Apple OS X 10.14 (Mojave) Security Technical Implementation Guide

The Apple OS X 10.14 (Mojave) Security Technical Implementation Guide (V2 R6) has 119 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

119STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 27 2022

The macOS system must enable certificate for smartcards.

Apple OS X 10.14 (Mojave) Security Technical Implementation Guide

Assessment Title

Rule Text

The macOS system must enable certificate for smartcards.

Description

Discussion Text

To prevent untrusted certificates the certificates on a smartcard card must be valid in these ways: its issuer is system-trusted, the certificate is not expired, its "valid-after" date is in the past, and it passes CRL and OCSP checking.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-209614

Rule

SV-209614r610285_rule

Severity

medium

Rule Version

AOSX-14-003002

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

To view the setting for the smartcard certification configuration, run the following command:

sudo /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep checkCertificateTrust

If the return is not "checkCertificateTrust = 1;" with the numeral equal to 1 or greater, this is a finding.

Implementation Procedure

Fix Text

This setting is enforced using the "Smart Card Policy" configuration profile. 

Note: Before applying the "Smart Card Policy", the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.

STIG check 87 of 119 in the Apple OS X 10.14 (Mojave) STIG checklist

← Previous · V-209613The macOS system must issue or obtain public key certificates under an appropriate certificate policy from an approved service provider.Next · V-209615 →The macOS system must map the authenticated identity to the user or group account for PKI-based authentication.