Title

The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions. (Cat II impact)

Discussion

By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational responsibility of the System Administrator for the Windows Operation System Active Directory.

Check Content

Access the Tanium Module server interactively and log on as an Administrator. Click “Start” and click the down arrow to view Apps. Find "Tanium Connection Manager", right-click on the icon and choose to Run-as administrator and confirm at the User Account Control window prompt. In the "Tanium Connection Manager" configuration window, select the "Connector Plug-Ins" tab. Verify a plug-in exists for the "Type of Active Directory Sync". If no plug-in exists with the "Type of Active Directory Sync", this is a finding.

Fix Text

Access the Tanium Module server interactively and log on as an Administrator. Click “Start” and click the down arrow to view Apps. Find Tanium Connection Manager, right-click on the icon and choose to Run-as administrator and confirm. In the Tanium Connection Manager configuration window, select the "Connector Plug-Ins" tab. Click the + to add a connector For Connector Type:, choose Active Directory Sync Assign a unique Connector Name: Click “OK”. Configure Active Directory and configuration tabs with variables according to site's Active Directory configuration.

Additional Identifiers

Rule ID: SV-81487r1_rule

Vulnerability ID: V-66997

Group Title: SRG-APP-000023

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.