The Essential Eight
How the Tanium Platform can assist with theimplementation of the Australian Cyber Security
Centre’s Essential Eight recommendations.

Essential Eight Overview
The Essential Eight is a baseline set of mitigation
strategies that have been recommended by theAustralian Cyber Security Centre (ACSC) to makeit harder for adversaries to compromise computer
systems. While implementation of the Essential
Eight does not guarantee against a successful
attack, the objective is aimed at significantly
reducing the attack surface.
Before we even start to address the Essential Eightcontrols, it’s worth discussing one of the greatest
challenges that most organisations face – andthat’s visibility. You can implement a very stringent
security posture against all your managed IT assets,
but that posture is only as good as the weakest
link. In this context, that weak link is your unknown
and therefore unmanaged devices. The Tanium
platform is designed to shine a light into every darkcorner of your network. It will continuously expose
every connected interface and quickly determine
those that should be brought under management,
those that are unmanageable and devices thatshould be immediately quarantined. Once you havean accurate, up to the minute view of your entire
endpoint fleet, only then will implementing theEssential Eight make a substantive improvement toThis document details each of the Essential Eightcontrols exactly as described by the ACSC andthen maps the capabilities of the Tanium Platform
against each control.
Application Control
ESSENTIAL EIGHT CONTROL - To prevent executionof unapproved/malicious programs including .exe,DLL, scripts (e.g. Windows Script Hosts, Powershelland HTA) and installer.
TANIUM CAPABILITY - For some years, theWindows Operating System (client and servervariants) have come with application and script
execution control in the form of AppLocker.
Organisations often choose not to use AppLocker
for a variety of reasons:
1. Whitelisting applications like AppLocker
require constant updates to cover the everchanging application landscape of a large
enterprise
2. Administration of AppLocker via the nativecontrols is cumbersome
3. Local admins can change policy and render
AppLocker ineffective

your overall security.

Tanium Enforce allows administrators to set

The Tanium Platform allows organisations toto specific Computer Groups. The policy itself is“replatform” the endpoint, removing multiple 3rdparty applications and their associated endpoint
agents. With Tanium, functionality is consolidated
into a single agent, maximising endpoint resourcesand driving down 3rd party software costs.

AppLocker policy across an enterprise targeted
defined via an intuitive UI and can be applied andenforced to endpoints within the corporate networkor connected via the internet, whether on the VPN
or not.

Application Patchingalso possible to update settings via an application

ESSENTIAL EIGHT CONTROL - Flash, webspecific configuration file. Again, Tanium Enforce

browsers, Microsoft Office, Java and PDF viewers.

offers integration into GPO to allow policy

Patch/mitigate computers with ‘extreme risk’definition targeted based on machine, groups

vulnerabilities within 48 hours. Use the latestor users. Registry Keys and configuration files

version of applications.

can be modified at speed and scale via an Action
Package. The required state can be monitored andTANIUM CAPABILITY - Many organisations struggle

re-enforced if local changes over-write the desiredto understand the state of their application assets.

state.

They have limited visibility of what’s actually
installed on their endpoint fleet and their CMDB isRestrict Administrative Privileges

hard to keep up to date. They often rely on end-ESSENTIAL EIGHT CONTROL - Restrict

users to carry out application updates which results

administrative privileges to operating systems

in unpatched vulnerabilities remaining in place forand applications based on user duties. Regularly

months or years.

revalidate the need for privileges. Don’t use
privileged accounts for reading email and web

Tanium Deploy provides the ability to Install, Update

browsing.

and Remove applications at speed and scale acrossthe entire enterprise. Each endpoint constantly

TANIUM CAPABILITY - Keeping track ofevaluates its application state against the publishedadministrative privileges can be challenging. In

software catalogue, providing unparalleled visibility

general, permissions become too permissive over

into application assets across the entire endpoint

time as it’s easier to grant access than to remove it.

fleet. Application updates can be enforce based

In larger organisations, permissions become nestedon policy and update packages distributed very

as permission groups get included in others.

efficiently using the power of the Tanium Linear
Chain architecture.

Tanium Impact allows you to gain control ofyour administrative privileges. It provides aConfigure Microsoft Office Macro Settingsgraphical representation of access rights andESSENTIAL EIGHT CONTROL - Block macros from

more importantly, the resulting exposure if thosethe internet, and only allow vetted macros either

credentials are compromised. It will detail thein ‘trusted locations’ with limited write access orpotential lateral movement across your enterprisedigitally signed with a trusted certificate.

and allow you to quickly remediate a security issue.

TANIUM CAPABILITY - Setting Office Macro policy

More importantly, Tanium Impact gives youis achieved via Group Policy or Registry Keys.

the tools required to be able to lock down

Tanium makes either approach very easy. Taniumadministrative access rights to only those accounts

Enforce offers integration into GPO to allow policy

where they are actually required – limiting thedefinition targeted based on machine, groups orpossibility of privileged credential exposure and theusers. In addition, Tanium can update Registry

resulting lateral movement during an attack.

Keys at speed and scale across the entire endpoint
fleet, targeted by Computer Group using an Action

Patch Operating Systems

Package. Once in place, the configuration state canESSENTIAL EIGHT CONTROL - Patch/mitigate

be monitored to ensure the enforced state remains

computers (including network devices) within place.

‘extreme risk’ vulnerabilities within 48 hours. Use
the latest operating system version. Don’t use

User Application Hardening

unsupported versions.

ESSENTIAL EIGHT CONTROL - Configure webbrowsers to block Flash (ideally uninstall it), ads

TANIUM CAPABILITY - Patching systems in aand Java on the internet. Disable unneeded

heterogeneous environment is complex. Assuming

features in Microsoft Office (e.g. OLE), web browsers

you can identify which systems need a patch, youand PDF viewers.

have little feedback about whether a patch actually
installed successfully after it’s been deployed.

TANIUM CAPABILITY - Depending on theThe borderless enterprise means that more andapplication, hardening can be accomplished via

more company IT assets are located remotely andGPO and Registry Keys. For some applications, it ispatching these systems can have a negative impact

on VPN and WAN connectivity.

Daily Backups
ESSENTIAL EIGHT CONTROL - Maintain a daily

Tanium Patch solves these issues. It gives you

backup of important new/changed data, software

visibility into the patching state of your entire

and configuration settings, stored disconnected,

endpoint fleet – whether they are on the corporate

retained for at least three months. Test restoration

network or not. Monthly patching becomes a trivial

initially, annually and when IT infrastructure

exercise that can be completed in minutes or hours

changes.

rather than days or weeks with current patchingsolutions. Any endpoints that are off the corporate

TANIUM CAPABILITY - For many organisations,network are just as visible to Tanium Patch anddaily backup of critical data has become a process

patch download location can be controlled whenthat is transparent to the endpoint. Backups are

it makes more sense to download directly fromtaken centrally via a volume backup on a shared

Microsoft. This ensures that corporate WAN andstorage device or at the hypervisor layer. While theVPN resources are protected and available for

Tanium Platform doesn’t provide backup services,critical business functions.

there are a few uses cases where Tanium can assist.

For major Operating System updates - for example

If an adversary has made changes to critical files

Windows 10 1909 and 2004 - Tanium Deploy can be

and built in persistence via modified registry keys,

used to manage deployment.

these changes are typically included as part of
the regular backup. This means that following theMulti-factor authentication

discovery of an attack, it can be very difficult to findESSENTIAL EIGHT CONTROL - Implement multi-a restore point that isn’t going to keep the door

factor authentication (MFA) for VPNs, RDP, SSH

open for the attacker. Of course, the further backand other remote access, and for all users when

you go, the further you move from your Recovery

they perform a privileged action or access an

Point Objective.

important (sensitive/high-availability) datarepository.

Understanding when unauthorised changes arebeing made to critical system files is essential toTANIUM CAPABILITY - While the Tanium Platform

ensuring that the data you are backing up is indeed

doesn’t provide MFA capability, it will fully support

in a restorable condition. Tanium Integrity Monitor

integration with the most common MFA providers.

enables you to monitor those critical files and alert

Indeed, it is strongly recommended that MFA is inon any changes that occur, giving you confidence

place for the Tanium platform and is mandatory forin the integrity of your backup.

TaaS (Tanium as a Service).
There are times when a machine-initiated backup
However, Tanium can be used to audit youris required. Given the prevalence of centralised

endpoint fleet to ensure that MFA is correctly

backup technology, this can expose someenabled and provide visibility into configuration

management challenges. The Tanium Platform

gaps. This information is very useful to ensure

can be used in both an auditing and schedulingcomprehensive MFA coverage and eliminate

capacity. It can monitor critical systems to ensure

any weak spots in your security posture. Whenthat backups have been completed correctly.

issues are found, Tanium can also be used to pushTanium can also be used to copy and export criticalrequired MFA software to an endpoint as well

files to an external system.

as modify any configurations across your entire
endpoint fleet.

For more information on the Essential Eight, visit
https://cyber.gov.au/acsc and speak to Tanium.

About Us
Tanium is a unified endpoint management and security platform proven in the world’s most technically demanding organizations. Providing unparalleled speed, visibility, andscale, we serve half of the Fortune 100, top retailers and financial institutions, and four branches of the US Armed Forces, which rely on Tanium to make confident decisions,operate efficiently, and reduce risk. Tanium recently ranked 7th on the Forbes list of “Top 100 Private Companies In Cloud Computing For 2019,” 10th on FORTUNE’s list of the“100 Best Medium Workplaces” in the U.S., and 18th on the UK’s Best Workplaces list. Visit us at www.tanium.com or follow us on LinkedIn and Twitter.

©2020 Tanium. All rights reserved.