STIGQter STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server.

DISA Rule

SV-253862r997284_rule

Vulnerability Number

V-253862

Group Title

SRG-APP-000416

Rule Version

TANS-SV-000044

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: regedit <enter>.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Add a new string (REG_SZ) or modify the string "SSLCipherSuite" to have a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

Check Contents

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: "regedit".

4. Click "Enter".

5. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

6. Verify the existence of the string "SSLCipherSuite" with a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

If the string "SSLCipherSuite" does not exist with the appropriate list values, this is a finding.

Vulnerability Number

V-253862

Documentable

False

Rule Version

TANS-SV-000044

Severity Override Guidance

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Access the server's registry by typing: "regedit".

4. Click "Enter".

5. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

6. Verify the existence of the string "SSLCipherSuite" with a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

If the string "SSLCipherSuite" does not exist with the appropriate list values, this is a finding.

Check Content Reference

M

Target Key

5476