U Apple macOS 14 V2R2

ℹ️ The items you can view are limited because you do not have a subscription. Contact us at [email protected] to purchase one.

All (155)

Highs (10)

Mediums (143)

Lows (2)

UNCLASSIFIED

Group Title

SRG-OS-000033-GPOS-00014

Group ID

V-259438

Rule Version

APPL-14-000054

Rule Title

The macOS system must limit SSHD to FIPS-compliant connections.

Rule ID

SV-259438r958408_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If SSHD is enabled then it must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS 140 validated.

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

Operating systems utilizing encryption must use FIPS validated mechanisms for authenticating to cryptographic modules.

Note: For more information on FIPS compliance with the version of SSHD included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174,SRG-OS-000396-GPOS-00176,SRG-OS-000424-GPOS-00188,SRG-OS-000478-GPOS-00223

Documentable

False

Check Content

Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]" "KexAlgorithms ecdh-sha2-nistp256" "MACs hmac-sha2-256" "PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]" "CASignatureAlgorithms ecdsa-sha2-nistp256")

total=0

for config in $fips_sshd_config; do

total=$(expr $(/usr/sbin/sshd -G | /usr/bin/grep -i -c "$config") + $total)

done

echo $total

If the result is not "7", this is a finding.

Check System

C-63177r945373_chk

Fix Reference

F-63085r945374_fix

Fix Text

Configure the macOS system to limit SSHD to FIPS-compliant connections with the following command:

fips_sshd_config="Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/bin/echo "${fips_sshd_config}" > /etc/ssh/sshd_config.d/fips_sshd_config

Identities

CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-000803

Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

800-53 :: IA-7
800-53 Rev. 4 :: IA-7
800-53 Rev. 5 :: IA-7
800-53A :: IA-7.1

CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

800-53 Rev. 4 :: SC-8 (1)
800-53 Rev. 5 :: SC-8 (1)

CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

800-53 Rev. 4 :: SC-13
800-53 Rev. 5 :: SC-13 b

CCI-002890

Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

800-53 Rev. 4 :: MA-4 (6)
800-53 Rev. 5 :: MA-4 (6)

CCI-003123

Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

800-53 Rev. 4 :: MA-4 (6)
800-53 Rev. 5 :: MA-4 (6)

Group Title

SRG-OS-000033-GPOS-00014

Group ID

V-259439

Rule Version

APPL-14-000057

Rule Title

The macOS system must limit SSH to FIPS-compliant connections.

Rule ID

SV-259439r958408_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

SSH must be configured to limit the Ciphers, HostbasedAcceptedAlgorithms, HostKeyAlgorithms, KexAlgorithms, MACs, PubkeyAcceptedAlgorithms, CASignatureAlgorithms to algorithms that are FIPS 140 validated.

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meet federal requirements.

Operating systems utilizing encryption must use FIPS-validated mechanisms for authenticating to cryptographic modules.

Note: For more information on FIPS compliance with the version of SSH included in the macOS, the manual page apple_ssh_and_fips has additional information.

Satisfies: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000250-GPOS-00093,SRG-OS-000396-GPOS-00176,SRG-OS-000424-GPOS-00188,SRG-OS-000478-GPOS-00223

Documentable

False

Check Content

Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command:

fips_ssh_config="Host *

Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/usr/bin/grep -c "$fips_ssh_config" /etc/ssh/ssh_config.d/fips_ssh_config

If the result is not "8", this is a finding.

Check System

C-63178r945375_chk

Fix Reference

F-63086r945376_fix

Fix Text

Configure the macOS system to limit SSH to FIPS-compliant connections with the following command:

fips_ssh_config="Host *

Ciphers [email protected]

HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

HostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]

KexAlgorithms ecdh-sha2-nistp256

MACs hmac-sha2-256

PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]

CASignatureAlgorithms ecdsa-sha2-nistp256"

/bin/echo "${fips_ssh_config}" > /etc/ssh/ssh_config.d/fips_ssh_config

Identities

CCI-000068

Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-000803

800-53 :: IA-7
800-53 Rev. 4 :: IA-7
800-53 Rev. 5 :: IA-7
800-53A :: IA-7.1

CCI-001453

Implement cryptographic mechanisms to protect the integrity of remote access sessions.

800-53 :: AC-17 (2)
800-53 Rev. 4 :: AC-17 (2)
800-53 Rev. 5 :: AC-17 (2)
800-53A :: AC-17 (2).1

CCI-002421

Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

800-53 Rev. 4 :: SC-8 (1)
800-53 Rev. 5 :: SC-8 (1)

CCI-002450

Implement organization-defined types of cryptography for each specified cryptography use.

800-53 Rev. 4 :: SC-13
800-53 Rev. 5 :: SC-13 b

Group Title

SRG-OS-000067-GPOS-00035

Group ID

V-259477

Rule Version

APPL-14-001150

Rule Title

The macOS system must disable password authentication for SSH.

Rule ID

SV-259477r1009591_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If remote logon through SSH is enabled, password-based authentication must be disabled for user logon.

All users must go through multifactor authentication to prevent unauthenticated access and potential compromise to the system.

Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.

Satisfies: SRG-OS-000067-GPOS-00035,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000125-GPOS-00065,SRG-OS-000375-GPOS-00160

Documentable

False

Check Content

Verify the macOS system is configured to disable password authentication for SSH with the following command:

/usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)'

If the result is not "2", this is a finding.

Check System

C-63216r941051_chk

Fix Reference

F-63124r941052_fix

Fix Text

Configure the macOS system to disable password authentication for SSH with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')

if [[ -z $include_dir ]]; then

/usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config

echo "passwordauthentication no" >> "${include_dir}01-mscp-sshd.conf"

echo "kbdinteractiveauthentication no" >> "${include_dir}01-mscp-sshd.conf"

for file in $(ls ${include_dir}); do

if [[ "$file" == "100-macos.conf" ]]; then

continue

if [[ "$file" == "01-mscp-sshd.conf" ]]; then

break

/bin/mv ${include_dir}${file} ${include_dir}20-${file}

done

Identities

CCI-000186

For public key-based authentication, enforce authorized access to the corresponding private key.

800-53 :: IA-5 (2)
800-53 Rev. 4 :: IA-5 (2) (b)
800-53 Rev. 5 :: IA-5 (2) (a) (1)
800-53A :: IA-5 (2).1

CCI-000765

Implement multifactor authentication for network access to privileged accounts.

800-53 :: IA-2 (1)
800-53 Rev. 4 :: IA-2 (1)
800-53 Rev. 5 :: IA-2 (1)
800-53A :: IA-2 (1).1

CCI-000766

Implement multifactor authentication for network access to non-privileged accounts.

800-53 :: IA-2 (2)
800-53 Rev. 4 :: IA-2 (2)
800-53 Rev. 5 :: IA-2 (2)
800-53A :: IA-2 (2).1

CCI-000767

The information system implements multifactor authentication for local access to privileged accounts.

800-53 :: IA-2 (3)
800-53 Rev. 4 :: IA-2 (3)
800-53A :: IA-2 (3).1

CCI-000768

The information system implements multifactor authentication for local access to non-privileged accounts.

800-53 :: IA-2 (4)
800-53 Rev. 4 :: IA-2 (4)
800-53A :: IA-2 (4).1

CCI-000877

Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

800-53 :: MA-4 c
800-53 Rev. 4 :: MA-4 c
800-53 Rev. 5 :: MA-4 c
800-53A :: MA-4.1 (iv)

CCI-001941

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

800-53 Rev. 4 :: IA-2 (8)
800-53 Rev. 5 :: IA-2 (8)

CCI-001948

The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

800-53 Rev. 4 :: IA-2 (11)

CCI-004046

Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

800-53 Rev. 5 :: IA-2 (6) (a)

Group Title

SRG-OS-000074-GPOS-00042

Group ID

V-259499

Rule Version

APPL-14-002038

Rule Title

The macOS system must disable Trivial File Transfer Protocol service.

Rule ID

SV-259499r987796_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

If the system does not require Trivial File Transfer Protocol (TFTP), support it is nonessential and must be disabled.

The information system must be configured to provide only essential capabilities. Disabling TFTP helps prevent the unauthorized connection of devices and the unauthorized transfer of information.

Note: TFTP service is disabled at startup by default macOS.

Satisfies: SRG-OS-000074-GPOS-00042,SRG-OS-000080-GPOS-00048

Documentable

False

Check Content

Verify the macOS system is configured to disable trivial file transfer protocol service with the following command:

/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.tftpd" => disabled'

If the result is not "1", this is a finding.

Check System

C-63238r941117_chk

Fix Reference

F-63146r941118_fix

Fix Text

Configure the macOS system to disable trivial file transfer protocol service with the following command:

/bin/launchctl disable system/com.apple.tftpd

The system may need to be restarted for the update to take effect.

Identities

CCI-000197

For password-based authentication, transmit passwords only cryptographically-protected channels.

800-53 :: IA-5 (1) (c)
800-53 Rev. 4 :: IA-5 (1) (c)
800-53 Rev. 5 :: IA-5 (1) (c)
800-53A :: IA-5 (1).1 (v)

CCI-000213

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53 :: AC-3
800-53 Rev. 4 :: AC-3
800-53 Rev. 5 :: AC-3
800-53A :: AC-3.1

Group Title

SRG-OS-000366-GPOS-00153

Group ID

V-259509

Rule Version

APPL-14-002060

Rule Title

The macOS system must apply gatekeeper settings to block applications from unidentified developers.

Rule ID

SV-259509r1009592_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The information system implements cryptographic mechanisms to authenticate software prior to installation.

Gatekeeper settings must be configured correctly to only allow the system to run applications downloaded from the Mac App Store or applications signed with a valid Apple Developer ID code. Administrator users will still have the option to override these settings on a per-app basis. Gatekeeper is a security feature that ensures that applications must be digitally signed by an Apple-issued certificate in order to run. Digital signatures allow the macOS to verify that the application has not been modified by a malicious third party.

Documentable

False

Check Content

Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following command:

/usr/sbin/spctl --status --verbose | /usr/bin/grep -c "developer id enabled"

If the result is not "1", this is a finding.

Check System

C-63248r941147_chk

Fix Reference

F-63156r941148_fix

Fix Text

Configure the macOS system to apply gatekeeper settings to block applications from unidentified developers with the following command:

/usr/sbin/spctl --global-enable; /usr/sbin/spctl --enable

Identities

CCI-001749

The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

800-53 Rev. 4 :: CM-5 (3)

CCI-003992

Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

800-53 Rev. 5 :: CM-14

Group Title

SRG-OS-000423-GPOS-00187

Group ID

V-259510

Rule Version

APPL-14-002062

Rule Title

The macOS system must disable Bluetooth when no approved device is connected.

Rule ID

SV-259510r958908_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The macOS system must be configured to disable Bluetooth unless an approved device is connected.

[IMPORTANT]

====

Information system security officers (ISSOs) may make the risk-based decision not to disable Bluetooth to maintain necessary functionality, but they are advised to first fully weigh the potential risks posed to their organization.

====

Satisfies: SRG-OS-000423-GPOS-00187,SRG-OS-000481-GPOS-00481

Documentable

False

Check Content

Verify the macOS system is configured to disable Bluetooth with the following command:

/usr/bin/osascript -l JavaScript << EOS

$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\

.objectForKey('DisableBluetooth').js

EOS

If the result is not "true", this is a finding.

Check System

C-63249r941150_chk

Fix Reference

F-63157r941151_fix

Fix Text

Configure the macOS system to disable Bluetooth by installing the "com.apple.MCXBluetooth" configuration profiles.

Identities

CCI-002418

Protect the confidentiality and/or integrity of transmitted information.

800-53 Rev. 4 :: SC-8
800-53 Rev. 5 :: SC-8

Group Title

SRG-OS-000366-GPOS-00153

Group ID

V-259512

Rule Version

APPL-14-002064

Rule Title

The macOS system must enable Gatekeeper.

Rule ID

SV-259512r1009593_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

Gatekeeper must be enabled.

Gatekeeper is a security feature that ensures applications are digitally signed by an Apple-issued certificate before they are permitted to run. Digital signatures allow the macOS host to verify that the application has not been modified by a malicious third party.

Administrator users will still have the option to override these settings on a case-by-case basis.

Documentable

False

Check Content

Verify the macOS system is configured to enable gatekeeper with the following command:

/usr/sbin/spctl --status | /usr/bin/grep -c "assessments enabled"

If the result is not "1", this is a finding.

Check System

C-63251r941156_chk

Fix Reference

F-63159r941157_fix

Fix Text

Configure the macOS system to enable gatekeeper with the following command:

/usr/sbin/spctl --global-enable

Identities

CCI-001749

800-53 Rev. 4 :: CM-5 (3)

CCI-003992

800-53 Rev. 5 :: CM-14

Group Title

SRG-OS-000324-GPOS-00125

Group ID

V-259515

Rule Version

APPL-14-002069

Rule Title

The macOS system must require administrator privileges to modify systemwide settings.

Rule ID

SV-259515r958726_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

The system must be configured to require an administrator password in order to modify the systemwide preferences in System Settings.

Some Preference Panes in System Settings contain settings that affect the entire system. Requiring a password to unlock these systemwide settings reduces the risk of a nonauthorized user modifying system configurations.

Documentable

False

Check Content

Verify the macOS system is configured to require administrator privileges to modify systemwide settings with the following command:

authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferences.printing" "system.preferences.sharing" "system.preferences.softwareupdate" "system.preferences.startupdisk" "system.preferences.timemachine")

result="1"

for section in ${authDBs[@]}; do

if [[ $(/usr/bin/security -q authorizationdb read "$section" | /usr/bin/xmllint -xpath 'name(//*[contains(text(), "shared")]/following-sibling::*[1])' -) != "false" ]]; then

result="0"

done

echo $result

If the result is not "1", this is a finding.

Check System

C-63254r941165_chk

Fix Reference

F-63162r941166_fix

Fix Text

Configure the macOS system to require administrator privileges to modify systemwide settings with the following command:

for section in ${authDBs[@]}; do

/usr/bin/security -q authorizationdb read "$section" > "/tmp/$section.plist"

key_value=$(/usr/libexec/PlistBuddy -c "Print :shared" "/tmp/$section.plist" 2>&1)

if [[ "$key_value" == *"Does Not Exist"* ]]; then

/usr/libexec/PlistBuddy -c "Add :shared bool false" "/tmp/$section.plist"

else

/usr/libexec/PlistBuddy -c "Set :shared false" "/tmp/$section.plist"

/usr/bin/security -q authorizationdb write "$section" < "/tmp/$section.plist"

done

Identities

CCI-002235

Prevent non-privileged users from executing privileged functions.

800-53 Rev. 4 :: AC-6 (10)
800-53 Rev. 5 :: AC-6 (10)

Group Title

SRG-OS-000051-GPOS-00024

Group ID

V-259560

Rule Version

APPL-14-005001

Rule Title

The macOS system must ensure System Integrity Protection is enabled.

Rule ID

SV-259560r958428_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

System Integrity Protection (SIP) must be enabled.

SIP is vital to protecting the integrity of the system as it prevents malicious users and software from making unauthorized and/or unintended modifications to protected files and folders; ensures the presence of an audit record generation capability for defined auditable events for all operating system components; protects audit tools from unauthorized access, modification, and deletion; restricts the root user account and limits the actions that the root user can perform on protected parts of the macOS; and prevents nonprivileged users from granting other users direct access to the contents of their home directories and folders.

Note: SIP is enabled by default in macOS.

Satisfies: SRG-OS-000051-GPOS-00024,SRG-OS-000054-GPOS-00025,SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000062-GPOS-00031,SRG-OS-000080-GPOS-00048,SRG-OS-000122-GPOS-00063,SRG-OS-000256-GPOS-00097,SRG-OS-000257-GPOS-00098,SRG-OS-000258-GPOS-00099,SRG-OS-000259-GPOS-00100,SRG-OS-000278-GPOS-00108,SRG-OS-000350-GPOS-00138

Documentable

False

Check Content

Verify the macOS system is configured to enable System Integrity Protection with the following command:

/usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.'

If the result is not "1", this is a finding.

/usr/bin/grep -c "logger -s -p" /etc/security/audit_warn

If the result is not "1", this is a finding.

Check System

C-63299r941300_chk

Fix Reference

F-63207r941301_fix

Fix Text

Configure the macOS system to enable "System Integrity Protection" by booting into "Recovery" mode, launch "Terminal" from the "Utilities" menu, and run the following command:

/usr/bin/csrutil enable

Identities

CCI-000154

Provide the capability to centrally review and analyze audit records from multiple components within the system.

800-53 :: AU-6 (4)
800-53 Rev. 4 :: AU-6 (4)
800-53 Rev. 5 :: AU-6 (4)
800-53A :: AU-6 (4).1

CCI-000158

Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.

800-53 :: AU-7 (1)
800-53 Rev. 4 :: AU-7 (1)
800-53 Rev. 5 :: AU-7 (1)
800-53A :: AU-7 (1).1

CCI-000162

Protect audit information from unauthorized access.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000163

Protect audit information from unauthorized modification.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000164

Protect audit information from unauthorized deletion.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-000169

Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

800-53 :: AU-12 a
800-53 Rev. 4 :: AU-12 a
800-53 Rev. 5 :: AU-12 a
800-53A :: AU-12.1 (ii)

CCI-000213

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53 :: AC-3
800-53 Rev. 4 :: AC-3
800-53 Rev. 5 :: AC-3
800-53A :: AC-3.1

CCI-001493

Protect audit tools from unauthorized access.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9 a
800-53A :: AU-9.1

CCI-001494

Protect audit tools from unauthorized modification.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9
800-53A :: AU-9.1

CCI-001495

Protect audit tools from unauthorized deletion.

800-53 :: AU-9
800-53 Rev. 4 :: AU-9
800-53 Rev. 5 :: AU-9
800-53A :: AU-9.1

CCI-001496

Implement cryptographic mechanisms to protect the integrity of audit tools.

800-53 :: AU-9 (3)
800-53 Rev. 4 :: AU-9 (3)
800-53 Rev. 5 :: AU-9 (3)
800-53A :: AU-9 (3).1

CCI-001499

Limit privileges to change software resident within software libraries.

800-53 :: CM-5 (6)
800-53 Rev. 4 :: CM-5 (6)
800-53 Rev. 5 :: CM-5 (6)
800-53A :: CM-5 (6).1

CCI-001876

Provide an audit reduction capability that supports on-demand reporting requirements.

800-53 Rev. 4 :: AU-7 a
800-53 Rev. 5 :: AU-7 a

CCI-001878

Provide a report generation capability that supports on-demand audit review and analysis.

800-53 Rev. 4 :: AU-7 a
800-53 Rev. 5 :: AU-7 a

Group Title

SRG-OS-000185-GPOS-00079

Group ID

V-259561

Rule Version

APPL-14-005020

Rule Title

The macOS system must enforce FileVault.

Rule ID

SV-259561r958552_rule

Rule Severity

● High

Rule Weight

10.0

Vuln Discussion

FileVault must be enforced.

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

Satisfies: SRG-OS-000185-GPOS-00079,SRG-OS-000404-GPOS-00183,SRG-OS-000405-GPOS-00184

Documentable

False

Check Content

Verify the macOS system is configured to enforce FileVault with the following command:

dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS

$.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\

.objectForKey('dontAllowFDEDisable').js

EOS

)

fileVault=$(/usr/bin/fdesetup status | /usr/bin/grep -c "FileVault is On.")

if [[ "$dontAllowDisable" == "true" ]] && [[ "$fileVault" == 1 ]]; then

echo "1"

else

echo "0"

If the result is not "1", this is a finding.

Check System

C-63300r941303_chk

Fix Reference

F-63208r941304_fix

Fix Text

Note: Refer to the FileVault supplemental to implement this rule.

Identities

CCI-001199

Protects the confidentiality and/or integrity of organization-defined information at rest.

800-53 :: SC-28
800-53 Rev. 4 :: SC-28
800-53 Rev. 5 :: SC-28
800-53A :: SC-28.1

CCI-002475

Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.

800-53 Rev. 4 :: SC-28 (1)
800-53 Rev. 5 :: SC-28 (1)

CCI-002476

Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

800-53 Rev. 4 :: SC-28 (1)
800-53 Rev. 5 :: SC-28 (1)

UNCLASSIFIED