STIGQter: STIG Summary: Tanium 7.0 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 27 July 2018:

The bandwidth consumption for the Tanium Server must be limited.

DISA Rule

SV-93451r1_rule

Vulnerability Number

V-78745

Group Title

SRG-APP-000247

Rule Version

TANS-SV-000055

Severity

CAT II

CCI(s)

• CCI-001095 - The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Access the Tanium Server interactively.

Log on with an account with administrative privileges to the server.

Access the server's registry by typing: regedit <enter>

Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

Add or modify the DWORD "DownloadBytesPerSecondLimit" to have a value that matches the value recorded in the system documentation.

Check Contents

Access the Tanium Server interactively.

Log on with an account with administrative privileges to the server.

Access the server's registry by typing: regedit <enter>

Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

Verify the existence of a DWORD "DownloadBytesPerSecondLimit".

If the DWORD "DownloadBytesPerSecondLimit" does not exist with a value equal to the value recorded in the system documentation, this is a finding.

Consult with your TAM for an appropriate value and record this in the system documentation.

If this setting is not documented, this is a finding.

Vulnerability Number

V-78745

Documentable

False

Rule Version

TANS-SV-000055

Severity Override Guidance

Access the Tanium Server interactively.

Log on with an account with administrative privileges to the server.

Access the server's registry by typing: regedit <enter>

Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

Verify the existence of a DWORD "DownloadBytesPerSecondLimit".

If the DWORD "DownloadBytesPerSecondLimit" does not exist with a value equal to the value recorded in the system documentation, this is a finding.

Consult with your TAM for an appropriate value and record this in the system documentation.

If this setting is not documented, this is a finding.

Check Content Reference

M

Target Key

3215

Comments