Apple OS X 10.15 (Catalina) Security Technical Implementation Guide

The Apple OS X 10.15 (Catalina) Security Technical Implementation Guide (V1 R10) has 109 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

109STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R10

CurrentPublished Thu Jan 26 2023

The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.

Apple OS X 10.15 (Catalina) Security Technical Implementation Guide

Assessment Title

Rule Text

The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.

Description

Discussion Text

Setting a lockout time period of 15 minutes is an effective deterrent against brute forcing that also makes allowances for legitimate mistakes by users. When three invalid logon attempts are made, the account will be locked.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-225132

Rule

SV-225132r853310_rule

Severity

medium

Rule Version

AOSX-15-000021

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Password policy is set with the Passcode Policy configuration profile.

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep minutesUntilFailedLoginReset

If the return is null or not "minutesUntilFailedLoginReset = 15", this is a finding.

Implementation Procedure

Fix Text

This setting is enforced using the "Passcode Policy" configuration profile or by a directory service.

STIG check 15 of 109 in the Apple OS X 10.15 (Catalina) STIG checklist

← Previous · V-225131The macOS system must enforce the limit of three consecutive invalid logon attempts by a user.Next · V-225133 →The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked.