What changed in Apple OS X 10.15 (Catalina) STIG V1R10V1R10 changes

Apple OS X 10.15 (Catalina) STIG V1R10 (2023-01-26) replaced V1R9 (2022-07-27): 1 check added, 3 updated. It has 109 checks, against 108 in V1R9.

V1R10 checklistV1R9 checklist Compare V1R9 and V1R10 in STIG Compare

  • 1 added
  • 0 removed
  • 3 updated

Updated fields: Check text 2Discussion 1

Added in V1R10 (1)

  • V-255894CAT IThe macOS system must be a supported release.

Updated in V1R10 (3)

V-225120CAT IIThe macOS system must initiate the session lock no more than five seconds after a screen saver is started.Check text

Check text

To check if the system will prompt users to enter their passwords to unlock the screen saver, run the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep askForPasswordDelay If there is no result, or if "askForPasswordDelay" is not set to "5.0" or less, this is a finding.

V-225120 in V1R10

V-225221CAT IIThe macOS Application Firewall must be enabled.Check text

Check text

Verify that the built-in Firewallfirewall is enabled: # /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep 'EnableFirewall1|EnableStealthMode' If the return is not "EnableFirewall = 1;" and "EnableStealthMode = 1;" this is a finding. If the built-in firewall is not enabled, ask the System Administrator if another application firewall is installed and enabled. If no application firewall is installed and enabled, this is a finding.

V-225221 in V1R10

V-234700CAT IIThe macOS system must authenticate peripherals before establishing a connection.Discussion

Discussion

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drives, external storage, and printers.

V-234700 in V1R10

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R10 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.