mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 16:39:01 +00:00
MAC CIS 13 2.5.1 (#10168)
This commit is contained in:
Sharon Katz
GitHub
parent
2844ed3157
commit
58b8d65b6f
3 changed files with 364 additions and 0 deletions
|
|
@ -802,6 +802,296 @@ spec:
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri is enabled (Based on organization's policy) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case.
|
||||
In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements.
|
||||
Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times, and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The `PayloadType` string is com.apple.applicationaccess.
|
||||
2. The key to include is allowAssistant.
|
||||
3. The key must be set to <true/>.
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowAssistant'
|
||||
AND (value = '1' OR value = 'true');
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-enabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri is disabled (Based on organization's policy) (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case.
|
||||
In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements.
|
||||
Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times, and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the Bluetooth status in the menu bar.
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The `PayloadType` string is com.apple.applicationaccess.
|
||||
2. The key to include is allowAssistant.
|
||||
3. The key must be set to <false/>.
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.applicationaccess'
|
||||
AND
|
||||
name='allowAssistant'
|
||||
AND (value = '0' OR value = 'false');
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-disabled, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field TypeToSiriEnabled is true (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri TypeToSiriEnabled field is true.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool true
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'TypeToSiriEnabled' AND
|
||||
value = '1') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-TypeToSiriEnabled-true, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field TypeToSiriEnabled is false (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri TypeToSiriEnabled field is false.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool false
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'TypeToSiriEnabled' AND
|
||||
value = '0') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-TypeToSiriEnabled-false, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field StatusMenuVisible is true (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri StatusMenuVisible field is true.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool true
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'StatusMenuVisible' AND
|
||||
value = '1') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-StatusMenuVisible-true, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field StatusMenuVisible is false (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri StatusMenuVisible field is false.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool false
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'StatusMenuVisible' AND
|
||||
value = '0') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-StatusMenuVisible-false, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field VoiceTriggerUserEnabled is true (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri VoiceTriggerUserEnabled field is true.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool true
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'VoiceTriggerUserEnabled' AND
|
||||
value = '1') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-VoiceTriggerUserEnabled-true, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field VoiceTriggerUserEnabled is false (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri VoiceTriggerUserEnabled field is false.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool false
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'VoiceTriggerUserEnabled' AND
|
||||
value = '0') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-VoiceTriggerUserEnabled-false, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field LockscreenEnabled is true (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri LockscreenEnabled field is true.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool true
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'LockscreenEnabled' AND
|
||||
value = '1') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-LockscreenEnabled-true, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Siri field LockscreenEnabled is false (Based on organization's policy)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Extention of CIS-2.5.1. This will check that Siri LockscreenEnabled field is false.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure
|
||||
$ /usr/bin/sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool false
|
||||
query: |
|
||||
SELECT 1 WHERE NOT EXISTS (
|
||||
SELECT 1 FROM users AS u
|
||||
LEFT JOIN (
|
||||
SELECT * FROM plist WHERE
|
||||
path LIKE '/Users/%/Library/Preferences/com.apple.Siri.plist' AND
|
||||
key = 'LockscreenEnabled' AND
|
||||
value = '0') AS p
|
||||
ON p.path = CONCAT(u.directory, '/Library/Preferences/com.apple.Siri.plist')
|
||||
WHERE u.directory LIKE '/Users/%' AND
|
||||
p.value IS NULL
|
||||
);
|
||||
/*CIS does not make a hard recommendation for this policy. Fleet has provided two policies (one failing, one succeeding).
|
||||
Depending on your organization's decision, you can delete this policy or its counterpart.*/
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-2.5.1-LockscreenEnabled-false, decision-needed
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Location Services Is Enabled
|
||||
platforms: macOS
|
||||
|
|
|
|||
37
ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.5.1-disable.mobileconfig
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.applicationaccess</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.5.1.check-disable</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>4B56DF79-ECAF-4175-AACC-95F08A980B6C</string>
|
||||
<key>allowAssistant</key>
|
||||
<false/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Disable Siri</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.5.1-disable</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>FB3E1980-5FE2-4C8F-BCF8-6FFF4117C962</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
37
ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig
Normal file
37
ee/cis/macos-13/test/profiles/2.5.1-enable.mobileconfig
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>test</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.applicationaccess</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.5.1.check-enable</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>DC0652C5-E996-408F-84A0-9F09657FD771</string>
|
||||
<key>allowAssistant</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>test</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Enable Siri</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.fleetdm.cis-2.5.1-enable</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>F5001E34-CC4D-4951-A7A3-A95DC02F0090</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
Loading…
Reference in a new issue