7231 - Second batch of macOS policy queries for CIS Benchmark (#7380)
* Adding CIS 1.5 / 1.6 / 2.2.1 to constants.ts * Adding CIS 1.5 / 1.6 / 2.2.1 to standard query library * Adding 2.3.1 * Adding 2.3.1 to query library and 2.4.2 to both * Adding 2.4.10 * Tagging 2.5.1.1 * Tagging 2.5.2.1 * Tagging 2.5.2.2 * Adding 2.5.6 * Adding 2.6.1.4 * Adding 3.6 * Tagging 5.1.2 * Tagging 5.2.2 * Tagging 5.8 The query we have for the screen lock is comprehensive and covers more than one CIS requirement * Adding 6.1.3 and 6.1.4
This commit is contained in:
Guillaume Ross
@@ -481,7 +481,7 @@ spec:
|
||||
description: Checks to make sure that the Gatekeeper feature is enabled on macOS devices. Gatekeeper tries to ensure only trusted software is run on a mac machine.
|
||||
resolution: "To enable Gatekeeper, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable."
|
||||
platforms: macOS
|
||||
tags: compliance, hardening, built-in
|
||||
tags: compliance, hardening, built-in, CIS2.5.2.1
|
||||
platform: darwin
|
||||
contributors: groob
|
||||
---
|
||||
@@ -509,7 +509,7 @@ spec:
|
||||
description: Checks to make sure that full disk encryption (FileVault) is enabled on macOS devices.
|
||||
resolution: To enable full disk encryption, on the failing device, select System Preferences > Security & Privacy > FileVault > Turn On FileVault.
|
||||
platforms: macOS
|
||||
tags: compliance, hardening, built-in
|
||||
tags: compliance, hardening, built-in, CIS2.5.1.1
|
||||
platform: darwin
|
||||
contributors: groob
|
||||
---
|
||||
@@ -533,7 +533,7 @@ spec:
|
||||
description: Checks to make sure that the System Integrity Protection feature is enabled.
|
||||
resolution: "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable."
|
||||
platforms: macOS
|
||||
tags: compliance, malware, hardening, built-in
|
||||
tags: compliance, malware, hardening, built-in, CIS5.1.2
|
||||
platform: darwin
|
||||
contributors: groob
|
||||
---
|
||||
@@ -700,7 +700,7 @@ spec:
|
||||
description: "Checks if the firewall is enabled."
|
||||
resolution: "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall."
|
||||
platforms: macOS
|
||||
tags: hardening, compliance, built-in
|
||||
tags: hardening, compliance, built-in, CIS2.5.2.2
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
@@ -736,7 +736,7 @@ spec:
|
||||
description: "Checks that the password policy requires at least 10 characters. Requires osquery 5.4.0 or newer."
|
||||
resolution: "Contact your IT administrator to make sure your Mac is receiving configuration profiles for password length."
|
||||
platforms: macOS
|
||||
tags: compliance, hardening, built-in
|
||||
tags: compliance, hardening, built-in, CIS5.2.2
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
@@ -786,4 +786,136 @@ spec:
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS1.4
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Automatic security and data file updates is enabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' AND value=1 LIMIT 1;
|
||||
description: "Checks that the operating system is configured to automatically download updates to built-in macOS security tools such as malware removal tools."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic security and data update installation."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS1.5
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Automatic installation of operating system updates is enabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallMacOSUpdates' AND value=1 LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to automatically install operating system updates."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of operating system updates."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS1.6
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Time and date are configured to be updated automatically (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='forceAutomaticDateAndTime' AND value=1 LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to automatically update the time and date."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic time and date configuration."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.2.1
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Inactivity limit of 20 minutes or less (macOS)
|
||||
query: SELECT 1 WHERE EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'askForPasswordDelay' AND valueint <= 60 LIMIT 1) AND EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'idleTime' AND valueint <= 1140 LIMIT 1) AND EXISTS (SELECT 1 from managed_policies WHERE domain='com.apple.screensaver' AND name='askForPassword' AND value=1 LIMIT 1);
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system lock the screen in 20 minutes or less."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that enables the screen saver and lock within an inactivity delay of 20 minutes or less."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.3.1, CIS5.8
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Internet sharing is blocked (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.MCX' AND name='forceInternetSharingOff' AND value='1' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to prevent Internet sharing."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that prevents Internet sharing."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.4.2
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Content caching is disabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='allowContentCaching' AND value='0' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to disable content caching."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that disables content caching."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.4.10
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Ad tracking is limited (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.AdLib' AND name='forceLimitAdTracking' AND value='1' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to limit advertisement tracking."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that disables advertisement tracking."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.5.6
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: iCloud Desktop and Document sync is disabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.icloud.managed' AND name='DisableCloudSync' AND value='1' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to prevent iCloud Desktop and Documents sync."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile to prevent iCloud Desktop and Documents sync."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS2.6.1.4
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Firewall logging is enabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND name='EnableLogging' AND value='1' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system log firewall activity."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that enables firewall logging."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS3.6
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Guest account is disabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.loginwindow' AND name='DisableGuestAccount' AND value='1' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to prevent the use of a guest account."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that disables the guest account."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS6.1.3
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: Guest access to shared folders is disabled (macOS)
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.AppleFileServer' AND name='guestAccess' AND value='0' LIMIT 1;
|
||||
description: "Checks that a mobile device management (MDM) solution configures the operating system to prevent guest access to shared folders."
|
||||
resolution: "Contact your IT administrator to ensure your Mac is receiving a profile that prevents guest access to shared folders."
|
||||
platforms: macOS
|
||||
tags: compliance, CIS, CIS6.1.4
|
||||
platform: darwin
|
||||
contributors: GuillaumeRoss
|
||||
Reference in New Issue
Block a user