Apple OS X 10.12 Security Technical Implementation Guide

The Apple OS X 10.12 Security Technical Implementation Guide (V1 R6) has 122 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

122STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R6

CurrentPublished Fri Jan 24 2020

The OS X system must restrict the ability of individuals to use USB storage devices.

Apple OS X 10.12 Security Technical Implementation Guide

Assessment Title

Rule Text

The OS X system must restrict the ability of individuals to use USB storage devices.

Description

Discussion Text

External hard drives, such as USB, must be disabled for users. USB hard drives are a potential vector for malware and can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-76101

Rule

SV-90789r1_rule

Severity

medium

Rule Version

AOSX-12-000850

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If an approved HBSS DCM/DLP solution is installed, this is not applicable.

To verify external USB drives are disabled, run the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -A 3 harddisk-external

If the option "eject,alert" is not set for "harddisk-external", this is a finding.

Implementation Procedure

Fix Text

This setting is enforced using the "Restrictions Policy" configuration profile.

STIG check 79 of 122 in the Apple OS X 10.12 STIG checklist

← Previous · V-76099The OS X system must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously where HBSS is used; 30 days for any additional internal network scans not covered by HBSS; and annually for external scans by Computer Network Defense Service Provider (CNDSP).Next · V-76103 →The OS X system must be configured with the usbmuxd daemon disabled.