What changed in Tanium 7.x Operating System on TanOS STIG V2R3V2R3 changes

Title

The Tanium Operating System (TanOS) must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system.

Check text

1. Access the Tanium Server interactively. 2. Verify DODDoW use notification displayed prior to login. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If a DODDoW-approved use notification banner does not display prior to logon, this is a finding.

Fix text

1. Create a .txt file composed of the DODDoW-authorized warning banner verbiage. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 2. Name the file "banner_ssh.txt". 3. Use SFTP to upload the HTML banner file to the /incoming folder. 4. Access the Tanium Server interactively. 5. Log on to the TanOS server with the tanadmin role, or any additional user with administrative privileges. 6. Enter A: Appliance Configuration Menu >> A: Security >> 3: Configure SSH Banner and follow the prompts. 7. Log off and back on to the Tanium Server to confirm application.

V-254840 in V2R3

Title

The Tanium Operating System (TanOS) must enforce a 6180-day maximum password lifetime restriction.

Check text

1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu". 4. Press "L" for "Local Tanium User Management". 5. Press "B" for "Security Policy Local Authentication Service". If the "Password Maximum Age (days)" is not set to "60180", this is a finding.

Fix text

1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "C" for "User Administration Menu". 4. Press "L" for "Local Tanium User Management". 5. Press "B" for "Security Policy Local Authentication Service". 6. Type "Yes". 7. Press "Enter" to accept the current value for "Define the minimum password in days [0 - 20]". 8. Set the value of "Define the maximum password lifetime in days [0-300]" to "60180". 9. Press "Enter" to accept the current values for the rest of the options. 10. Type "Yes" to apply the new security policy.

V-254844 in V2R3

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DODDoW CAC with DODDoW-approved PKI is an example of multifactor authentication.

V-254847 in V2R3

Discussion

To assure accountability and prevent unauthenticated access, nonprivileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include:(i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A nonprivileged account is any information system account with authorizations of a nonprivileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection. The DODDoW CAC with DODDoW-approved PKI is an example of multifactor authentication.

V-254848 in V2R3

Discussion

To protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512. This requirement also include HMAC, KDFs, Random Bit Generation, and hash-only applications (e.g., hashing passwords and use for compute a checksum). For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use only, but this is discouraged by DODDoW. Separate requirements for configuring applications and protocols used by each product (e.g., SNMPv3, SSH, NTP, and other protocols and applications that require server/client authentication) are required to implement this requirement.

V-254849 in V2R3

Title

The publicly accessible Tanium Operating System (TanOS) must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system.

Check text

1. Access the TanOS interactively. If the Standard Mandatory DODoW Notice and Consent Banner is not displayed at logon, this is a finding.

Fix text

1. Use SFTP to copy a file named "banner_ssh.txt" containing the Standard Mandatory DODDoW Notice and Consent Banner to the /incoming folder. 2. Access the TanOS interactively. 3. Enter "A" to go to the "Appliance Configuration" menu. 4. Enter "A" to go to the "Security" menu. 5. Enter "3" to add the banner file.

V-254855 in V2R3

Title

The Tanium operating system (TanOS) must, for networked systems, compare internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DODDoW network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).

V-254865 in V2R3

Check text

1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "A" for "Appliance Configuration Menu," and then press "Enter". 4. Press "3" for "NTP Configuration," and then press "Enter". If there is no address listed for "Currently configured ntp servers:", this is a finding. The status is reported differently in different versions of TanOS. TanOS &lt= 1.7.1: If the "Current NTP Status" does not list a status of "Synchronized to NTP Server ( &ltaddress>) at stratum #" and "Time correct to within # ms", this is a finding. TanOS >= 1.7.2: If the "Current NTP Status" does not list a status of "Normal", this is a finding.

V-254866 in V2R3

Discussion

The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes it's time to a more accurate source. The system must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. Organizations should also consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). This requirement is related to the comparison done in CCI-001891. DODDoW-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: A time server designated for the appropriate DODDoW network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

V-254867 in V2R3