Details

If the system does not require Apple Filing Protocol (AFP) Sharing, support it is non-essential and _MUST_ be disabled.

The information system _MUST_ be configured to provide only essential capabilities. Disabling AFP helps prevent the unauthorized connection of devices and the unauthorized transfer of information.

Solution

Run the following bash code

/bin/launchctl disable system/com.apple.AppleFileServer
----
The system may need to be restarted for the update to take effect.

Supportive Information

The following resource is also helpful.

• https://github.com/usnistgov/macos_security

This security hardening control applies to the following category of controls within NIST 800-53: Access Control, Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|AC-3
• 800-53|AC-17
• 800-53|CM-7a.
• CCE|CCE-84823-4, CCI|CCI-000381
• STIG-ID|AOSX-15-002002

Source

• Tenable.com/audits