Tanium Security Recommendations

This guide applies to on-premises installations of the Tanium Core Platform.

Tanium provides various resources, including hardened appliances and documentation, to help customers implement a secure architecture and configuration of the Tanium™ Core Platform. This document provides an overview of these resources and recommendations.

Infrastructure options

There are two primary infrastructure options for deploying the Tanium Core Platform:

1. Hardened physical or virtual Tanium™ Appliance.
2. Windows installation on customer-provided hardware.

Tanium recommends that you deploy a physical or virtual appliance when possible. Updates for the appliances are provided by Tanium. If an appliance is not practical, Tanium Core Platform software can be installed to customer-provided hardware, or to a cloud infrastructure with Windows virtual machines. Deployments on cloud infrastructure or customer-provided hardware require that the customer maintain and update the selected infrastructure.

General security recommendations

Regardless of how Tanium is deployed, Tanium recommends the following security best practices.

Secure access to the Tanium™ Console

Tanium recommends that you limit network access to the Tanium Console to specific management networks and specific devices. In addition, user access should require multi-factor authentication (MFA). Tanium supports multi-factor authentication via RADIUS, TACACS+, X.509 based certificate authentication with Common Access Cards (CAC), and SAML.

Related links

• Tanium Core Platform Deployment Reference Guide: Smart card authentication
• Tanium Core Platform User Guide: Using SAML

Install a valid TLS Certificate

User connections to the Tanium Console are encrypted using Transport Layer Security (TLS). A self-signed certificate is generated during the installation process. However, Tanium recommends that customers obtain and install a valid TLS certificate.

Related links

• Tanium Core Platform Deployment Reference Guide: SSL certificates

Configure enhanced security for Tanium private keys

Tanium recommends that you use a Hardware Security Module (HSM) to provide a higher level of protection for key material. When you use an HSM, keys are stored on the HSM, rather than on the Tanium Server, and cannot be retrieved from the HSM. The Tanium Server interacts with the HSM, which signs valid Tanium requests.

Related links

• Tanium Console User Guide: Managing Tanium keys
• Tanium Platform Deployment Reference Guide: Securing keys with an HSM

Use two-person integrity for actions

Tanium recommends that you enable and use the action approval feature when possible. When action approval is enabled, any action deployed by a user must first be approved by a second employee. Action approval significantly mitigates the risk of an operator mistakenly issuing a potentially harmful action.

Related links

• Tanium Core Platform User Guide: Using action approval

Enable and forward Tanium logs

Tanium recommends that you enable audit logs and forward the logs to a centralized log management solution. Tanium supports logging of all actions performed by Tanium users, including user changes related to API tokens, computer groups, content sets, dashboards, keys, global settings, packages, plugin schedules, privileges, saved questions, scheduled actions, roles, sensors, users, and user groups.

You can use Tanium™ Connect to send audit logs to external destinations, and you can also access audit information through the Get audit types route (/api/v2/audit_types) in the Tanium Server REST API. To obtain a copy of the Tanium Server REST API Reference, contact Tanium Support.

Related links

• Tanium Connect User Guide: Tanium Audit Source data

Role-based access control (RBAC)

Tanium supports fine-grained role-based access controls to allow your organization to implement the principle of least privilege. Tanium provides a number of granular roles with each product and supports creation of additional roles with custom privileges. In addition to role-based access controls, you can use computer groups to scope permissions to a limited set of endpoints. Tanium recommends leveraging these features to ensure that the appropriate roles are granted to existing users and new users to limit functionality according to the specific job requirements for a given user.

Related links

• Tanium Core Platform User Guide: RBAC overview

Infrastructure-specific security recommendations

In addition to the general recommendations, Tanium recommends the following security considerations that are specific to each type of infrastructure.

Securing a Tanium Virtual Appliance

Tanium recommends that you secure the virtual host to limit access to the guest Tanium virtual appliance. This includes applying appropriate hardening guides and, where possible, requiring MFA to access the host.

Securing a deployment in cloud infrastructure

Tanium recommends that you subject cloud environments that host Tanium Core Platform servers to strict access controls to ensure that only a well-known and limited group of users may access and alter the cloud resources used by the Tanium deployment. Tanium recommends that you leverage the cloud provider’s access controls functionality to isolate the Tanium Core Platform servers from other internal or production systems:

• In Amazon Web Services (AWS) infrastructure, use Organizations and deploy in a Tanium-specific AWS account.
• In a Google Cloud Platform (GCP) infrastructure, deploy Tanium in a Tanium-specific Project.
• In Microsoft Azure infrastructure, deploy Tanium in a Tanium-specific Resource Group.

In addition, follow the security best practices available from your cloud provider and industry standards including, but not limited to, limiting network communications to and from their virtual network, ensuring MFA is enabled for cloud users, and monitoring cloud API activity.

Securing a deployment in customer-provided Windows infrastructure

When installing Tanium on a Windows Server, Tanium recommends that customers follow the Tanium hardening guide. The guide was developed in cooperation with the Defense Information Systems Agency (DISA) and provides recommendations on how to secure the Tanium Server in a Windows environment.

Tanium also recommends that customers implement strict access controls to mitigate the risk of a domain credential compromise impacting the security of a Tanium Windows installation. At a minimum, this should include:

• Restricting inbound access to Windows management protocols using a hardware or software-based firewall, especially those not protected by MFA. Access can also be limited by removing the Windows Server from the domain.
• Limiting the number of services accounts and permissions for service accounts to only the accounts and permissions that are required.

Contact Tanium Support

To contact Tanium Support for help, sign in to https://support.tanium.com.