OpenControls Logo

STIG Viewer

STIGViewer Support

The Tanium Server certificates must have Extended Key Usage entries for the serverAuth object TLS Web Server Authentication and the clientAuth object TLS Web Client Authentication.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-254914TANS-AP-000480SV-254914r961038_ruleCCI-000185medium
Description
Restricting this setting limits the user's ability to change their password. Passwords need to be changed at specific policy based intervals; however, if the application allows the user to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.
STIGDate
Tanium 7.x Application on TanOS Security Technical Implementation Guide2025-02-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4(17)Domain Authentication
1.00

+43 more (top 10 by confidence shown)

CCI1 mapping
CCI-000185
1.00

Details

Check Text (C-254914r961038_chk)

From Browser: 1. Navigate to the Tanium Console URI and log in using multi-factor authentication. 2. Click the lock to the left of the URI in the address bar. 3. Select the lock on the left of the URI in the address bar: a) Chrome: Select "Certificate". b) Edge: Select "Connection is Secure," and then select the certificate icon on the right. 4. Select the "Details" tab. 5. Scroll down through the details to find and select the "Enhanced Key Usage" field. If there is no "Enhanced Key Usage" field, this is a finding. In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified. If "Server Authentication" and "Client Authentication" are not both identified, this is a finding. From Server: 1. Access the Tanium Server interactively. 2. Log on to the TanOS server with the tanadmin role. 3. Press "2" for "Tanium Operations Menu," and then press "Enter". 4. Press "7" for "Download SOAP Certificate," and then press "Enter". 5. In a browser with access to the Tanium Server Console, navigate to https://<tanium server>/pub/SOAPServer.crt. 6. Download the SOAPServer.crt file when prompted. 7. Double-click on the file to open the certificate. 8. Select the "Details" tab. 9. Scroll down through the details to find and select the "Enhanced Key Usage" field. If there is no "Enhanced Key Usage" field, this is a finding. In the bottom screen, verify "Server Authentication" and "Client Authentication" are both identified. If "Server Authentication" and "Client Authentication" are not both identified, this is a finding.

Fix Text (F-58471r867641_fix)

Request or regenerate the certificate being used to include both the "Server Authentication" and "Client Authentication" objects.