Home
Security Hardening
DISA STIG Apple Mac OSX 10 15 V1R7

DISA STIG Apple Mac OSX 10 15 V1R7

AOSX-15-000011 – The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications – SSHD currently running
Details Without confidentiality and integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session....
AOSX-15-000011 – The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications – SSHD service disabled
Details Without confidentiality and integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session....
AOSX-15-000012 – The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.
Details If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be...
AOSX-15-000052 – The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.
Details SSH should be configured with an Active Client Alive Maximum Count of 0. Terminating an idle session within a...
AOSX-15-000053 – The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.
Details SSH should be configured to log users out after a 15-minute interval of inactivity and to wait only 30...
AOSX-15-000054 – The macOS system must implement approved Ciphers to protect the confidentiality of SSH connections..
Details Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide...
AOSX-15-000055 – The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
Details Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide...
AOSX-15-000056 – The macOS system must implement an approved Key Exchange Algorithm.
Details Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide...
AOSX-15-001001 – The macOS system must generate audit records for all account creations, modifications, disabling, and termination events; privileged activities or other system-level access; all kernel module load, unload, and restart actions; all program initiations; and organizationally defined events for all non-local maintenance and diagnostic sessions.
Details Without generating audit records that are specific to the security and mission needs of the organization, it would be...
AOSX-15-001002 – The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.
Details Frequently, an attacker that successfully gains access to a system has only gained access to an account with limited...

Prev Next

DISA STIG Apple Mac OSX 10 15 V1R7

AOSX-15-000012 – The macOS system must automatically remove or disable temporary and emergency user accounts after 72 hours.

AOSX-15-000052 – The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.

AOSX-15-000053 – The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less.

AOSX-15-000054 – The macOS system must implement approved Ciphers to protect the confidentiality of SSH connections..

AOSX-15-000055 – The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.

AOSX-15-000056 – The macOS system must implement an approved Key Exchange Algorithm.

AOSX-15-001002 – The macOS system must monitor remote access methods and generate audit records when successful/unsuccessful attempts to access/modify privileges occur.