Tenable Identity Exposure 2024 On-Premises Release Notes

Tenable Identity Exposure version 3.77.6 contains the following bug fixes:

• Indicators of Attack (IoA)

  • New basic and aggressive modes — The basic mode is designed for customers who prefer a streamlined setup, minimizing configuration time and reducing false positives, thereby cutting down on unnecessary alert noise. This applies to the following IoAs:

    • DCSync

    • Suspicious DC Password Change

    • Golden Ticket

    • NTDS Extraction

    • OS Credential Dumping: LSASS Memory

    • Enumeration of Local Administrators

    • SAMAccountName Impersonation

• Indicators of Exposure (IoE)

  • New IoEs

  • Shadow Credentials — A new IoE detects backdoors and misconfigurations of shadow credentials in the "Windows Hello for Business" feature and its associated key credentials.

  • Managed Service Accounts Dangerous Misconfigurations — A new IoE ensures the proper deployment and configuration of Managed Service Accounts.

  • Privileged Authentication Silo Configuration — Assists AD administrators in installing and setting up an authentication silo for Tier-0 accounts.

  • Property Sets Integrity — "Property Set" in Microsoft Active Directory (AD) consolidates multiple attributes for easier, more efficient ACL management. This Indicator of Exposure checks for misconfigurations or potential backdoors within these AD objects and their attributes.

  • Privileged AD User Accounts Synchronized to Microsoft Entra ID — Checks that privileged Active Directory user accounts are not synchronized to Microsoft Entra ID.

  • Enabled Guest Account — Checks that the built-in guest account is disabled.

  • Conflicting Security Principals — Checks that there are no duplicated (conflicting) users, computers, or groups.

  • RSOP-based IoEs — To enhance performance, Tenable Identity Exposure excludes live RSoP (Resultant Set of Policy) checks. Instead, schedule one RSoP security check every 30 minutes, which allows for better management of related checks that are necessary during the RSoP process. For more information, see RSOP-based Indicators of Exposure.

  • Last Password Change on KRBTGT Account — Added support for the krbtgt_AzureAD account in Windows Hello for Business (Cloud Trust deployment).

  • Reversible Passwords — Now includes validation for reversible passwords defined by the PSO with the attribute msDS-PasswordReversibleEncryptionEnabled.

  • Local Administrative Account Management — Support for New Windows LAPS. Introduces a new option called "LAPS version installed" and validate the configuration of the LAPS version based on user selections.

• Proxy — Ability to define a proxy connection during Tenable Identity Exposure installation or upgrade . This proxy connection enables on-premises environments to work with Tenable One features.

• Secure Relay installation — The enhanced installer facilitates the upload of the self-signed certificate from the Directory Listener when you install the Secure Relay on a separate (standalone) machine.

• Email alerting now only supports secured encryption protocols, specifically TLS 1.2 and 1.3. Customers who have overridden their Secure Relay to use deprecated SMTP encryption standards, like SSLv3, must remove the override. The only allowed values are 'Tls12', 'Tls13', or 'TLS12,Tls13' for automatic switching based on the server version. Using unsupported values will prevent the relay from starting.

• New 10-hour "defer time" (Golden Ticket IoA) to allowlist legitimate users during this period, reducing the number of false positives.

• IoA setup — Ability to choose event gathering duration before triggering event analysis. Values are bounded from 30 seconds to 9 minutes.

• Active Directory — Tenable Identity Exposure increased the size limit for the AD objects it manages.

• Indicators of Exposure

  • Dangerous Kerberos Delegation

    • No longer considers users with smartcards a security issue, as they are not affected by the AS-REP Roasting attack.

    • No longer flags computers as deviant for the reason "Not protected against delegation"; it resolves any existing deviances.

    • A new reason reports all accounts where the attribute used by the constrained delegation (msDS-AllowedToDelegateTo) refers to a Service Principal Name (SPN) that does not exist.

    • A new reason detects the current configuration of Kerberos delegation on Microsoft Entra Connect account (AZUREADSSOACC).

• User Primary Group IoE — An additional reason reports on all accounts where the primaryGroupID attribute appears empty due to insufficient rights.

• Accounts With Never Expiring Passwords — A new reason to make a distinction between privileged users and regular users.

• Conflicting Security Principals — A new IoE checks that there are no duplicated (conflicting) objects such as users, computers, or groups.

• User Account Using Old Password, Computers Running an Obsolete OS, and Dormant Accounts — Two new reasons to make a distinction between privileged users and regular users.

• Domain Without Computer-Hardening GPOs

  • New checks to ensure that null sessions are explicitly disabled on all domain computers.

  • New checks related to hardened UNC paths configured for domain controllers (SYSVOL/NETLOGON shares).

  • New checks to ensure that the Print Spooler service is disabled on all domain controllers.

  • SMB signing enforcement — Tenable Identity Exposure ensures proper SMB signing enforcement on domain controllers and other servers. It validates the "Default Domain Controllers Policy" parameter and checks for correct GPO configuration on other servers.

Tenable Identity Exposure version 3.77.3 contains the following bug fixes: