Check: TANS-CN-000027
Tanium 7.x STIG:
TANS-CN-000027
(in versions v2 r1 through v1 r1)
Title
Multifactor authentication must be enabled and enforced on the Tanium Server for all access and all accounts. (Cat II impact)
Discussion
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following. 1. Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and 2. Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity. Satisfies: SRG-APP-000080; SRG-APP-000403; SRG-APP-000156; SRG-APP-000005; SRG-APP-000150; SRG-APP-000152
Check Content
1. Access the Tanium Server. 2. Log on to the server with an account that has administrative privileges. 3. Run regedit as Administrator. 4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server. 5. Validate the value for REG_DWORD "ForceSOAPSSLClientCert" is set to "1". 6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server. 7. Validate the following keys exist and are configured: REG_SZ "ClientCertificateAuthField" For example: X509v3 Subject Alternative Name REG_SZ "ClientCertificateAuthRegex" For example-DoD: .+?Name:\s*?(\S+@[._a-zA-Z0-9]+).* Note: This regex may vary. REG_SZ "ClientCertificateAuth" For example: E:\Program Files\Tanium\Tanium Server\cac.pem REG_SZ "TrustedHostList" For example: 127.0.0.1 (for IPv4) and [::1] (for IPv6) If the value for REG_DWORD "ForceSOAPSSLClientCert" is not set to "1" and the remaining required registry values are not configured, this is a finding.
Fix Text
Use the vendor documentation titled "Smart card authentication" to implement correct configuration settings for this requirement. Vendor documentation can be downloaded from https://docs.tanium.com/platform_deployment_reference/platform_deployment_reference/smart_card_authentication.html?Highlight=cac. 1. Access the Tanium Server. 2. Log on to the server with an account that has administrative privileges. 3. Run regedit as Administrator. 4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server. 5. Configure the value for REG_DWORD "ForceSOAPSSLClientCert" to "1". 6. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> WOW6432Node >> Tanium >> Tanium Server. 7. Configure the following keys: REG_SZ "ClientCertificateAuthField" For example: X509v3 Subject Alternative Name REG_SZ "ClientCertificateAuthRegex" For example-DoD: .+?Name:\s*?(\S+@[._a-zA-Z0-9]+).* Note: This regex may vary. REG_SZ "ClientCertificateAuth" For example: E:\Program Files\Tanium\Tanium Server\cac.pem REG_SZ "TrustedHostList" For example: Append 127.0.0.1 (for IPv4) and [::1] (for IPv6)
Additional Identifiers
Rule ID: SV-253828r1015844_rule
Vulnerability ID: V-253828
Group Title: SRG-APP-000148
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000056 |
Retain the device lock until the user reestablishes access using established identification and authentication procedures. |
| CCI-000166 |
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. |
| CCI-000764 |
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. |
| CCI-000766 |
Implement multifactor authentication for access to non-privileged accounts. |
| CCI-000768 |
The information system implements multifactor authentication for local access to non-privileged accounts. |
| CCI-001941 |
Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts. |
| CCI-002010 |
Electronically verify Personal Identity Verification-compliant credentials from other federal agencies. |
| CCI-004046 |
Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
| CCI-004047 |
Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements. |
Controls
| Number | Title |
|---|---|
| AC-11 |
Session Lock |
| AU-10 |
Non-repudiation |
| IA-2 |
Identification and Authentication (organizational Users) |
| IA-2(2) |
Network Access to Non-privileged Accounts |
| IA-2(4) |
Local Access to Non-privileged Accounts |
| IA-2(8) |
Network Access to Privileged Accounts - Replay Resistant |
| IA-8(1) |
Acceptance of PIV Credentials from Other Agencies |