Details

Apple introduced Core Storage with 10.7. It is used as the default for formatting on macOS volumes prior to 10.13.

All HFS and Core Storage Volumes should be encrypted.

Rationale:

In order to protect user data from loss or tampering volumes carrying data should be encrypted.

Impact:

While FileVault protects the boot volume data may be copied to other attached storage and reduce the protection afforded by FileVault. Ensure all user volumes are encrypted to protect data.

Solution

Use Disk Utility to erase a disk and format as macOS Extended (Journaled, Encrypted)

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3092

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-7b.

Source

• Tenable.com/audits