STIGQter STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide

Version: 1

Release: 2 Benchmark Date: 24 Jan 2020

CheckedNameTitle
SV-104709r2_ruleThe macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission.
SV-104711r1_ruleThe macOS system must be integrated into a directory services infrastructure.
SV-104713r1_ruleThe macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked.
SV-104715r1_ruleThe macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions.
SV-104717r1_ruleThe macOS system must limit the number of concurrent SSH sessions to 10 for all accounts and/or account types.
SV-104719r1_ruleThe macOS system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records are not immediately sent to a central audit record storage facility.
SV-104721r1_ruleThe macOS system must limit the ability of non-privileged users to grant other users direct access to the contents of their home directories/folders.
SV-104723r1_ruleThe macOS system must prohibit user installation of software without explicit privileged status.
SV-104725r1_ruleThe macOS system must uniquely identify peripherals before establishing a connection.
SV-104727r1_ruleThe macOS system must use an approved antivirus program.
SV-104729r1_ruleThe macOS system must use multifactor authentication for local and network access to privileged and non-privileged accounts.
SV-104731r2_ruleThe macOS system must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
SV-104733r1_ruleThe macOS system must be configured with the sudoers file configured to authenticate users on a per -tty basis.
SV-104735r1_ruleThe macOS system must be configured with a dedicated user account to decrypt the hard disk upon startup.
SV-104925r1_ruleThe macOS system must be configured to prevent Apple Watch from terminating a session lock.
SV-104927r1_ruleThe macOS system must retain the session lock until the user reestablishes access using established identification and authentication procedures.
SV-104929r1_ruleThe macOS system must initiate the session lock no more than five seconds after a screen saver is started.
SV-104931r1_ruleThe macOS system must initiate a session lock after a 15-minute period of inactivity.
SV-104933r1_ruleThe macOS system must be configured to lock the user session when a smart token is removed.
SV-104935r1_ruleThe macOS system must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
SV-104937r2_ruleThe macOS system must be configured to disable hot corners.
SV-104939r1_ruleThe macOS system must be configured with Wi-Fi support software disabled.
SV-104941r1_ruleThe macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission.
SV-104943r1_ruleThe macOS system must automatically remove or disable temporary user accounts after 72 hours.
SV-104945r2_ruleThe macOS system must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.
SV-104947r1_ruleThe macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS).
SV-104949r1_ruleThe macOS system must utilize an HBSS solution and implement all DoD required modules.
SV-104951r1_ruleThe macOS system must enforce the limit of three consecutive invalid logon attempts by a user.
SV-104953r2_ruleThe macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts.
SV-104955r1_ruleThe macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system.
SV-104957r1_ruleThe macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.
SV-104959r1_ruleThe macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system.
SV-104961r1_ruleThe macOS system must be configured so that log files must not contain access control lists (ACLs).
SV-104963r1_ruleThe macOS system must be configured so that log folders must not contain access control lists (ACLs).
SV-104965r1_ruleThe macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.
SV-104967r1_ruleThe macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.
SV-104969r1_ruleThe macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.
SV-104971r1_ruleThe macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all non-local maintenance and diagnostic sessions.
SV-104973r1_ruleThe macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.
SV-104975r1_ruleThe macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
SV-104977r1_ruleThe macOS system must shut down by default upon audit failure (unless availability is an overriding concern).
SV-104979r1_ruleThe macOS system must be configured with audit log files owned by root.
SV-104981r1_ruleThe macOS system must be configured with audit log folders owned by root.
SV-104983r1_ruleThe macOS system must be configured with audit log files group-owned by wheel.
SV-104985r1_ruleThe macOS system must be configured with audit log folders group-owned by wheel.
SV-104987r1_ruleThe macOS system must be configured with audit log files set to mode 440 or less permissive.
SV-104989r1_ruleThe macOS system must be configured with audit log folders set to mode 700 or less permissive.
SV-104991r1_ruleThe macOS system must audit the enforcement actions used to restrict access associated with changes to the system.
SV-104993r1_ruleThe macOS system must provide an immediate warning to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of repository maximum audit record storage capacity.
SV-104995r1_ruleThe macOS system must provide an immediate real-time alert to the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.
SV-104997r1_ruleThe macOS system must generate audit records for DoD-defined events such as successful/unsuccessful logon attempts, successful/unsuccessful direct access attempts, starting and ending time for user access, and concurrent logons to the same account from different sources.
SV-104999r1_ruleThe macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
SV-105001r1_ruleThe macOS system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.
SV-105003r1_ruleThe macOS system must be configured to disable SMB File Sharing unless it is required.
SV-105005r1_ruleThe macOS system must be configured to disable Apple File (AFP) Sharing.
SV-105007r1_ruleThe macOS system must be configured to disable the Network File System (NFS) daemon unless it is required.
SV-105009r1_ruleThe macOS system must be configured to disable Location Services.
SV-105011r1_ruleThe macOS system must be configured to disable Bonjour multicast advertising.
SV-105013r1_ruleThe macOS system must be configured to disable the UUCP service.
SV-105015r1_ruleThe macOS system must be configured to disable Internet Sharing.
SV-105021r1_ruleThe macOS system must be configured to disable Web Sharing.
SV-105023r1_ruleThe macOS system must be configured to disable AirDrop.
SV-105025r2_ruleThe macOS system must be configured to disable the application FaceTime.
SV-105027r2_ruleThe macOS system must be configured to disable the application Messages.
SV-105029r1_ruleThe macOS system must be configured to disable the iCloud Calendar services.
SV-105031r1_ruleThe macOS system must be configured to disable the iCloud Reminders services.
SV-105033r1_ruleThe macOS system must be configured to disable iCloud Address Book services.
SV-105035r1_ruleThe macOS system must be configured to disable the Mail iCloud services.
SV-105037r1_ruleThe macOS system must be configured to disable the iCloud Notes services.
SV-105039r1_ruleThe macOS system must be configured to disable the camera.
SV-105043r1_ruleThe macOS system must be configured to disable the application Mail.
SV-105045r1_ruleThe macOS system must be configured to disable Siri and dictation.
SV-105047r2_ruleThe macOS system must be configured to disable sending diagnostic and usage data to Apple.
SV-105049r1_ruleThe macOS system must be configured to disable Remote Apple Events.
SV-105051r1_ruleThe macOS system must be configured to disable the application Calendar.
SV-105053r1_ruleThe macOS system must be configured to disable the system preference pane for iCloud.
SV-105055r2_ruleThe macOS system must be configured to disable the system preference pane for Internet Accounts.
SV-105057r1_ruleThe macOS system must be configured to disable the Siri Setup services.
SV-105059r1_ruleThe macOS system must be configured to disable the Cloud Setup services.
SV-105061r1_ruleThe macOS system must be configured to disable the Privacy Setup services.
SV-105063r1_ruleThe macOS system must be configured to disable the Cloud Storage Setup services.
SV-105065r2_ruleThe macOS system must be configured to disable the tftpd service.
SV-105067r1_ruleThe macOS system must disable Siri pop-ups.
SV-105069r1_ruleThe macOS system must disable iCloud Keychain synchronization.
SV-105071r1_ruleThe macOS system must disable iCloud document synchronization.
SV-105073r1_ruleThe macOS system must disable iCloud bookmark synchronization.
SV-105075r1_ruleThe macOS system must disable iCloud photo library.
SV-105077r1_ruleThe macOS system must disable Cloud Document Sync.
SV-105079r1_ruleThe macOS system must disable the Screen Sharing feature.
SV-105081r2_ruleThe macOS system must allow only applications downloaded from the App Store to run.
SV-105083r1_ruleThe macOS system must be configured so that end users cannot override Gatekeeper settings.
SV-105085r1_ruleThe macOS system must be configured with Bluetooth turned off unless approved by the organization.
SV-105087r1_ruleThe macOS system must disable the guest account.
SV-105089r1_ruleThe macOS system must have the security assessment policy subsystem enabled.
SV-105091r1_ruleThe macOS system must not allow an unattended or automatic logon to the system.
SV-105093r1_ruleThe macOS system must set permissions on user home directories to prevent users from having access to read or modify another users files.
SV-105095r1_ruleThe macOS system must issue or obtain public key certificates under an appropriate certificate policy from an approved service provider.
SV-105097r1_ruleThe macOS system must enable certificate for smartcards.
SV-105099r1_ruleThe macOS system must map the authenticated identity to the user or group account for PKI-based authentication.
SV-105101r1_ruleThe macOS system must enforce password complexity by requiring that at least one numeric character be used.
SV-105103r1_ruleThe macOS system must enforce a 60-day maximum password lifetime restriction.
SV-105105r1_ruleThe macOS system must prohibit password reuse for a minimum of five generations.
SV-105107r1_ruleThe macOS system must enforce a minimum 15-character password length.
SV-105109r1_ruleThe macOS system must enforce password complexity by requiring that at least one special character be used.
SV-105111r1_ruleThe macOS system must be configured to prevent displaying password hints.
SV-105113r1_rulemacOS must be configured with a firmware password to prevent access to single user mode and booting from alternative media.
SV-105115r1_ruleThe macOS system must use multifactor authentication in the establishment of nonlocal maintenance and diagnostic sessions.
SV-105117r1_ruleThe macOS system must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
SV-105119r1_ruleThe macOS system must be configured so that the login command requires smart card authentication.
SV-105121r1_ruleThe macOS system must be configured so that the su command requires smart card authentication.
SV-105123r1_ruleThe macOS system must be configured so that the sudo command requires smart card authentication.
SV-105125r1_ruleThe macOS system must be configured with system log files owned by root and group-owned by wheel or admin.
SV-105127r1_ruleThe macOS system must be configured with system log files set to mode 640 or less permissive.
SV-105129r2_ruleThe macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission.
SV-105131r2_ruleThe macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission.
SV-105133r1_ruleThe macOS system must enable System Integrity Protection.
SV-105135r1_ruleThe macOS system must implement cryptographic mechanisms to protect the confidentiality and integrity of all information at rest.
SV-105137r1_ruleThe macOS Application Firewall must be enabled.
SV-105139r1_ruleThe macOS system must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.