CCI-000018 in U Apple macOS 13 V1R4

ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

UNCLASSIFIED
Group Title
SRG-OS-000004-GPOS-00004
Group ID
V-257168
Rule Version
APPL-13-001001
Rule Title
The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all nonlocal maintenance and diagnostic sessions.
Rule ID
SV-257168r905137_rule
Rule Severity
● Medium
Rule Weight
10.0
Vuln Discussion

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). If events associated with nonlocal administrative access or diagnostic sessions are not logged, a major tool for assessing and investigating attacks would not be available.

This requirement addresses auditing-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems.

Administrative and privileged access, including administrative use of the command line tools "kextload" and "kextunload" and changes to configuration settings, are logged by way of the "ad" flag.

Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection.

This requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system, for example, the software implementing "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch.

Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000327-GPOS-00127, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222

Documentable
False
Check Content

Verify the macOS system is configured to audit privileged access with the following command:

/usr/bin/sudo /usr/bin/grep ^flags /etc/security/audit_control

If "ad" is not listed in the output, this is a finding.

Check System
C-60853r905135_chk
Fix Reference
F-60794r905136_fix
Fix Text

Configure the macOS system to audit privileged access with the following command:

/usr/bin/sudo /usr/bin/sed -i.bak '/^flags/ s/$/,ad/' /etc/security/audit_control; /usr/bin/sudo /usr/sbin/audit -s

A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.

Identities
CCI-000018

Automatically audit account creation actions.

  • 800-53 :: AC-2 (4)
  • 800-53 Rev. 4 :: AC-2 (4)
  • 800-53 Rev. 5 :: AC-2 (4)
  • 800-53A :: AC-2 (4).1 (i and ii)
CCI-000172

Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

  • 800-53 :: AU-12 c
  • 800-53 Rev. 4 :: AU-12 c
  • 800-53 Rev. 5 :: AU-12 c
  • 800-53A :: AU-12.1 (iv)
CCI-001403

Automatically audit account modification actions.

  • 800-53 :: AC-2 (4)
  • 800-53 Rev. 4 :: AC-2 (4)
  • 800-53 Rev. 5 :: AC-2 (4)
  • 800-53A :: AC-2 (4).1 (i and ii)
CCI-001404

Automatically audit account disabling actions.

  • 800-53 :: AC-2 (4)
  • 800-53 Rev. 4 :: AC-2 (4)
  • 800-53 Rev. 5 :: AC-2 (4)
  • 800-53A :: AC-2 (4).1 (i and ii)
CCI-001405

Automatically audit account removal actions.

  • 800-53 :: AC-2 (4)
  • 800-53 Rev. 4 :: AC-2 (4)
  • 800-53 Rev. 5 :: AC-2 (4)
  • 800-53A :: AC-2 (4).1 (i and ii)
CCI-002234

Log the execution of privileged functions.

  • 800-53 Rev. 4 :: AC-6 (9)
  • 800-53 Rev. 5 :: AC-6 (9)
CCI-002884

Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

  • 800-53 Rev. 4 :: MA-4 (1) (a)
  • 800-53 Rev. 5 :: MA-4 (1) (a)
UNCLASSIFIED