MAC CIS 13_2.1.1.1 (#10120)
This commit is contained in:
Sharon Katz
@@ -77,6 +77,21 @@ fleetctl apply -f cis-policy-queries.yml
|
||||
|
||||
The above will add all the automated CIS Benchmark checks as Fleet policies.
|
||||
|
||||
### macOS 13.0 Ventura Benchmark manual checks that require customer decision
|
||||
|
||||
- 2.1.1.1 Audit iCloud Keychain (Level 2): Ensure that the iCloud keychain is used consistently with organizational requirements.
|
||||
The customer will decide whether iCloud keychain should be enabled or disabled and use only the relevant query
|
||||
2.1.1.1-enabled OR 2.1.1.1-disabled
|
||||
- 2.1.1.2 Audit iCloud Drive (Level 2): Ensure that the iCloud Drive is used consistently with organizational requirements.
|
||||
The customer will decide whether iCloud Drive should be enabled or disabled and use only the relevant query
|
||||
2.1.1.2-enabled OR 2.1.1.2-disabled
|
||||
- 2.5.1 Audit Siri (Level 1): Ensure that the Siri is used consistently with organizational requirements.
|
||||
The customer will decide whether Siri should be enabled or disabled and use only the relevant query
|
||||
2.5.1-enabled OR 2.5.1-disabled
|
||||
- 2.8.1 Audit Universal Control (Level 1): Ensure that the Universal Control is used consistently with organizational requirements.
|
||||
The customer will decide whether Universal Control should be enabled or disabled and use only the relevant query
|
||||
2.8.1-enabled OR 2.8.1-disabled
|
||||
|
||||
### macOS 13.0 Ventura Benchmark manual checks
|
||||
|
||||
The following CIS benchmark checks cannot be automated and must be addressed manually (they are flagged as "Manual"):
|
||||
@@ -102,4 +117,4 @@ The following CIS benchmark checks cannot be automated and must be addressed man
|
||||
|
||||
Please refer to the "CIS Apple macOS 13.0 Ventura Benchmark v1.0.0 - 11-14-2022" PDF for descriptions and instructions on how to remediate.
|
||||
|
||||
<meta name="pageOrderInSection" value="1700">
|
||||
<meta name="pageOrderInSection" value="1700">
|
||||
|
||||
@@ -103,6 +103,68 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Keychain is disabled (if your org policy is to disable it) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
The iCloud keychain is Apple's password manager that works with macOS and iOS. The capability allows users to store passwords in either iOS or macOS for use in Safari on both platforms and other iOS-integrated applications. The most pervasive use is driven by iOS use rather than macOS. The passwords stored in a macOS keychain on an Enterprise-managed computer could be stored in Apple's cloud and then be available on a personal computer using the same account. The stored passwords could be for organizational as well as for personal accounts.
|
||||
If passwords are no longer being used as organizational tokens, they are not in scope for iCloud keychain storage.
|
||||
Rationale:
|
||||
Ensure that the iCloud keychain is used consistently with organizational requirements.
|
||||
resolution: |
|
||||
The administrator should configure this via MDM profile.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.applicationaccess.
|
||||
2. The key to include is allowCloudKeychainSync.
|
||||
3. The key must be set to <false/>.
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowCloudKeychainSync'
|
||||
AND (value = '1' OR value = 'true')
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.1.1.1-disable, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Keychain is enabled (if your org policy is to enable it) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
The iCloud keychain is Apple's password manager that works with macOS and iOS. The capability allows users to store passwords in either iOS or macOS for use in Safari on both platforms and other iOS-integrated applications. The most pervasive use is driven by iOS use rather than macOS. The passwords stored in a macOS keychain on an Enterprise-managed computer could be stored in Apple's cloud and then be available on a personal computer using the same account. The stored passwords could be for organizational as well as for personal accounts.
|
||||
If passwords are no longer being used as organizational tokens, they are not in scope for iCloud keychain storage.
|
||||
Rationale:
|
||||
Ensure that the iCloud keychain is used consistently with organizational requirements.
|
||||
resolution: |
|
||||
The administrator should configure this via MDM profile.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.applicationaccess.
|
||||
2. The key to include is allowCloudKeychainSync.
|
||||
3. The key must be set to <true/>.
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowCloudKeychainSync'
|
||||
AND (value = '0' OR value = 'false')
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.1.1.1-enable, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Drive Document and Desktop Sync Is Disabled (MDM Required)
|
||||
platforms: macOS
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure iCloud Keychain is disabled (if your org policy is to disable it) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
The iCloud keychain is Apple's password manager that works with macOS and iOS. The capability allows users to store passwords in either iOS or macOS for use in Safari on both platforms and other iOS-integrated applications. The most pervasive use is driven by iOS use rather than macOS. The passwords stored in a macOS keychain on an Enterprise-managed computer could be stored in Apple's cloud and then be available on a personal computer using the same account. The stored passwords could be for organizational as well as for personal accounts.
|
||||
If passwords are no longer being used as organizational tokens, they are not in scope for iCloud keychain storage.
|
||||
Rationale:
|
||||
Ensure that the iCloud keychain is used consistently with organizational requirements.
|
||||
resolution: |
|
||||
The administrator should configure this via MDM profile.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.applicationaccess.
|
||||
2. The key to include is allowCloudKeychainSync.
|
||||
3. The key must be set to <false/>.
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowCloudKeychainSync'
|
||||
AND (value = '1' OR value = 'true')
|
||||
);
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.1.1.1-disable
|
||||
contributors: sharon-fdm
|
||||
@@ -0,0 +1,37 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.applicationaccess</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.1.check-enable</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>68D8C498-FB81-4262-9EF4-E689B5A6B40F</string>
|
||||
<key>allowCloudKeychainSync</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Ensure iCloud Keychain is enabled</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.1.1.1-enable</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>EE1BA83A-E145-4F5B-9597-836DC357BBE7</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
Reference in New Issue
Block a user