STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The SSLHonorCipherOrder must be configured to disable weak encryption algorithms on the Tanium Server.

DISA Rule

SV-253859r997281_rule

Vulnerability Number

V-253859

Group Title

SRG-APP-000416

Rule Version

TANS-SV-000035

Severity

CAT II

CCI(s)

CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

Fix Recommendation

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: regedit <enter>.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Add or modify the DWORD "SSLHonorCipherOrder" to have a value of 0x00000001 (hex).

Check Contents

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: regedit <enter>.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Verify the existence of a DWORD "SSLHonorCipherOrder" with a value of "0x00000001" (hex).

If the DWORD "SSLHonorCipherOrder" does not exist with a value of "0x00000001" (hex), this is a finding.

Vulnerability Number

V-253859

Documentable

False

Rule Version

TANS-SV-000035

Severity Override Guidance

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: regedit <enter>.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Verify the existence of a DWORD "SSLHonorCipherOrder" with a value of "0x00000001" (hex).

If the DWORD "SSLHonorCipherOrder" does not exist with a value of "0x00000001" (hex), this is a finding.

Check Content Reference

Target Key

5476