+SYS.2.4 macOS Clients
---+SYS.2.4.G1. Uncontrolled Access to Outsourced Data
---+SYS.2.4.G2. Misuse of Apple IDs as Central Access Information for Apple Services
---+SYS.2.4.G3. Attacks on Wireless Interfaces
---+SYS.2.4.G4. Attacks on Applications with a Preview Function
---+SYS.2.4.G5. Insecure Protocols in macOS or macOS Applications
---+SYS.2.4.A1 Planning the Secure Use of macOS (B)
---+SYS.2.4.A2 Using the Security Functions Integrated into macOS (B)
---+SYS.2.4.A3 Use of Suitable User Accounts [User] (B)
---+SYS.2.4.A4 Use of Hard Drive Encryption (S)
---+SYS.2.4.A5 Disabling Security-Critical Functions in macOS (S)
---+SYS.2.4.A6 Using Up-To-Date Mac Hardware (S)
---+SYS.2.4.A7 Two-Factor Authentication for Apple IDs [User] (S)
---+SYS.2.4.A8 No iCloud Use for Confidential Data [User] (S)
---+SYS.2.4.A9 Using Additional Protection Programs in macOS (S)
---+SYS.2.4.A10 Activating the Personal Firewall in macOS (S)
---+SYS.2.4.A11 Disposing of Macs (S)
---+SYS.2.4.A12 Firmware Password and Boot Protection on Macs [User] (H)

SYS.2.4 macOS Clients

Introduction

macOS is a client operating system from Apple. It is based on Darwin, the free Unix operating system from Apple, which in turn is based on the open-source operating system FreeBSD. macOS consists mainly of Darwin and the proprietary graphical user interface Aqua, as well as other applications and services. According to Apple's licensing conditions, macOS may only be installed on Apple IT systems ("Macs"). For this reason, features of these systems are also part of this module.

Objective

The objective of this module is to protect information which is processed on or transmitted by IT systems running macOS. To achieve this, macOS IT systems must appropriately secured.

Scoping and Modelling

Module SYS.2.4 macOS Clients must be applied to all client systems on which the Apple macOS operating system is used.

This module focuses on protecting a Mac running macOS that is operated as a stand-alone system or a client in a client/server network. It therefore supplements the general aspects of module SYS.2.1 General Client, which also applies here. The possible use of macOS as a server operating system is not considered in this module. For professional settings, the Profile Manager tool and mobile device management service offer the option to manage Macs remotely. These solutions offer extended configuration and administration functions which are not covered in this module. The relevant security aspects are covered in module SYS.3.2.2 Mobile Device Management (MDM). It should also be noted that the Apple operating systems macOS (for Macs), iOS (for iPhones), and iPadOS (for iPads) are closely interlinked. Module SYS.3.2.3 iOS (for Enterprise) should also be considered if iOS or iPadOS devices are used in addition to macOS.

Useful resources

The National Institute of Standards and Technology (NIST) has published the document "SP 800-179 Rev. 1 (DRAFT): Guide to Securing Apple macOS 10.12 Systems for IT Professionals: A NIST Security Configuration Checklist" (October 2018).

1. Επισκόπηση

Τίτλος	Πρότυπο
SYS.2.4.A1 Planning the Secure Use of macOS (B)	The introduction of macOS MUST be planned carefully. A decision MUST be taken as to where and how data will be stored. Organisations MUST make plans regarding how backups can be integrated into their overarching backup concepts. The systematic installation of updates related to security and other aspects of macOS and applications MUST be planned. When switching to macOS, the applications required MUST be determined. If a Mac is operated on a data network, the network protocols to be used MUST also be taken into account.
SYS.2.4.A2 Using the Security Functions Integrated into macOS (B)	The integrated macOS protection mechanisms System Integrity Protection (SIP), Xprotect, and Gatekeeper MUST be activated. Unless unsigned programs are absolutely necessary, Gatekeeper MUST ONLY allow signed programs to run.
SYS.2.4.A3 Use of Suitable User Accounts [User] (B)	The administrator account created during the initial configuration of macOS MUST ONLY be used for administrative purposes. A standard user account MUST be created for normal Mac use. If a Mac is used by several users, a separate user account MUST be created for every user. The guest user account MUST be disabled.
SYS.2.4.A4 Use of Hard Drive Encryption (S)	Hard drives SHOULD be encrypted, particularly for portable Macs (e.g. MacBooks). If the FileVault function integrated into macOS is used for this, the key material MUST NOT be stored online at Apple. The recovery keys produced by FileVault MUST be stored in a secure place. Whether an organisational recovery key should be used for FileVault SHOULD be checked.
SYS.2.4.A5 Disabling Security-Critical Functions in macOS (S)	The location services integrated into macOS SHOULD be disabled. Downloaded data SHOULD NOT be opened automatically. Content from optical and other media SHOULD NOT run automatically.
SYS.2.4.A6 Using Up-To-Date Mac Hardware (S)	If new Macs are to be purchased, current models SHOULD be selected. Macs already in use SHOULD be regularly checked to determine whether the installed operating systems still receive security updates from Apple. If Macs are no longer supported by Apple, they SHOULD NOT be used.
SYS.2.4.A7 Two-Factor Authentication for Apple IDs [User] (S)	Two-factor authentication SHOULD be activated for Apple ID accounts.
SYS.2.4.A8 No iCloud Use for Confidential Data [User] (S)	The synchronisation of confidential data among multiple devices via iCloud services SHOULD be prevented. Data SHOULD only be synchronised using self-operated services. Sensitive data SHOULD NOT be stored in iCloud. Draft copies (e.g. of e-mails or documents) SHOULD NOT be stored automatically in iCloud.
SYS.2.4.A9 Using Additional Protection Programs in macOS (S)	If required (such as when operating a Mac in a heterogeneous network), virus protection solutions from third parties SHOULD be used in addition to the integrated protection mechanisms of macOS.
SYS.2.4.A10 Activating the Personal Firewall in macOS (S)	The personal firewall integrated into macOS SHOULD be appropriately activated and configured.
SYS.2.4.A11 Disposing of Macs (S)	When disposing of a Mac, the NVRAM (Non-Volatile Random Access Memory) and SMC (System Management Controller) should be reset.
SYS.2.4.A12 Firmware Password and Boot Protection on Macs [User] (H)	On older Macs, the request for a secure firmware password SHOULD be activated in command mode to prevent unauthorised booting from another boot drive. It SHOULD be checked whether a password should be requested for every startup process via full mode. On Macs with a T2 security chip, a firmware password SHOULD be set via the Startup Security Utility. The option "Secure startup: Full security" SHOULD be activated. The option "Do not allow startup from external media" SHOULD be activated.

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις
Πηγή	Απαίτηση

3. Σχετικοί κανονισμοί

Κανονισμοί
Πηγή	Κανονισμός

Συνδεδεμένα ζητήματα

Συνδέσεις
Τύπος σύνδεσης	Ζήτημα
includes	SYS.2.4.G1. Uncontrolled Access to Outsourced Data
includes	SYS.2.4.G2. Misuse of Apple IDs as Central Access Information for Apple Services
includes	SYS.2.4.G3. Attacks on Wireless Interfaces
includes	SYS.2.4.G4. Attacks on Applications with a Preview Function
includes	SYS.2.4.G5. Insecure Protocols in macOS or macOS Applications

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)