Title

The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions. (Cat II impact)

Discussion

By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the cog of the Windows Operating System and separate maintenance will not be required.

Check Content

Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Validate the "cac_ldap_server_url" value exists and is configured to point to the site's Active Directory instance. This registry value requires that Tanium validate every CAC/PIV authentication attempt with AD to determine the state of the account that is logging in. It must use the syntax of LDAP://<AD instance FQDN> (Note: All CAPS for LDAP). If the value for "cac_ldap_server_url" does not exist or is not configured to the site's AD instance, this is a finding.

Fix Text

Access the Tanium App server through interactive logon. Run regedit as Administrator. Navigate to HKLM\Software\Wow6432Node\Tanium\Tanium Server. Set the value for "cac_ldap_server_url" to reference the site's AD instance. It must use the syntax of LDAP://<AD instance FQDN> (Note: All CAPS for LDAP).

Additional Identifiers

Rule ID: SV-81489r1_rule

Vulnerability ID: V-66999

Group Title: SRG-APP-000023

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.