STIGQter: STIG Summary: Tanium 7.x Application on TanOS Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The SSLCipherSuite must be configured to disable weak encryption algorithms on the Tanium Server.

DISA Rule

SV-254946r962034_rule

Vulnerability Number

V-254946

Group Title

SRG-APP-000416

Rule Version

TANS-AP-001095

Severity

CAT II

CCI(s)

CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

Fix Recommendation

1. Access the Tanium Server interactively.

2. Log on to the server with the tanadmin role.

3. Enter 2: Tanium Operations >> 2: Tanium Configuration Settings >> 1: Edit Tanium Server Settings.

4. Enter the number associated with key "SSLCipherSuite" to edit its value.

5. Add or modify the "SSLCipherSuite" key to have a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

Check Contents

1. Access the Tanium Server interactively.

2. Log on to the server with the tanadmin role.

3. Enter 2: Tanium Operations >> 2: Tanium Configuration Settings >> 1: Edit Tanium Server Settings.

4. Verify the existence of a "SSLCipherSuite" key with a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

If the String "SSLCipherSuite" does not exist with the appropriate list values, this is a finding.

Vulnerability Number

V-254946

Documentable

False

Rule Version

TANS-AP-001095

Severity Override Guidance

1. Access the Tanium Server interactively.

2. Log on to the server with the tanadmin role.

3. Enter 2: Tanium Operations >> 2: Tanium Configuration Settings >> 1: Edit Tanium Server Settings.

4. Verify the existence of a "SSLCipherSuite" key with a value of:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK

If the String "SSLCipherSuite" does not exist with the appropriate list values, this is a finding.

Check Content Reference

Target Key

5492