The Tanium Operating System (TanOS) must use multifactor authentication for network access to privileged accounts.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-254847 | TANS-OS-000325 | SV-254847r986546_rule | CCI-000765 | high |
| Description | ||||
| Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). The DOD CAC with DOD-approved PKI is an example of multifactor authentication. | ||||
| STIG | Date | |||
| Tanium 7.x Operating System on TanOS Security Technical Implementation Guide | 2025-02-11 | |||
Details
Check Text (C-254847r986546_chk)
1. Sign in to the TanOS console as a user with the tanadmin role.
2. Enter "C" to go to the "User Administration" menu.
3. Enter "M" to go to the "Multi-Factor Global Settings" menu.
4. If the status shows "Multi-Factor: Optional", this is a finding.
Fix Text (F-58404r866081_fix)
1. Sign in to the TanOS console as a user with the tanadmin role.
2. Enter "C" to go to the "User Administration" menu.
3. Enter "M" to go to the "Multi-Factor Global Settings" menu.
4. Enter "M" to "Require Multi-Factor Authentication".
5. Enter "E" to "Enable Require Multi-factor Authentication".