Details
Managing automatic actions, while useful in very few situations, is unlikely to increase security on the computer and does complicate the user experience and add additional complexity to the configuration. These settings are user controlled and can be changed without Administrator privileges unless controlled through MCX settings or Parental Controls. Unlike Windows, the Auto-run the optical media is accessed through Operating System applications. Those same applications can open and access the media directly. If optical media is not allowed in the environment the optical media drive should be disabled in hardware and software.
Rationale:
Setting automatic actions for optical media can mitigate malicious code from running automatically when optical media is inserted.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Perform the following to set the optical media action setting:
Graphical Method:
Open System Preferences
Select CDs & DVDs
Set each option to meet your organization’s requirements
Terminal Method:
Run the following command to set the optical media action:
$ sudo -u example: $ sudo -u seconduser defaults write /Users/seconduser/Library/Preferences/com.apple.digihub com.apple.digihub.blank.dvd.appeared -dict action 1 The five media types are com.apple.digihub.blank.cd.appeared(blank cd), com.apple.digihub.blank.dvd.appeared (blank dvd), com.apple.digihub.cd.music.appeared (music cd), com.apple.digihub.cd.picture.appeared (picture cd), and com.apple.digihub.dvd.video.appeared (DVD movie). The following resource is also helpful. This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.Supportive Information
References
Source