What changed in Tanium 7.x Application on TanOS STIG V2R3V2R3 changes

Title

The publicly accessible Tanium application must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the application.

Check text

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Verify DODDoW use notification is displayed prior to login. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If a DODDoW-approved use notification banner does not display prior to logon, this is a finding.

Fix text

For Tanium Server versions greater than or equal to 7.5.6.1108: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Configuration, select "Settings". 4. Click "Advanced Settings". 5. In the Filter Items box on the top right, search for "console_PreLoginBannerHTMLText" and select it. 6. In the "Value" field, enter the statement below: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 9. Click "Save". Note: An html file can be uploaded in place of the above similar to previous versions of Tanium as shown below. Tanium Server versions below 7.5.6.110: 1. Create an .html file composed of the DODDoW-authorized warning banner verbiage. "&lthtml>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.&lt/html>" 2. Name the file "banner.html". 3. Use SFTP to upload the HTML banner file to the /incoming folder. 4. Log on to the TanOS server with the tanadmin user role. 5. Enter 2: Tanium Operations >> X: Advanced Operations >> 4: Manage HTML Banner and follow the prompts to copy the HTML banner file to the appropriate location. 6. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 7. Click "Administration" on the top navigation banner. 8. Under Configuration, select "Settings". 9. Select "Advanced Settings". 10. Search for "console_PreLoginBannerHTML". 11. Confirm "console_PreLoginBannerHTML" a value of "banner.html". Note: If the above setting is not present, create it using the following steps. 1. Click "Add Setting". 2. Select "Server" for "Setting Type". 3. In "Create Platform Setting" dialog box, enter "console_PreLoginBannerHTML" for "Platform Setting Name". 4. Select "Text" radio button from "Value Type". 5. Enter "banner.html" for "Value:". 6. Click "Save".

V-254895 in V2R3

Title

The publicly accessible Tanium application must retain the Standard Mandatory DODDoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

Check text

1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Verify DODDoW use notification is displayed prior to login. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. If a DODDoW-approved use notification banner does not display prior to logon, this is a finding.

Fix text

For Tanium Server versions greater than or equal to 7.5.6.1108: 1. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 2. Click "Administration" on the top navigation banner. 3. Under Configuration, select "Settings". 4. Click "Advanced Settings". 5. In the Filter Items box on the top right, search for "console_PreLoginBannerHTMLText" and select it. 6. In the "Value" field enter the statement below: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 9. Click "Save". Note: An html file can be uploaded in place of the above, similar to previous versions of Tanium as seen below. Tanium Server versions below 7.5.6.1108: 1. Create an .html file composed of the DODDoW-authorized warning banner verbiage. "&lthtml>You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.&lt/html>" 2. Name the file "banner.html". 3. Use SFTP to upload the HTML banner file to the /incoming folder. 4. Log on to the TanOS server with the tanadmin user role. 5. Enter 2: Tanium Operations >> X: Advanced Operations >> 4: Manage HTML Banner and follow the prompts to copy the HTML banner file to the appropriate location. 6. Using a web browser on a system that has connectivity to the Tanium Application, access the Tanium Application web user interface (UI) and log on with multifactor authentication. 7. Click "Administration" on the top navigation banner. 8. Under Configuration, select "Settings". 9. Select "Advanced Settings". 10. Search for "console_PreLoginBannerHTML". 11. Confirm "console_PreLoginBannerHTML" a value of "banner.html". Note: If the above setting is not present, create it using the following steps. 1. Click "Add Setting". 2. Select "Server" for "Setting Type". 3. In "Create Platform Setting" dialog box, enter "console_PreLoginBannerHTML" for "Platform Setting Name". 4. Select "Text" radio button from "Value Type". 5. Enter "banner.html" for "Value:". 6. Click "Save".

V-254896 in V2R3

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access is access to DODDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

V-254909 in V2R3

Fix text

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization, as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu," and then press "Enter". 4. Press "L" for "Local Tanium User Management," and then press "Enter". 5. Press "B" for "Security Policy Local Authentication Service," and then press "Enter". 6. Type "yes," and then press "Enter". 7. Input the following settings, pressing "Enter" after every value: a) Minimum Password Lifetime - 1 b) Maximum Password Lifetime - 60180 c) Minimum Password Length - 15 d) Minimum Password History - 5 e) Password Lockout - TRUE f) Maximum Password Attempts - 3 8. Type "yes" to accept the new password policy.

V-254910 in V2R3

Title

The Tanium application must enforce a 6180-day maximum password lifetime restriction.

Check text

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Enter "C" for "User Administration Menu," and then press "Enter". 4. Enter "L" for " Local Tanium User Management," and then press "Enter". 5. Enter "B" for " Security Policy Local Authentication Service," and then press "Enter". If the value of "Password Maximum Age (days):" is greater than "60180", this is a finding.

Fix text

Console Users: Per guidance, Enterprise Console users are inherited via LDAP synchronization as such passwords are not managed or enforced at the Tanium application level. Local TanOS account: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Enter "" for "User Administration Menu," and then press "Enter". 4. Enter "L" for "Local Tanium User Management," and then press "Enter". 5. Enter "B" for "Security Policy Local Authentication Service," and then press "Enter". 6. Type "yes," and then press "Enter". 7. Input the following settings, pressing "Enter" after every value: a) Minimum Password Lifetime - 1 b) Maximum Password Lifetime - 60180 c) Minimum Password Length - 15 d) Minimum Password History - 5 e) Password Lockout - TRUE f) Maximum Password Attempts - 3 8. Type "yes" to accept the new password policy.

V-254913 in V2R3

Title

The Tanium Server certificate must be signed by a DODoW Certificate Authority.

V-254947 in V2R3