kriterion 0.0.1

data/standards/stig_tanium_6.5.json

@@ -0,0 +1,461 @@
+{
+  "name": "stig_tanium_6.5",
+  "date": "2016-09-29",
+  "description": "This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.",
+  "title": "Tanium 6.5 Security Technical Implementation Guide",
+  "version": "1",
+  "item_syntax": "^\\w-\\d+$",
+  "section_separator": null,
+  "items": [
+    {
+      "id": "V-66971",
+      "title": "The Tanium endpoint must have the Tanium Servers public key in its installation.",
+      "description": "Without cryptographic integrity protections, information can be altered by unauthorized users without detection. \n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. \n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66973",
+      "title": "Access to Tanium logs on each endpoint must be restricted by permissions.",
+      "description": "For the Tanium Client software to run without impact from external negligent or malicious changes, the permissions on the Tanium log files and their directory must be restricted.\n\nTanium is deployed with a Client Hardening Solution. This solution, when applied, will ensure directory permissions are in place.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66975",
+      "title": "The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.",
+      "description": "All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct Man in the Middle (MitM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium.\n\nTanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. before execution will be enforced by Tanium. \n\nSigning will prevent MitM remote code execution attacks and will protect data element in transit. Tanium also supports object level signing for content within the Tanium platform.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66977",
+      "title": "Firewall rules must be configured on the Tanium Endpoints for Client-to-Server communications.",
+      "description": "In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology--endpoints in California will form one ring while endpoints in Germany will form a separate ring. \n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66979",
+      "title": "Control of the Tanium Client service must be restricted to SYSTEM access only for all managed clients.",
+      "description": "The reliability of the Tanium client's ability to operate depends upon controlling access to the Tanium client service. By restricting access to SYSTEM access only, the non-Tanium system administrator will not have the ability to impact operability of the service.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66981",
+      "title": "The ability to uninstall the Tanium Client service must be disabled on all managed clients.",
+      "description": "By default, end users have the ability to uninstall software on their clients. In the event the Tanium Client software is uninstalled, the Tanium Server is unable to manage the client and must re-deploy to the client. Preventing the software from being displayed in the client's Add/Remove Programs will lessen the risk of the software being uninstalled by non-Tanium System Administrators.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66983",
+      "title": "The permissions on the Tanium Client directory must be restricted to only the SYSTEM account on all managed clients.",
+      "description": "By restricting access to the Tanium Client directory on managed clients, the Tanium client's ability to operate and function as designed will be protected from malicious attack and unintentional modifications by end users.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66985",
+      "title": "Tanium endpoint files must be protected from antivirus actions.",
+      "description": "Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. That is to say that Antivirus, Encryption, or other security and management stack software may disallow the Client from working as expected.\n\nhttps://kb.tanium.com/Security_Software_Exceptions",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66987",
+      "title": "The Tanium Client - Set Action Lock must be set to OFF during maintenance window timeframes only.",
+      "description": "Set Action Lock On will prevent any managed system from executing Tanium generated actions. This functionality is helpful when needing to eliminate systems from taking actions (e.g. patch scanning/installation, unmanaged asset scanning, updating, etc.), whether it is automatically scheduled upon install or manually scheduled. This functionality can also be used to help debug performance issues on a client if there is a fear that Tanium is running an action that could be causing a negative impact.\n\nSetting Action Lock Off will ensure any Tanium generated actions are executed at the endpoint.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66989",
+      "title": "The Tanium Client Deployment Tool (CDT) must not be configured to use the psexec method of deployment.",
+      "description": "When using the Tanium Client Deployment Tool (CDT), using psexec represents an increased vulnerability as the NTLM hash and clear text passwords of the authenticating user is exposed in the memory of the remote system.\n\nTo mitigate this vulnerability, the psexec method of deployment must not be used.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66991",
+      "title": "The Tanium Client must ensure the authenticity of communications sessions when answering requests from the Tanium Server.",
+      "description": "Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\n\nApplication communication sessions are protected utilizing transport encryption protocols, such as SSL or TLS. SSL/TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other.\n\nThis requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA). \n\nThis requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of SSL/TLS mutual authentication (two-way/bidirectional).",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66993",
+      "title": "Tanium endpoint files must be protected from file encryption actions.",
+      "description": "Similar to any other host-based applications, the Tanium Client is subject to the restrictions other System-level software may place on an operating environment. That is to say that Antivirus, Encryption, or other security and management stack software may disallow the Client from working as expected.\n\nhttps://kb.tanium.com/Security_Software_Exceptions",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66995",
+      "title": "The Tanium Console_ProhibitSavedLogin option must be explicitly enabled to prevent console browsers from saving non-CAC logon information.",
+      "description": "The Tanium Console, by default, can cache console users' credentials for convenience so that operators are not required to re-enter their passwords when logging back into the console. When this feature is enabled, there is a risk of access by individuals other than the original console user. Depending upon the original console user's privileges, such access could result in irreversible or malicious manipulation of the Tanium configuration.\n\nAlthough this option is not an impact when CAC is enabled, this feature should be explicitly disabled in the event CAC authentication is ever broken or removed.",
+      "severity": "high"
+    },
+    {
+      "id": "V-66997",
+      "title": "The Tanium Application Server must be configured with a connector to sync to Microsoft Active Directory for account management functions.",
+      "description": "By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the operational responsibility of the System Administrator for the Windows Operation System Active Directory.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-66999",
+      "title": "The Tanium Application Server must be configured to only use Microsoft Active Directory for account management functions.",
+      "description": "By restricting access to the Tanium Server to only Microsoft Active Directory, user accounts and related permissions can be strictly monitored. Account management will be under the cog of the Windows Operating System and separate maintenance will not be required.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67001",
+      "title": "Computer Groups must be used to restrict console users from affecting changes to unauthorized computers.",
+      "description": "Computer Groups allow a site running Tanium to assign responsibility of specific Computer Groups to specific Tanium console users. By doing so, a desktop administrator, for example, will not have the ability to enforce an action against a high visibility server. \n\nFor large sites, it is crucial to have the Computer Groups and while a smaller site might not seem to require Computer Groups, creating them provides for a cleaner implementation. All sites will be required to have some kind of Computer Groups configured other than the default \"All Computers\".",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67003",
+      "title": "Documentation identifying Tanium console users and their respective User Roles must be maintained.",
+      "description": "System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.\n\nWhen using Active Directory synchronization, as is required by this STIG, User Roles assignments are via the AD Sync connector. AD security groups correlate, one to one, to Tanium User Roles.\n\nTo change a Tanium user's User Role, their Active Directory account needs to be moved to the AD security group which correlates with the applicable User Role.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67005",
+      "title": "Role-based system access must be configured to least privileged access to Tanium Server functions through the Tanium interface.",
+      "description": "User accessibility to various Tanium Server functions performed via the console can be restricted by User Roles. Those User Roles are: Administrator, Read Only User, Question Author, Action User, Action Approver, Action Author, Sensor Author, Action/Sensor Author, and Content Administrator. These are already configured in Tanium.\n\nSystem access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Consider removing users that have not logged onto the system within a predetermined time frame.",
+      "severity": "high"
+    },
+    {
+      "id": "V-67007",
+      "title": "Tanium console users User Roles must be validated against the documentation for User Roles.",
+      "description": "System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.\n\nWhen using Active Directory synchronization, as is required by this STIG, User Roles assignments are via the AD Sync connector. AD security groups correlate, one to one, to Tanium User Roles.\n\nTo change a Tanium user's User Role, their Active Directory account needs to be moved to the AD security group which correlates with the applicable User Role.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67009",
+      "title": "Documentation identifying Tanium console users and their respective Computer Groups rights must be maintained.",
+      "description": "System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67011",
+      "title": "Tanium console users Computer Group rights must be validated against the documentation for Computer Group rights.",
+      "description": "System access should be reviewed periodically to verify that all Tanium users are assigned the appropriate role, with the least privileged access possible to perform assigned tasks being the recommended best practice. Users who have been removed from the documentation should no longer be configured as a Tanium Console User. Consider removing users that have not logged onto the system within a predetermined time frame.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67013",
+      "title": "Common Access Card (CAC)-based authentication must be enabled on the Tanium Server for network access with privileged accounts.",
+      "description": "To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following.\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and \n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\n\nThis not only meets a common requirement in the Federal space but adds a critical layer of security to the user authentication process.",
+      "severity": "high"
+    },
+    {
+      "id": "V-67015",
+      "title": "Common Access Card (CAC)-based authentication must be enabled on the Tanium Server for network access with non-privileged accounts.",
+      "description": "To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.\n\nMultifactor authentication uses two or more factors to achieve authentication.\n\nFactors include:\n(i) Something you know (e.g., password/PIN);\n(ii) Something you have (e.g., cryptographic identification device, token); or\n(iii) Something you are (e.g., biometric).\n\nA non-privileged account is any information system account with authorizations of a non-privileged user.\n\nNetwork access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.\n\nApplications integrating with the DoD Active Directory and utilize the DoD CAC are examples of compliant multifactor authentication solutions.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67017",
+      "title": "Common Access Card (CAC)-based authentication must be enforced on the Tanium Server for authentication for local access with privileged accounts.",
+      "description": "To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following.\n\n(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and \n(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.\n\nThis not only meets a common requirement in the Federal space but adds a critical layer of security to the user authentication process. ",
+      "severity": "high"
+    },
+    {
+      "id": "V-67019",
+      "title": "Common Access Card (CAC)-based authentication must be enforced on the Tanium Server for authentication for local access with non-privileged accounts.",
+      "description": "To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. \n\nMultifactor authentication is defined as: using two or more factors to achieve authentication.\n\nFactors include: \n(i) Something a user knows (e.g., password/PIN);\n(ii) Something a user has (e.g., cryptographic identification device, token); or \n(iii) Something a user is (e.g., biometric).\n\nA privileged account is defined as an information system account with authorizations of a privileged user.\n\nLocal access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network.\n\nApplications integrating with the DoD Active Directory and utilize the DoD CAC are examples of compliant multifactor authentication solutions.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67021",
+      "title": "Firewall rules must be configured on the Tanium Server for Console-to-Server communications.",
+      "description": "An HTML5/Adobe Flash based application, the Tanium Console runs from any device with a browser configured with Adobe Flash Player 11.5 or higher. For security, the TCP and SOAP communication to the Tanium Server is SSL encrypted, so the Tanium Server installer configures the server to listen for TCP and SOAP requests on port 443. If another installed application is listening on port 443, you can designate a different port for TCP and SOAP communication when installing the Tanium Server.\n\nPort Needed: To Tanium Server over TCP ports 443, 17440, and 17441\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 443 from any computer on the internal network to the Tanium Server device\n\nAllow TCP traffic on port 17440 from any computer on the internal network to the Tanium Server device (Patch Workbench)\n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67023",
+      "title": "The Tanium SQL database must be installed on a separate system.",
+      "description": "Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67025",
+      "title": "The Tanium SQL server must be dedicated to the Tanium application database.",
+      "description": "Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67027",
+      "title": "The access to the Tanium SQL database must be restricted. Only the designated database administrator(s) can have elevated privileges to the Tanium SQL database.",
+      "description": "After the Tanium Server has been installed and the Tanium databases created, only the Tanium Receiver, Tanium Module, and Tanium connection manager (ad sync) service needs to access the SQL Server database.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67029",
+      "title": "The Tanium Server installers account SQL database permissions must be reduced from sysadmin to db_owner.",
+      "description": "Creating the tanium and tanium_archive databases through the Tanium Server installer program or using the database create SQL scripts requires Sysadmin-level permissions. Once the databases have been created, the Tanium Server service must be configured to execute under an account that holds at least the dbo role on both databases.\n\nPost-installation, if the account used to configure the Tanium Server services to access the remote SQL database server holds only the Database Owner role, rather than the sysadmin role, consider granting this account the View Server State permission on the SQL Server. While it's not strictly necessary, this dynamic management view enables the Tanium Server to access data faster than the dbo role alone.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67031",
+      "title": "Firewall rules must be configured on the Tanium Server for Server-to-Database communications.",
+      "description": "The Tanium Server can use either a SQL Server RDBMS installed locally to the same device as the Tanium Server application or a remote dedicated or shared SQL Server instance. Using a local SQL Server database typically requires no changes to network firewall rules since all communication remains on the Tanium application server device. To access database resources installed to a remote device, however, the Tanium Server service communicates over the port reserved for SQL, by default port 1433, to the database.\n\nPort Needed: Tanium Server to Remote SQL Server over TCP port 1433.\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 1433 from the Tanium Server device to the remote device hosting the SQL Server RDBMS.\n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67033",
+      "title": "SQL stored queries or procedures installed during Tanium installation must be removed from the Tanium Server.",
+      "description": "Failure to protect organizational information from data mining may result in a compromise of information.\n\nData storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67035",
+      "title": "The Tanium Application Server must protect the confidentiality and integrity of transmitted information.",
+      "description": "Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPSEC.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67037",
+      "title": "The Tanium Application Server console must be configured to initiate a session lock after a 15-minute period of inactivity.",
+      "description": "The Tanium Console, when CAC is enabled, will initiate a session lock based upon the ActivClient or other Smart Card software.\n\nBy initiating the session lock, the console will be locked and not allow unauthorized access by anyone other than the original user.\n\nAlthough this setting does not apply when CAC is enabled, it should be explicitly disabled in the event CAC authentication is ever broken or removed.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67039",
+      "title": "Trusted Content providers must be documented.",
+      "description": "A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console. \n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67041",
+      "title": "Content providers must provide their public key to the Tanium administrator to import for validating signed content.",
+      "description": "A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console. \n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67043",
+      "title": "Public keys of content providers must be validated against documented trusted content providers.",
+      "description": "A Tanium Sensor, also called content, enables an organization to gather real-time inventory, configuration, and compliance data elements from managed computers. Sensors gather specific information from the local device and then write the results to the computer's standard output channel. The Tanium Client captures that output and forwards the results through the platform's unique \"ring\" architecture for display in the Tanium Console. \n\nThe language used for Sensor development is based on the scripting engine available on the largest number of devices under management as well as the scripting experience and background of the people who will be responsible for creating new Sensors. VBScript and PowerShell are examples of common scripting languages used for developing sensors.\n\nBecause errors in scripting can and will provide errant feedback at best and will impact functionality of the endpoint to which the content is directed, it is imperative to ensure content is only accepted from trusted sources.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67045",
+      "title": "The Tanium Action Approval feature must be enabled for two person integrity when deploying actions to endpoints.",
+      "description": "The Tanium Action Approval feature provides a \"four eyes\" control mechanism designed to achieve a high level of security and reduce the possibility of error for critical operations.\n\nWhen this feature is enabled, an action configured by one Tanium console user will require a second Tanium console user with a role of Action Approver to approve the Action before it is deployed to targeted computers.\n\nWhile this system slows workflow, the reliability of actions deployed will be greater on the Packaging and Targeting.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67047",
+      "title": "The Tanium documentation identifying recognized and trusted IOC Detect streams must be maintained.",
+      "description": "An IOC stream is a series or “stream” of IOCs that are imported from a vendor based on a subscription service. An IOC stream can be downloaded manually or on a scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67049",
+      "title": "The Tanium IOC Detect must be configured to receive IOC streams only from trusted sources.",
+      "description": "An IOC stream is a series or “stream” of IOCs that are imported from a vendor based on a subscription service or manually downloaded and placed in a folder. IOC Detect can be configured to retrieve the manually pulled IOC content on a regularly scheduled basis. The items in an IOC stream can be separately manipulated after they are imported.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67051",
+      "title": "The LogFileSize on Tanium Servers must be enabled with a value of 104857600 (100MB) or more.",
+      "description": "Although a full set of usage logs for each Tanium component is, by default, no more than 100 MB, logging is initially disabled to minimize impact to any computers that might be critically low on disk space and must be explicitly enabled.\n\nTo ensure logs retain enough forensic, the logs must be configured to grow to a large enough size. Specifying at least 10MB for clients, the log file will grow to 10MB before rolling over.\n\nTanium Server's log size should be a minimum of 100MB before rolling over in order to retain enough forensic data for analysis.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67053",
+      "title": "The Tanium IOC Detect module must be configured to forward events.",
+      "description": "Indicators of Compromise (IOC) is an artifact which is observed on the network or system that indicates computer intrusion. The Tanium IOC Detect module detects, manages, and analyzes systems against IOCs real-time. The module also responds to those detections.\n\nBy forwarding events the IOC Detect module, using Tanium Connect with a syslog or SIEM connection, captures the necessary forensic evidence supporting a compromise is retained.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67055",
+      "title": "Tanium Server files must be protected from antivirus actions.",
+      "description": "Similar to any other host-based applications, the Tanium Server is subject to the restrictions other System-level software may place on an operating environment. Antivirus, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://kb.tanium.com/Security_Software_Exceptions",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67057",
+      "title": "The Tanium Application Server console must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to The Tanium Application Server.",
+      "description": "Display of the DoD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n \nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreement.\"",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67059",
+      "title": "The Tanium Application Server console must be configured to retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.",
+      "description": "The banner must be acknowledged by the user prior to allowing the user access to the application. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoD will not be in compliance with system use notifications required by law.\n\nTo establish acceptance of the application usage policy, a click-through banner at application logon is required. The application must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\".",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67061",
+      "title": "Tanium Server files must be protected from file encryption actions.",
+      "description": "Similar to any other host-based applications, the Tanium Server is subject to the restrictions other System-level software may place on an operating environment. Antivirus, Encryption, or other security and management stack software may disallow the Tanium Server from working as expected.\n\nhttps://kb.tanium.com/Security_Software_Exceptions",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67063",
+      "title": "The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server.",
+      "description": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67065",
+      "title": "The Tanium Application Server must protect audit tools from unauthorized access.",
+      "description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the access to audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67067",
+      "title": "The Tanium Application Server must protect audit tools from unauthorized modification.",
+      "description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification of audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67069",
+      "title": "The Tanium Application Server must protect audit tools from unauthorized deletion.",
+      "description": "Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nApplications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the deletion of audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67071",
+      "title": "The Tanium cryptographic signing capabilities must be enabled on the Tanium Server.",
+      "description": "All of Tanium's signing capabilities should be enabled upon install. Tanium supports the cryptographic signing and verification before execution of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. Enabling signing does away with the ability of an attacker to conduct Man in the Middle (MitM) attacks for the purposes of remote code execution and precludes the modification of the aforementioned data elements in transit. Additionally, Tanium supports object level signing for content ingested into the Tanium platform. This allows for the detection and rejection of changes to objects (sensors, actions, etc.) by even a privileged user within Tanium.\n\nTanium has built-in signing capabilities enabled by default when installed. Cryptographic signing and verification of all Sensors, Questions, Actions, Sensor Libraries, File Shards, etc. before execution will be enforced by Tanium. \n\nSigning will prevent MitM remote code execution attacks and will protect data element in transit. Tanium also supports object level signing for content within the Tanium platform.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67073",
+      "title": "The Tanium Server must be configured to only allow signed content to be imported.",
+      "description": "Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate that is recognized and approved by the organization ensures the software has not been tampered with and that it has been provided by a trusted vendor. \n\nAccordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization. \n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67075",
+      "title": "All installation files originally downloaded to the Tanium Server must be configured to download to a location other than the Tanium Server directory.",
+      "description": "Typically, the Tanium Server stores the Package Source Files that it downloads from the Internet and server shares or files uploaded through the Tanium Console in a subdirectory of the server's installation directory called Downloads. To ensure package files are not accessible to non-authorized functions, the files must be re-located to outside of the server's installation directory.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67077",
+      "title": "Firewall rules must be configured on the Tanium Server for Client-to-Server communications.",
+      "description": "In addition to the client-to-server TCP communication that takes place over port 17472, Tanium Clients also communicate to other Tanium-managed computers over port 17472. The Tanium environment can perform hundreds or thousands of times faster than other security or systems management tools because the Tanium Clients communicate in secure, linearly-controlled peer-to-peer rings. Because clients dynamically communicate with other nearby agents based on proximity and latency, rings tend to form automatically to match a customer's topology--endpoints in California will form one ring while endpoints in Germany will form a separate ring. \n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67079",
+      "title": "Firewall rules must be configured on the Tanium Zone Server for Client-to-Zone Server communications.",
+      "description": "In customer environments using the Tanium Zone Server, a Tanium Client may be configured to point to a Zone Server instead of a Tanium Server. The communication requirements for these Clients are identical to the Server-to-Client requirements. \n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67081",
+      "title": "The Tanium Application Server must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.",
+      "description": "In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nApplications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. \n\nTo support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67083",
+      "title": "The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication.",
+      "description": "Information can be either unintentionally or maliciously disclosed or modified during reception including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When receiving data, applications need to leverage protection mechanisms, such as TLS, SSL VPNs, or IPSEC.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67085",
+      "title": "The Tanium Server certificate and private/public keys directory must be protected with appropriate permissions.",
+      "description": "If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure.\n\nThe cornerstone of the PKI is the private key used to encrypt or digitally sign information.\n\nIf the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user.\n\nBoth the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.",
+      "severity": "high"
+    },
+    {
+      "id": "V-67087",
+      "title": "Flash must not be installed on the Tanium Server.",
+      "description": "Adobe Flash Player is freeware software for using content created on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio. \n\nFlash Player is a common format for games, animations, and graphical user interfaces (GUIs) embedded in web pages. \n\nFlash Player runs SWF files. Flash Player supports vector and raster graphics, 3D graphics, an embedded scripting language called ActionScript, and streaming of video and audio. ActionScript is based on ECMAScript, and supports object-oriented code, and is similar to JavaScript.Adobe Flash Player is a runtime that executes and displays content from a provided SWF file.  \n\nAlthough it has no in-built features to modify the SWF file at runtime, it can execute software written in the ActionScript programming language which enables the runtime manipulation of text, data, vector graphics, raster graphics, sound, and video. The player can also access certain connected hardware devices, including web cameras and microphones, after permission for the same has been granted by the user.\n\nThroughout the various version of Adobe Flash Player, multiple vulnerabilities have been exposed requiring patching to mitigate and because of these vulnerabilities it continues to be a target for exploitation.\n\nSince Tanium does not require Adobe Flash Player for any functionality, ensuring it is not installed removes the vulnerability.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67089",
+      "title": "The Tanium Module server must be installed on a separate system.",
+      "description": "Unauthorized access to the Tanium Server is protected by disabling the Module Server service on the Tanium Server and by configuring the Module Server on a separate system. \n\nWhen X509 smartcard certificates (CAC or PIV tokens) are used for access to the Tanium Server, the Tanium Module server must be on a separate system.\n\nIn order to restrict access to the Tanium Server resulting from an attack on the Module Server, it is recommended that the Tanium Module Server be installed on a separate system or VM from the Tanium Server.  Adding to this recommendation, if the Tanium Server is configured to accept X509 Smartcard certificates (also referred to as CAC or PIV tokens) in lieu of username/password logon, the requirement becomes explicit and the Tanium Module Server must be installed on a separate system or VM.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67091",
+      "title": "The permissions on the Tanium Server directory must be restricted to only the Tanium service account.",
+      "description": "Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67093",
+      "title": "The Tanium Server http directory and sub-directories must be restricted with appropriate permissions.",
+      "description": "Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67095",
+      "title": "The permissions on the Tanium Server registry keys must be restricted to only the Tanium service account.",
+      "description": "Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67097",
+      "title": "The Tanium Server Logs and TDL_Logs directories must be restricted with appropriate permissions.",
+      "description": "Discretionary Access Control (DAC) is based on the notion that individual users are \"owners\" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user controlled file permissions.\n\nWhen discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing (i.e., the subjects have the discretion to pass) the information to other subjects or objects. A subject that is constrained in its operation by Mandatory Access Control policies is still able to operate under the less rigorous constraints of this requirement. Thus, while Mandatory Access Control imposes constraints preventing a subject from passing information to another subject operating at a different sensitivity level, this requirement permits the subject to pass the information to any subject at the same sensitivity level. The policy is bounded by the information system boundary. Once the information is passed outside of the control of the information system, additional means may be required to ensure the constraints remain in effect. While the older, more traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this use of discretionary access control.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67099",
+      "title": "All Active Directory accounts synchronized with Tanium must be non-privileged domain accounts.",
+      "description": "Tanium has the ability to synchronize with Active Directory for Tanium account management. Tanium advises that all replicated accounts should be non-privileged domain accounts. In doing so, should a vulnerability in the industry standard OpenSSL libraries used by Tanium ever come to light, no privileged account information could be gained by an attacker. This is simply good housekeeping and should be exercised with any such platform product.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67101",
+      "title": "A connector must be configured to send log data to offline log collection.",
+      "description": "While the Tanium Server records audit log entries to the Tanium SQL database, retrieval and aggregation of log data through the Tanium console is not efficient.  \n\nThe Tanium Connect module allows for ArcSight, McAfee SIEM, SIEM, Splunk SIEM, and LogRhythm connectors in order to facilitate forensic data retrieval and aggregation efficiently.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67103",
+      "title": "Firewall rules must be configured on the Tanium module server to allow Server-to-Module Server communications from the Tanium Server.",
+      "description": "Tanium 6.5 introduces the Tanium Module Server (formerly known as the Tanium Plugin Server) used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477.\n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67105",
+      "title": "Firewall rules must be configured on the Tanium Server for Server-to-Module Server communications.",
+      "description": "Tanium 6.5 introduces the Tanium Module Server (formerly known as the Tanium Plugin Server) used to extend the functionality of Tanium through the use of various workbenches. The Tanium Module Server requires communication with the Tanium Server on port 17477.\n\nPort Needed: Tanium Server to Tanium Module Server over TCP port 17477.\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 17477 from the Tanium Server to the Tanium Module Server.\n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67107",
+      "title": "Firewall rules must be configured on the Tanium Server for Server-to-Zone Server communications.",
+      "description": "If you are using the Tanium Zone Server to proxy traffic from Tanium-managed computers on less trusted network segments to the Tanium Server on the core network, then the Tanium Zone Server Hub, typically installed to the Tanium Server device, must be able to connect to the Zone Server(s) in the DMZ. This is the only configuration that requires you to allow outbound traffic on port 17472 from the Tanium Server device. The ZoneServerList.txt configuration file located in the Tanium Zone Server Hub's installation folder identifies the addresses of the destination Zone Servers. See the Zone Server Configuration page for more details.\n\nPort Needed: Tanium Server to Zone Server over TCP port 17472.\n\nNetwork firewall rules:\n\nAllow TCP traffic on port 17472 from the Zone Server Hub, usually the Tanium Server device, to the destination DMZ devices(s) hosting the Zone Server(s).\n\nEndpoint firewall rules - for additional security, configure the following endpoint firewall rules:\n\nAllow TCP traffic outbound on port 17472 from only the Zone Server Hub process running on the Tanium Server device\nAllow TCP traffic inbound on port 17472 to only the Zone Server process running on the designated Zone Server device(s). \n\nhttps://kb.tanium.com/Port_Configuration_v6.5",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67109",
+      "title": "The Tanium application must authenticate all endpoint devices before allowing a network connection using bidirectional authentication that is cryptographically based.",
+      "description": "Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk.\n\nFor distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.\n\nA local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet).\n\nBecause of the challenges of applying this requirement of a large scale, organizations are encouraged to only apply the requirement to those limited number (and type) of devices that truly need to support this capability.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67111",
+      "title": "The SSLHonorCipherOrder DWORD  must be configured to disable weak encryption algorithms on the Tanium Server.",
+      "description": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67113",
+      "title": "The Tanium Server certificate must be signed by a DoD Certificate Authority.",
+      "description": "The Tanium Server has the option to use a \"self-signed\" certificate or a Trusted Certificate Authority signed certificate for SSL connections. During evaluations of Tanium in Lab settings, customers often conclude that a \"self-signed\" certificate is an acceptable risk. However, in production environments it is critical that a SSL certificate signed by a Trusted Certificate Authority be used on the Tanium Server in lieu of an untrusted and insecure \"self-signed\" certificate.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67115",
+      "title": "Any configured EMAIL RESULTS connectors must be configured to enable TLS/SSL to encrypt communications.",
+      "description": "Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.\n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPSEC.\n\nAn example of this would be the SMTP queue. The SMTP mail protocol places email messages into a centralized queue prior to transmission. If someone were to modify an email message contained in the queue and the SMTP protocol did not check to ensure the email message was not modified while it was stored in the queue, a modified email could be sent.",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67117",
+      "title": "The Tanium Server must ensure the authenticity of communications sessions when making requests from Tanium Clients.",
+      "description": "Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.\n\nApplication communication sessions are protected utilizing transport encryption protocols, such as SSL or TLS. SSL/TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. \n\nThis requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).\n\nThis requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of SSL/TLS mutual authentication (two-way/bidirectional).",
+      "severity": "medium"
+    },
+    {
+      "id": "V-67119",
+      "title": "File integrity monitoring of critical executables that Tanium uses must be configured.",
+      "description": "Tanium inherently watches files and their respective hash values for change but while Tanium can do file integrity checks of critical executables, it is important to conduct File Integrity Monitoring (FIM) via an outside service such as Host Based Security System (HBSS) or similar security suites with FIM capability. These technologies provide independent monitoring of critical Tanium and system binaries.",
+      "severity": "medium"
+    }
+  ]
+}