannerHTML" a value of "banner.html". Note: If the above setting is not present, create it using the following steps. 1. Click "Add Setting". 2. Select "Server" for "Setting Type". 3. In "Create Platform Setting" dialog box, enter "console_PreLoginBannerHTML" for "Platform Setting Name". 4. Select "Text" radio button from "Value Type". 5. Enter "banner.html" for "Value:". 6. Click "Save".

b

The publicly accessible Tanium application must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

AC-8 - Medium - CCI-000050 - V-254896 - SV-254896r1067694_rule

RMF Control

AC-8

Severity

M

CCI

CCI-000050

Version

TANS-AP-000180

Vuln IDs

V-254896

Rule IDs

SV-254896r1067694_rule

Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Checks: C-58509r1067692_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Verify DOD use notification is displayed prior to login. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. If a DOD-approved use notification banner does not display prior to logon, this is a finding.

Fix: F-58453r1067693_fix

For Tanium Server versions greater than or equal to 7.5.6.1108: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Configuration, select "Settings". 4. Click "Advanced Settings". 5. In the Filter Items box on the top right, search for "console_PreLoginBannerHTMLText" and select it. 6. In the "Value" field enter the statement below: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 9. Click "Save". Note: An html file can be uploaded in place of the above, similar to previous versions of Tanium as seen below. Tanium Server versions below 7.5.6.1108: 1. Create an .html file composed of the DOD-authorized warning banner verbiage. "<html>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.</html>" 2. Name the file "banner.html". 3. Use SFTP to upload the HTML banner file to the /incoming folder. 4. Log on to the TanOS server with the tanadmin user role. 5. Enter 2: Tanium Operations >> X: Advanced Operations >> 4: Manage HTML Banner and follow the prompts to copy the HTML banner file to the appropriate location. 6. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 7. Click "Administration" on the top navigation banner. 8. Under Configuration, select "Settings". 9. Select "Advanced Settings". 10. Search for "console_PreLoginBannerHTML". 11. Confirm "console_PreLoginBannerHTML" a value of "banner.html". Note: If the above setting is not present, create it using the following steps. 1. Click "Add Setting". 2. Select "Server" for "Setting Type". 3. In "Create Platform Setting" dialog box, enter "console_PreLoginBannerHTML" for "Platform Setting Name". 4. Select "Text" radio button from "Value Type". 5. Enter "banner.html" for "Value:". 6. Click "Save".

b

Multifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts.

AC-11 - Medium - CCI-000056 - V-254897 - SV-254897r1015861_rule

RMF Control

AC-11

Severity

M

CCI

CCI-000056

Version

TANS-AP-000195

Vuln IDs

V-254897

Rule IDs

SV-254897r1015861_rule

To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following. (i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity. Satisfies: SRG-APP-000080, SRG-APP-000148, SRG-APP-000149, SRG-APP-000150, SRG-APP-000151, SRG-APP-000152, SRG-APP-000156, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403, SRG-APP-000005, SRG-APP-000004, SRG-APP-000002

Checks: C-58510r986514_chk

1. Access the Tanium Server interactively. 2. Log on to the TanOS console with the "tanadmin" user role. 3. Enter "2" to access the "Tanium Operations" menu. 4. Enter "2" to access the "Tanium Configuration" Settings menu. 5. Enter "1" to access the "Edit Tanium Server Settings" menu. 6. Validate the value for "ForceSOAPSSLClientCert" is set to "1". 7. Validate the following keys exist and are configured: 7A. "ClientCertificateAuthField" For example: X509v3 Subject Alternative Name. 7B. "ClientCertificateAuthRegex" For example: .*:\s(\d+)@.* Note: This regex may vary. 7C. "ClientCertificateAuth" For example: /opt/Tanium/TaniumServer/cac.pem 7D. "TrustedHostList" For example: Append 127.0.0.1 (for IPv4) and [::1] (for IPv6) If the value for "ForceSOAPSSLClientCert" is not set to "1" and the remaining registry values are not configured, this is a finding.

Fix: F-58454r986515_fix

Use the vendor documentation titled "Multi-Factor Authentication" to implement correct configuration settings for this requirement. Vendor documentation can be downloaded from the following URL: https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html#cac_Tanium_Appliance 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin user role. 3. Enter "2" to access the "Tanium Operations" menu. 4. Enter "2" to access the "Tanium Configuration" Settings menu. 5. Enter "1" to access the "Edit Tanium Server Settings" menu. 6. Validate the value for "ForceSOAPSSLClientCert" is set to "1". 7. Validate the following keys exist and are configured: 7A. "ClientCertificateAuthField" For example: X509v3 Subject Alternative Name. 7B. "ClientCertificateAuthRegex" For example: .*:\s(\d+)@.* Note: This regex may vary. 7C. "ClientCertificateAuth" For example: /opt/Tanium/TaniumServer/cac.pem Note: The path name is case sensitive. 7D. "TrustedHostList" For example: Append 127.0.0.1 (for IPv4) and [::1] (for IPv6).

b

The Tanium application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.

AU-5 - Medium - CCI-000139 - V-254898 - SV-254898r960912_rule

RMF Control

AU-5

Severity

M

CCI

CCI-000139

Version

TANS-AP-000260

Vuln IDs

V-254898

Rule IDs

SV-254898r960912_rule

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.

Checks: C-58511r867592_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured Connections under "Connections" section. Work with the SIEM administrator to determine if an alert is configured when audit data is no longer received as expected. If there is no alert configured, this is a finding.

Fix: F-58455r867593_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Expand the left menu. 5. Click "Connections". 6. Configure a Connection for the "Tanium Audit Source" source from the Tanium Application to a SIEM tool. Work with the SIEM administrator to configure an alert when no audit data is received from Tanium based on the defined schedule of connections.

b

The Tanium application must be configured to send audit records from multiple components within the system to a central location for review and analysis of audit records.

AU-6 - Medium - CCI-000154 - V-254899 - SV-254899r960918_rule

RMF Control

AU-6

Severity

M

CCI

CCI-000154

Version

TANS-AP-000270

Vuln IDs

V-254899

Rule IDs

SV-254899r960918_rule

Successful incident response and auditing relies on timely, accurate system information and analysis to allow the organization to identify and respond to potential incidents in a proficient manner. If the application does not provide the ability to centrally review the application logs, forensic analysis is negatively impacted. Segregation of logging data to multiple disparate computer systems is counterproductive and makes log analysis and log event alarming difficult to implement and manage, particularly when the system or application has multiple logging components written to different locations or systems. Automated mechanisms for centralized reviews and analyses include, for example, Security Information Management products.

Checks: C-58512r870360_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured Connections under the "Connections" section. If no Connection exists to send the "Tanium Audit Source" to a SIEM tool, this is a finding.

Fix: F-58456r867596_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Click "Create Connection". 5. In the "Configuration" section under "Source," select "Tanium Audit Source" as the source from the drop-down menu. 6. In the "Configuration" section under "Destination," select the desired Destination and fill in the respective fields. 7. In the "Configure Output" section under "Format," select the desired file format type. 8. In the "Schedule" section, select the desired schedule. 9. Click "Create Connection".

b

The Tanium applications must provide the capability to filter audit records for events of interest based upon organization-defined criteria.

AU-7 - Medium - CCI-000158 - V-254900 - SV-254900r960924_rule

RMF Control

AU-7

Severity

M

CCI

CCI-000158

Version

TANS-AP-000280

Vuln IDs

V-254900

Rule IDs

SV-254900r960924_rule

The ability to specify the event criteria of interest provides the persons reviewing the logs with the ability to quickly isolate and identify these events without having to review entries that are of little or no consequence to the investigation. Without this capability, forensic investigations are impeded. Events of interest can be identified by the content of specific audit record fields including, for example, identities of individuals, event types, event locations, event times, event dates, system resources involved, IP addresses involved, or information objects accessed. Organizations may define audit event criteria to any degree of granularity required, for example, locations selectable by general networking location (e.g., by network or subnetwork) or selectable by specific information system component. This requires applications to provide the capability to customize audit record reports based on organization-defined criteria.

Checks: C-58513r867598_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Expand the left menu. 5. Click "Connections". 5. Review the configured Connections. If there are no configured connections, this is a finding.

Fix: F-58457r867599_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Expand the left menu. 5. Click "Connections". 6. Click "Create Connection" or if importing, click "Import". 7. Give the "Connection" a name and description. 8. In the "Configuration" section, select "Event" as the source. 9. Select appropriate source under "Event Group". Any source to generate interest-based events (Discover, Asset, IM, THR, etc.). 10. Select the appropriate events to send. Note: Consult with the Tanium System Administrator for the Destination. 11. Select "Listen for this Event". 12. Click "Save".

b

Access to Tanium logs on each endpoint must be restricted by permissions.

AU-9 - Medium - CCI-000163 - V-254901 - SV-254901r960933_rule

RMF Control

AU-9

Severity

M

CCI

CCI-000163

Version

TANS-AP-000295

Vuln IDs

V-254901

Rule IDs

SV-254901r960933_rule

For the Tanium Client software to run without impact from external negligent or malicious changes, the permissions on the Tanium log files and their directory must be restricted. Tanium is deployed with a Client Hardening Solution. This solution, when applied, will ensure directory permissions are in place.

Checks: C-58514r870361_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Actions, select "Scheduled Actions". 4. Look for a scheduled action titled "Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory". If a scheduled action titled "Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory" does not exist, or there is a Scheduled Action contradicting the "Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory" scheduled action, this is a finding. If the scheduled action exists, select it and if it is not approved (the "Approve" button at the top of the section will be displayed if not approved), this is a finding.

Fix: F-58458r867602_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Ask the question "Get Tanium Client Directory Permissions from all machines". Tanium will parse the script and return a row for "Restricted" and a row for "Not Restricted", with their respective client counts. 3. Click the "Not Restricted" row. 4. Select "Deploy Action". In the "Deploy Action" dialog box, the package "Client Service Hardening - Set SYSTEM only permissions on Tanium Client directory" will be selected. The clients, which have their Tanium Client directory "Not Restricted" will be displayed in the bottom window. 5. Choose a schedule to deploy the hardening. 6. Under "Targeting Criteria," in the Action Group, select "All Computers" from the drop-down. 7. Click "Deploy Action". 8. Verify settings. 9. Click "Show Client Status Details".

b

The Tanium application must prohibit user installation, modification, or deletion of software without explicit privileged status.

AU-9 - Medium - CCI-001493 - V-254902 - SV-254902r960939_rule

RMF Control

AU-9

Severity

M

CCI

CCI-001493

Version

TANS-AP-000305

Vuln IDs

V-254902

Rule IDs

SV-254902r960939_rule

Allowing regular users to install, modify, or delete software, without explicit privileges, creates the risk that the application performs in an inconsistent manner from its design. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. Application functionality will vary, and while users are not permitted to install unapproved applications, there may be instances where the organization allows the user to install approved software packages such as from an approved software repository. The application must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. Satisfies: SRG-APP-000121, SRG-APP-000122, SRG-APP-000123

Checks: C-58515r867604_chk

1. Consult with the Tanium System Administrator to review the documented list of Tanium users. 2. Review the users' respective approved roles, as well as the correlated LDAP security group for the User Roles. 3. Validate LDAP security groups/Tanium roles are documented to assign least privileged access to the functions of the Tanium Server through the Tanium interface. If the documentation does not reflect a granular, least privileged access approach to the LDAP Groups/Tanium Roles assignment, this is a finding.

Fix: F-58459r867605_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Permissions, select "Users". 4. Analyze the users configured in the Tanium interface. 5. Determine least privileged access required for each user to perform their respective duties. 6. Move users to the appropriate LDAP security group to ensure the user is synced to the appropriate Tanium User Role. 7. If the appropriate LDAP security groups are not already configured, create the groups and add the appropriate users. 8. Ensure LDAP sync repopulates the Tanium Users' associated Roles accordingly.

b

The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.

SC-23 - Medium - CCI-001184 - V-254903 - SV-254903r1067697_rule

RMF Control

SC-23

Severity

M

CCI

CCI-001184

Version

TANS-AP-000330

Vuln IDs

V-254903

Rule IDs

SV-254903r1067697_rule

All of Tanium's signing capabilities must be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct Man in the Middle (MitM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium. Tanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc., before execution will be enforced by Tanium. Signing will prevent MitM remote code execution attacks and will protect data element in transit. Tanium also supports object level signing for content within the Tanium platform. Satisfies: SRG-APP-000131, SRG-APP-000219

Checks: C-58516r1067695_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter Items" search box type "AllQuestionsRequireSignatureFlag". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "AllQuestionsRequireSignatureFlag" but the value is not "1", this is a finding.

Fix: F-58460r1067696_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. Click "Create Setting". 6. Select "Client" for "Setting Type." 7. In the "Create Platform Setting" dialog box, enter "AllQuestionsRequireSignatureFlag" for "Name". 8. Select "Numeric" radio button for "Value Type". 9. Enter "1" for "Value". 10. Click "Save".

b

The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.

SC-3 - Medium - CCI-001084 - V-254904 - SV-254904r1067700_rule

RMF Control

SC-3

Severity

M

CCI

CCI-001084

Version

TANS-AP-000335

Vuln IDs

V-254904

Rule IDs

SV-254904r1067700_rule

All of Tanium's signing capabilities must be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct man-in-the-middle (MITM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object-level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium. Tanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc., before execution will be enforced by Tanium. Signing will prevent MITM remote code execution attacks and will protect data element in transit. Tanium also supports object-level signing for content within the Tanium platform. Satisfies: SRG-APP-000131, SRG-APP-000233, SRG-APP-000317

Checks: C-58517r1067698_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter Items" search box, enter "sign_all_questions_flag". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "sign_all_questions_flag" but the value is not "1", this is a finding.

Fix: F-58461r1067699_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. Click "Create Setting". 6. Select "Server" for "Setting Type." 7. In "Create Platform Setting" dialog box, enter "sign_all_questions_flag" for "Name". 8. Select the "Numeric" radio button for "Value Type". 9. Enter "1" for "Value". 10. Click "Save".

b

Firewall rules must be configured on the Tanium Endpoints for Client-to-Server communications.

CM-7 - Medium - CCI-000382 - V-254905 - SV-254905r1043177_rule

RMF Control

CM-7

Severity

M

CCI

Version

TANS-AP-000355

Vuln IDs

V-254905

Rule IDs

SV-254905r1043177_rule

In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. Without proper firewall configurations, proper TCP communications may not take place as necessary for application functionality. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer’s topology—endpoints in California will form one ring while endpoints in Germany will form a separate ring.

Checks: C-58518r867613_chk

Note: This check is performed for the Tanium Endpoints and must be validated against the enterprise firewall solution (e.g., Endpoint Security Solution Firewall, Microsoft Windows Defender Firewall setting, Microsoft Advance Threat Protection Firewall, etc.) policies applied to the Endpoints. 1. Consult with the personnel who maintain the Enterprise Security Suite configuration for assistance. 2. Validate a rule exists within the firewall policies for managed clients for the following: 2A. Port Needed: Tanium Clients or Zone Clients over TCP port 17472, bi-directionally. If a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, this is a finding. 3. Consult with the boundary network firewall administrator and validate rules exist for the following: 3A. Allow TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network. If a network firewall rule does not exist to allow TCP port 17472 from any managed computer to any other managed computer on the same local area network, this is a finding.

Fix: F-58462r867614_fix

1. Consult with the personnel who maintain the Enterprise Security Suite to configure host-based and network firewall rules to allow the following: 1A. Tanium Clients or Zone Clients over TCP port 17472, bi-directionally. 2. Consult with the boundary network firewall administrator to create a rule to allow the following: 2A. TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network.

b

Firewall rules must be configured on the Tanium Server for Client-to-Server communications.

CM-7 - Medium - CCI-000382 - V-254906 - SV-254906r1043177_rule

RMF Control

CM-7

Severity

M

CCI

Version

TANS-AP-000360

Vuln IDs

V-254906

Rule IDs

SV-254906r1043177_rule

In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. Without proper firewall configurations, proper TCP communications may not take place as necessary for application functionality. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology—endpoints in California will form one ring while endpoints in Germany will form a separate ring. https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/network_ports.html

Checks: C-58519r867616_chk

Note: This check is performed for the Tanium Endpoints and must be validated against the enterprise firewall solution (e.g., Endpoint Security Solution Firewall, Microsoft Windows Defender Firewall setting, Microsoft Advance Threat Protection Firewall, etc.) policies applied to the Endpoints. 1. Consult with the personnel who maintain the Enterprise Security Suite configuration for assistance. 2. Validate a rule exists within the firewall policies for managed clients for the following: 2A. Port Needed: Tanium Clients or Zone Clients over TCP port 17472, bi-directionally. If a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, this is a finding. 3. Consult with the boundary network firewall administrator and validate rules exist for the following: 3A. Allow TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network. If a network firewall rule does not exist to allow TCP port 17472 from any managed computer to any other managed computer on the same local area network, this is a finding.

Fix: F-58463r867617_fix

1. Consult with the personnel who maintain the Enterprise Security Suite to configure host-based and network firewall rules to allow the following: 1A. Tanium Clients or Zone Clients over TCP port 17472, bi-directionally. 2. Consult with the boundary network firewall administrator to create a rule to allow the following: 2A. TCP traffic on port 17472 from any computer to be managed on a local area network to any other computer to be managed on the same local area network.

b

Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.

CM-7 - Medium - CCI-000382 - V-254907 - SV-254907r1043177_rule

RMF Control

CM-7

Severity

M

CCI

Version

TANS-AP-000365

Vuln IDs

V-254907

Rule IDs

SV-254907r1043177_rule

In customer environments using the Tanium Zone Server, a Tanium Client may be configured to point to a Zone Server instead of a Tanium Server. The communication requirements for these Clients are identical to the Server-to-Client requirements. Without proper firewall configurations, proper TCP communications may not take place as necessary for application functionality. Additionally, without proper configuration, organizations may lose complete visibility into endpoints that cannot connect directly to the Tanium Server. https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/network_ports.html

Checks: C-58520r867619_chk

Note: If a Zone Server is not being used, this is Not Applicable. 1. Consult with the Tanium System Administrator to verify which firewall is being used as a host-based firewall on the Tanium Zone Server. 2. Access the host-based firewall configuration on the Tanium Zone Server. 3. Validate a rule exists for the following: 3A. Port Needed: Tanium Clients to Zone Server over TCP port 17472, bi-directionally. If a host-based firewall rule does not exist to allow TCP port 17472, bi-directionally, from Tanium Clients to the Tanium Zone Server, this is a finding.

Fix: F-58464r867620_fix

1. Consult with the personnel who maintain the Enterprise Security Suite to configure host-based and network firewall rules to allow the following: 1A. Tanium Clients or Zone Clients over TCP port 17472, bi-directionally.

b

The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CM-7 - Medium - CCI-000382 - V-254908 - SV-254908r1067702_rule

RMF Control

CM-7

Severity

M

CCI

Version

TANS-AP-000370

Vuln IDs

V-254908

Rule IDs

SV-254908r1067702_rule

To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.

Checks: C-58521r1067701_chk

Review the PPSM CAL to ensure Tanium has been registered with all of the TCP ports required for functionality to include (but not limited to) TCP 17472, 17477, 17440, 17441, and 433. If any TCP ports are being used on the Tanium Server that have been deemed as restricted by the PPSM CAL, this is a finding.

Fix: F-58465r867623_fix

Submit a formal request to have the Tanium communication ports evaluated and added to the PPSM CAL.

b

The Tanium endpoint must have the Tanium Servers public key in its installation.

IA-3 - Medium - CCI-000778 - V-254909 - SV-254909r960999_rule

RMF Control

IA-3

Severity

M

CCI

CCI-000778

Version

TANS-AP-000415

Vuln IDs

V-254909

Rule IDs

SV-254909r960999_rule

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Checks: C-58522r867625_chk

The Tanium endpoint makes a connection to the Tanium Server; the endpoint's copy of the Tanium Server's public key is used to verify the validity of the registration day coming from the Tanium Server. If any endpoint systems do not have the correct Tanium Server public key in its configuration, they will not perform any instructions from the Tanium Server and a record of those endpoints will be listed in the Tanium Server's System Status. To validate: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3 . Select the "Client Status" tab. 4. Click "Administration". 5. Change "Show systems that have reported in the last:", enter "7" in the first field. 6. Select "Days" from the drop-down menu in the second field to determine if any endpoints connected with an invalid key. If any systems are listed with "No" in the "Valid Key" column, this is a finding.

Fix: F-58466r867626_fix

For systems which do not have a valid key for the Tanium Server, redeploy the client software using the Tanium Client Management (TCM) or work with the Tanium System Administrator to accomplish this. Documentation on TCM: https://docs.tanium.com/client/client/index.html.

b

The Tanium application must enforce a minimum 15-character password length.

Medium - CCI-004066 - V-254910 - SV-254910r1015864_rule

RMF Control

Severity

M

CCI

CCI-004066

Version

TANS-AP-000425

Vuln IDs

V-254910

Rule IDs

SV-254910r1015864_rule

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.

Checks: C-58523r867628_chk

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization, as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu," and then press "Enter". 4. Press "L" for "Local Tanium User Management," and then press "Enter". 5. Press "B" for "Security Policy Local Authentication Service," and then press "Enter". If the value of "Password Minimum Length:" is less than "15", this is a finding.

Fix: F-58467r867629_fix

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization, as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu," and then press "Enter". 4. Press "L" for "Local Tanium User Management," and then press "Enter". 5. Press "B" for "Security Policy Local Authentication Service," and then press "Enter". 6. Type "yes," and then press "Enter". 7. Input the following settings, pressing "Enter" after every value: a) Minimum Password Lifetime - 1 b) Maximum Password Lifetime - 60 c) Minimum Password Length - 15 d) Minimum Password History - 5 e) Password Lockout - TRUE f) Maximum Password Attempts - 3 8. Type "yes" to accept the new password policy.

b

Tanium must enforce 24 hours/one day as the minimum password lifetime.

Medium - CCI-004066 - V-254912 - SV-254912r1015865_rule

RMF Control

Severity

M

CCI

CCI-004066

Version

TANS-AP-000470

Vuln IDs

V-254912

Rule IDs

SV-254912r1015865_rule

Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement.

Checks: C-58525r867634_chk

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu," and then press "Enter". 4. Press "L" for " Local Tanium User Management," and then press "Enter". 5. Press "B" for " Security Policy Local Authentication Service," and then press "Enter". If the value of "Password Minimum Age (days):" is greater than "1", this is a finding.

Fix: F-58469r867635_fix

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu," and then press "Enter". 4. Press "L" for "Local Tanium User Management," and then press "Enter". 5. Press "B" for "Security Policy Local Authentication Service," and then press "Enter". 6. Type "yes" and press "Enter". 7. Input the following settings, pressing "Enter" after every value: a) Minimum Password Lifetime - 1 b) Maximum Password Lifetime - 60 c) Minimum Password Length - 15 d) Minimum Password History - 5 e) Password Lockout - TRUE f) Maximum Password Attempts - 3 8. Type "yes" to accept the new password policy.

b

The Tanium application must enforce a 60-day maximum password lifetime restriction.

Medium - CCI-004066 - V-254913 - SV-254913r1043190_rule

RMF Control

Severity

M

CCI

CCI-004066

Version

TANS-AP-000475

Vuln IDs

V-254913

Rule IDs

SV-254913r1043190_rule

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.

Checks: C-58526r867637_chk

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "L" for " Local Tanium User Management," and then press "Enter". 5. Enter "B" for " Security Policy Local Authentication Service," and then press "Enter". If the value of "Password Maximum Age (days):" is greater than "60", this is a finding.

Fix: F-58470r867638_fix

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Enter "" for "User Administration Menu," and then press "Enter". 4. Enter "L" for "Local Tanium User Management," and then press "Enter". 5. Enter "B" for "Security Policy Local Authentication Service," and then press "Enter". 6. Type "yes," and then press "Enter". 7. Input the following settings, pressing "Enter" after every value: a) Minimum Password Lifetime - 1 b) Maximum Password Lifetime - 60 c) Minimum Password Length - 15 d) Minimum Password History - 5 e) Password Lockout - TRUE f) Maximum Password Attempts - 3 8. Type "yes" to accept the new password policy.

b

The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication.

IA-5 - Medium - CCI-000185 - V-254914 - SV-254914r961038_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000185

Version

TANS-AP-000480

Vuln IDs

V-254914

Rule IDs

SV-254914r961038_rule

Restricting this setting limits the user's ability to change their password. Passwords need to be changed at specific policy based intervals; however, if the application allows the user to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Checks: C-58527r867640_chk

From Browser: 1. Navigate to the Tanium Console URI and log in using multi-factor authentication. 2. Click the lock to the left of the URI in the address bar. 3. Select the lock on the left of the URI in the address bar: a) Chrome: Select "Certificate". b) Edge: Select "Connection is Secure," and then select the certificate icon on the right. 4. Select the "Details" tab. 5. Scroll down through the details to find and select the "Enhanced Key Usage" field. If there is no "Enhanced Key Usage" field, this is a finding. In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified. If "Server Authentication" and "Client Authentication" are not both identified, this is a finding. From Server: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "7" for "Download SOAP Certificate," and then press "Enter". 5. In a browser with access to the Tanium Server Console, navigate to https://<tanium server>/pub/SOAPServer.crt. 6. Download the SOAPServer.crt file when prompted. 7. Double-click on the file to open the certificate. 8. Select the "Details" tab. 9. Scroll down through the details to find and select the "Enhanced Key Usage" field. If there is no "Enhanced Key Usage" field, this is a finding. In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified. If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

Fix: F-58471r867641_fix

Request or regenerate the certificate being used to include both the "Server Authentication" and "Client Authentication" objects.

b

The Tanium application must be configured for LDAP user/group synchronization to map the authenticated identity to the individual user or group account for PKI-based authentication.

IA-5 - Medium - CCI-000187 - V-254915 - SV-254915r961044_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000187

Version

TANS-AP-000490

Vuln IDs

V-254915

Rule IDs

SV-254915r961044_rule

Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.

Checks: C-58528r867643_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Verify a sync exists under "Enabled Servers". If no sync exists, this is a finding. If sync exists under "Disabled Servers" and there are no Enabled Servers, this is a finding."

Fix: F-58472r867644_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Verify a sync exists under "Enabled Servers". 5. If no sync exists, click "Add Server". 6. Fill in the correct information for connecting to the organizations LDAP server. Work with a systems administrator to get this information if necessary. 7. Click "Save". 8. If a sync exists and it is disabled, click the edit icon. 9. Change the status to "enabled". 10. Click "Save".

b

The Tanium application must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

IA-8 - Medium - CCI-000804 - V-254916 - SV-254916r961053_rule

RMF Control

IA-8

Severity

M

CCI

CCI-000804

Version

TANS-AP-000505

Vuln IDs

V-254916

Rule IDs

SV-254916r961053_rule

Lack of authentication and identification enables nonorganizational users to gain access to the application or possibly other information systems and provides an opportunity for intruders to compromise resources within the application or information system. Nonorganizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors and guest researchers). Nonorganizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server.

Checks: C-58529r867646_chk

Local users can be identified by the following: 1. Using a web browser on a system, which has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Permissions," select "Users". 4. Compare users listed to the prepared documentation. If documentation identifying the Tanium console users and their respective User Groups, Roles, Computer Groups, and associated LDAP security groups does not exist this is a finding.

Fix: F-58473r867647_fix

Prepare and maintain documentation identifying the Tanium console users and their respective User Groups, Roles, Computer Groups, and associated LDAP security groups.

b

The Tanium application must separate user functionality (including user interface services) from information system management functionality.

SC-2 - Medium - CCI-001082 - V-254917 - SV-254917r961095_rule

RMF Control

SC-2

Severity

M

CCI

CCI-001082

Version

TANS-AP-000555

Vuln IDs

V-254917

Rule IDs

SV-254917r961095_rule

Application management functionality includes functions necessary for administration and requires privileged user access. Allowing nonprivileged users to access application management functionality capabilities increases the risk that nonprivileged users may obtain elevated privileges. The separation of user functionality from information system management functionality is either physical or logical and is accomplished by using different computers, different central processing units, different instances of the operating system, different network addresses, different TCP/UDP ports, virtualization techniques, combinations of these methods, or other methods, as appropriate. An example of this type of separation is observed in web administrative interfaces that use separate authentication methods for users of any other information system resources. This may include isolating the administrative interface on a different security domain and with additional access controls.

Checks: C-58530r867649_chk

Consult with the Tanium System Administrator to review the documented list of Tanium users. The users' User Groups, Roles, Computer Groups, and correlated LDAP security groups or Local Users must be documented. Local users can be identified by the following: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Permissions," select "Users". 4. Compare users that do not have a Domain listed to the prepared documentation. If documentation identifying the Tanium console users and their respective User Groups, Roles, Computer Groups, and associated LDAP security groups does not exist this is a finding.

Fix: F-58474r867650_fix

Prepare and maintain documentation identifying the Tanium console users and their respective User Groups, Roles, Computer Groups, and associated LDAP security groups.

b

The Tanium Server and Client applications must have logging enabled.

SC-24 - Medium - CCI-001665 - V-254918 - SV-254918r961125_rule

RMF Control

SC-24

Severity

M

CCI

CCI-001665

Version

TANS-AP-000600

Vuln IDs

V-254918

Rule IDs

SV-254918r961125_rule

Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving application state information helps to facilitate application restart and return to the operational mode of the organization with less disruption to mission-essential processes.

Checks: C-58531r867652_chk

Tanium Server: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "Common". 4. Select "Log Level". 5. In "Log Verbosity Level for Troubleshooting," verify current level for "Tanium Server" is set. If the value for current level for "Tanium Server" is not set to "1" or higher this is a finding. Tanium Client: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Interact". 4. In the "Explore Data" box, type the following question: 4A. Get Tanium Client Explicit Setting[LogVerbosityLevel] < 1 and Is Windows from all machines with Tanium Client Explicit Setting[LogVerbosityLevel] < 1 Note: For VDI systems, follow vendor guidance: https://docs.tanium.com/client/client/os_imaging.html#VDI If there are any answers returned that are "0" this is a finding.

Fix: F-58475r867653_fix

Tanium Server: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "Common". 4. Select "Log Level". 5. In "Log Verbosity Level for Troubleshooting," verify current level for "Tanium Server" is set. Tanium Client: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Interact". 4. In the "Explore Data" box, type the following question: 4A. Get Tanium Client Explicit Setting[LogVerbosityLevel] < 1 and Is Windows from all machines with Tanium Client Explicit Setting[LogVerbosityLevel] < 1 5. Select the row with "Is windows" set to "True" and deploy the following action and settings: a) Deployment Package: Modify Tanium Client Setting b) RegType: REG_DWORD c) ValueName: LogVerbosityLevel d) ValueData: 1 or higher Schedule Deployment a) Distribute over: 1 hour 6. Click "Show Preview to continue". 7. Click "Deploy Action". 8. Select the row with "Is windows" set to "False" and deploy the following action and settings: a) Deployment Package: Modify Tanium Client Setting [Non-Windows] b) RegType: NUMERIC c) ValueName: LogVerbosityLevel d) ValueData: 1 or higher Schedule Deployment a) Distribute over: 1 hour 9. Click "Show Preview to continue". 10. Click "Deploy Action".

b

The Tanium application must restrict the ability of individuals to use information systems to launch organization-defined denial-of-service (DoS) attacks against other information systems.

SC-5 - Medium - CCI-001094 - V-254919 - SV-254919r1067705_rule

RMF Control

SC-5

Severity

M

CCI

CCI-001094

Version

TANS-AP-000630

Vuln IDs

V-254919

Rule IDs

SV-254919r1067705_rule

The Tanium Action Approval feature provides a two-person integrity control mechanism designed to achieve a high-level of security and reduce the possibility of error for critical operations and DoS conditions. When this feature is enabled, an action configured by one Tanium console user will require a second Tanium console user with a role of Action Approver (or higher) to approve the action before it is deployed to targeted computers.

Checks: C-58532r1067703_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter items" search box, type "require_action_approval". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "require_action_approval", but the value is not "1", this is a finding.

Fix: F-58476r1067704_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. Click "Create Setting". 6. Select "Server" for "Setting Type". 7. In "Create Platform Setting" dialog box, enter "require_action_approval" does not exist: Flag" for " Name". 8. Select the "Numeric" radio button for "Value Type". 9. Enter "1" for "Value". 10. Click "Save".

b

The Tanium application must manage bandwidth throttles to limit the effects of information flooding types of Denial of Service (DoS) attacks.

SC-5 - Medium - CCI-001095 - V-254920 - SV-254920r961155_rule

RMF Control

SC-5

Severity

M

CCI

CCI-001095

Version

TANS-AP-000635

Vuln IDs

V-254920

Rule IDs

SV-254920r961155_rule

DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. In the case of application DoS attacks, care must be taken when designing the application to ensure the application makes the best use of system resources. SQL queries have the potential to consume large amounts of CPU cycles if they are not tuned for optimal performance. Web services containing complex calculations requiring large amounts of time to complete can bog down if too many requests for the service are encountered within a short period of time. The methods employed to meet this requirement will vary depending upon the technology the application utilizes. However, a variety of technologies exist to limit or, in some cases, eliminate the effects of application related DoS attacks. Employing increased capacity and bandwidth combined with specialized application layer protection devices and service redundancy may reduce the susceptibility to some DoS attacks.

Checks: C-58533r867658_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "Bandwidth Throttles". 4. Work with the Tanium Administrator to confirm settings. 5. If bandwidth throttles are not configured, this is a finding. For more information, see the following: https://docs.tanium.com/platform_user/platform_user/console_bandwidth_throttling.html.

Fix: F-58477r867659_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multi-factor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "Bandwidth Throttles". 4. Click "Add" on the line for "Global Throttle for All Data". 5. Work with Tanium Administrator to configure the required bandwidth throttles. 6. Click "Save". 7. Work with the Tanium Administrator to confirm or set settings for the remaining options: 7A. Global Throttle for Package Files. 7B. Global Throttle for Sensors. 7C. Site Throttles.

b

The Tanium application must reveal error messages only to the ISSO, ISSM, and SA.

SI-11 - Medium - CCI-001314 - V-254921 - SV-254921r961170_rule

RMF Control

SI-11

Severity

M

CCI

CCI-001314

Version

TANS-AP-000655

Vuln IDs

V-254921

Rule IDs

SV-254921r961170_rule

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the application. Additionally, Personally Identifiable Information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives. The structure and content of error messages must be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements.

Checks: C-58534r867661_chk

1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "U" for "TanOS User Management," and then press "Enter". If there are any users other than the documented approved TanOS users this is a finding.

Fix: F-58478r867662_fix

1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role, or any additional user with administrative privileges. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "U" for "TanOS User Management," and then press "Enter". 5. Work with Tanium System Administrator to either document approved accounts or remove nonapproved accounts.

b

Tanium must notify system administrator (SA) and the information system security officer (ISSO) when accounts are created.

AC-2 - Medium - CCI-000015 - V-254923 - SV-254923r1067707_rule

RMF Control

AC-2

Severity

M

CCI

Version

TANS-AP-000700

Vuln IDs

V-254923

Rule IDs

SV-254923r1067707_rule

Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail, which documents the creation of application user accounts and notifies administrators and ISSO exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.

Checks: C-58536r986526_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured connections. If no sources exist to send audit logs from Tanium to a SIEM tool or email destination, this is a finding. Work with the SIEM administrator to determine if an alert is configured when accounts are created. If there is no alert configured, this is a finding.

Fix: F-58480r1067706_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web UI and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Click "Create Connection" in the "Connections" section. 5. Configure sources to send audit logs from the Tanium Server to a SIEM tool or email destination. 6. Work with email administrator to configure email destination. 7. Work with the SIEM administrator to configure an alert when accounts are created.

b

Tanium must notify system administrators (SAs) and the information system security officer (ISSO) when accounts are modified.

AC-2 - Medium - CCI-000015 - V-254924 - SV-254924r1067709_rule

RMF Control

AC-2

Severity

M

CCI

Version

TANS-AP-000705

Vuln IDs

V-254924

Rule IDs

SV-254924r1067709_rule

When application accounts are modified, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account modification events to the SA and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes. To address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.

Checks: C-58537r986529_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured connections. If no sources exist to send audit logs from the Tanium Database to a SIEM tool or email destination, this is a finding. Work with the SIEM administrator to determine if an alert is configured when accounts are modified. If there is no alert configured, this is a finding.

Fix: F-58481r1067708_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web UI and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Click "Create Connection" in the "Connections" section. 5. Configure sources to send audit logs from the Tanium Server to a SIEM tool or email destination. 6. Work with email administrator to configure email destination. 7. Work with the SIEM administrator to configure an alert when accounts are modified.

b

Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account disabling actions.

AC-2 - Medium - CCI-000015 - V-254925 - SV-254925r1067711_rule

RMF Control

AC-2

Severity

M

CCI

Version

TANS-AP-000710

Vuln IDs

V-254925

Rule IDs

SV-254925r1067711_rule

When application accounts are disabled, user accessibility is affected. Accounts are utilized for identifying individual users or for identifying the application processes themselves. Sending notification of account disabling events to the SA and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes. To address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.

Checks: C-58538r986532_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured connections. If no sources exist to send audit logs from the Tanium SQL Server to a SIEM tool or email destination, this is a finding. Work with the SIEM administrator to determine if an alert is configured when accounts are disabled. If there is no alert configured, this is a finding.

Fix: F-58482r1067710_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web UI and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Click "Create Connection" in the "Connections" section. 5. Configure sources to send audit logs from the Tanium Server to a SIEM tool or email destination. 6. Work with email administrator to configure email destination. 7. Work with the SIEM administrator to configure an alert when accounts are modified.

b

Tanium must notify system administrators (SAs) and the information system security officer (ISSO) for account removal actions.

AC-2 - Medium - CCI-000015 - V-254926 - SV-254926r1067713_rule

RMF Control

AC-2

Severity

M

CCI

Version

TANS-AP-000715

Vuln IDs

V-254926

Rule IDs

SV-254926r1067713_rule

When application accounts are removed, user accessibility is affected. Accounts are utilized for identifying users or for identifying the application processes themselves. Sending notification of account removal events to the SA and ISSO is one method for mitigating this risk. Such a capability greatly reduces the risk that application accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes. To address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.

Checks: C-58539r986535_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Review the configured connections. If no sources exist to send audit logs from the Tanium SQL Server to a SIEM tool or email destination, this is a finding. Work with the SIEM administrator to determine if an alert is configured when accounts are deleted. If there is no alert configured, this is a finding.

Fix: F-58483r1067712_fix

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web UI and log on with multifactor authentication. 2. Click "Modules" on the top navigation banner. 3. Click "Connect". 4. Configure sources to send audit logs from the Tanium Server to a SIEM tool or email destination. 5. Work with email administrator to configure email destination. 6. Work with the SIEM administrator to configure an alert when accounts are deleted.

b

The Tanium application must set an inactive timeout for sessions.

AC-12 - Medium - CCI-002361 - V-254927 - SV-254927r1067716_rule

RMF Control

AC-12

Severity

M

CCI

CCI-002361

Version

TANS-AP-000720

Vuln IDs

V-254927

Rule IDs

SV-254927r1067716_rule

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that sessions not closed through the user logging out of an application are eventually closed. Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.

Checks: C-58540r1067714_chk

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In "Filter Items" box, enter "max_console_idle_seconds". 6. Click "Enter". If no results are returned, this is a finding. If results are returned for "max_console_idle_seconds", but the value is not "900" or less, this is a finding.

Fix: F-58484r1067715_fix

In the event the "max_console_idle_seconds" setting exists, but is not "900" or less: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. In the "Filter Items" box, enter "max_console_idle_seconds". 6. Select the "max_console_idle_seconds" setting. 7. Enter "900" or less for "Value". 8. Click "Save". In the event the "max_console_idle_seconds" setting does not exist: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration", select "Settings". 4. Click the "Advanced Settings" tab. 5. Click "Create Setting" in the top right. 6. Select "Server" for "Setting Type". 7. In "Create Platform Setting" dialog box, enter "max_console_idle_seconds" for "Name". 8. Select "Numeric" for the "Value Type". 9. Enter "900" or less for the "Value". 10. Click "Save".

b

The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions.

SC-3 - Medium - CCI-001084 - V-254928 - SV-254928r1015871_rule

RMF Control

SC-3

Severity

M

CCI

CCI-001084

Version

TANS-AP-000765

Vuln IDs

V-254928

Rule IDs

SV-254928r1015871_rule

By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational responsibility of the System Administrator for the Windows Operation System Active Directory. Satisfies: SRG-APP-000233, SRG-APP-000317, SRG-APP-000233

Checks: C-58541r986538_chk

Console Users: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Verify a sync exists under "Enabled Servers". If no sync exists, this is a finding. If sync exists under "Disabled Servers" and there are no Enabled Servers, this is a finding. Local TanOS Accounts: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role, or any additional user with administrative privileges. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "L" for "Local Tanium User Management," and then press "Enter". 5. Press "2" for "Manage Local User(s)," and then press "Enter". If there are any users other than the documented approved local users this is a finding.

Fix: F-58485r986539_fix

Console Users: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web UI and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under "Configuration," select "LDAP/AD Sync Configurations". 4. Click "Add Server". 5. Complete the settings using guidance from https://docs.tanium.com/platform_user/platform_user/console_using_ldap.html. 6. Click "Show Preview to Continue". 7. Review the users and groups to be imported. 8. Click "Save". Local TanOS Accounts: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role, or any additional user with administrative privileges. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "L" for "Local Tanium User Management," and then press "Enter". 5. Press "2" for "Manage Local User(s)," and then press "Enter". 6. Work with Tanium System Administrator to either document approved accounts or remove nonapproved accounts.

b

Tanium must notify the system administrator (SA) and information system security officer (ISSO) of account enabling actions.

AC-2 - Medium - CCI-000015 - V-254929 - SV-254929r1067719_rule

RMF Control

AC-2

Severity

M

CCI