Apple OS X 10.15 (Catalina) Security Technical Implementation Guide

The Apple OS X 10.15 (Catalina) Security Technical Implementation Guide (V1 R10) has 109 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

109STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R10

CurrentPublished Thu Jan 26 2023

The macOS system must restrict the ability to utilize external writable media devices.

Apple OS X 10.15 (Catalina) Security Technical Implementation Guide

Assessment Title

Rule Text

The macOS system must restrict the ability to utilize external writable media devices.

Description

Discussion Text

External writeable media devices must be disabled for users. External USB devices are a potential vector for malware and can be used to exfiltrate sensitive data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-250321

Rule

SV-250321r832919_rule

Severity

medium

Rule Version

AOSX-15-005051

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the system is configured to disable external writable media devices:
$ /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/egrep -A 3 'blankbd|blankcd|blankdvd|dvdram|harddisk-external'

"blankbd" = (
deny,
eject
);

"blankcd" = (
deny,
eject
);

"blankdvd" = (
deny,
eject
);

"dvdram" = (
deny,
eject
);

"harddisk-external" = (
deny,
eject
);

If the result does not match the output above and the external writeable media devices have not been approved by the Authorizing Official, this is a finding.

Implementation Procedure

Fix Text

This setting is enforced using the "Restrictions Policy" configuration profile.

STIG check 107 of 109 in the Apple OS X 10.15 (Catalina) STIG checklist

← Previous · V-245556The macOS system must be configured to disable the system preference pane for Siri.Next · V-252702 →The macOS system must be configured with Bluetooth turned off unless approved by the organization.