Apple macOS 13 (Ventura) Security Technical Implementation Guide

The Apple macOS 13 (Ventura) Security Technical Implementation Guide (V1 R5) has 113 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

113STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Thu Jan 30 2025

The macOS system must restrict the ability of individuals to use USB storage devices.

Apple macOS 13 (Ventura) Security Technical Implementation Guide

Assessment Title

Rule Text

The macOS system must restrict the ability of individuals to use USB storage devices.

Description

Discussion Text

External writeable media devices must be disabled for users. External USB devices are a potential vector for malware and can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-257243

Rule

SV-257243r991589_rule

Severity

medium

Rule Version

APPL-13-005051

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the macOS system is configured to disable USB storage devices with the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -A 32 "mount-controls"

bd = (
"read-only"
);
blankbd = (
deny,
eject
);
blankcd = (
deny,
eject
);
blankdvd = (
deny,
eject
);
cd = (
"read-only"
);
"disk-image" = (
"read-only"
);
dvd = (
"read-only"
);
dvdram = (
deny,
eject
);
"harddisk-external" = (
deny,
eject
);

If the result does not match the output above and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Implementation Procedure

Fix Text

Configure the macOS system to disable USB storage devices by installing the "Restrictions Policy" configuration profile.

STIG check 100 of 113 in the Apple macOS 13 (Ventura) STIG checklist

← Previous · V-257242The macOS Application Firewall must be enabled.Next · V-257244 →The macOS system logon window must be configured to prompt for username and password.