Navigate

Check: APPL-11-001003

Apple macOS 11 (Big Sur) STIG: APPL-11-001003 (in versions v1 r8 through v1 r1)

Title

The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system. (Cat II impact)

Discussion

Without establishing what type of events occurred, when they occurred, and by whom it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the operating system audit logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured operating system. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00020, SRG-OS-000042-GPOS-00021, SRG-OS-000055-GPOS-00026, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000303-GPOS-00120, SRG-OS-000337-GPOS-00129, SRG-OS-000358-GPOS-00145, SRG-OS-000359-GPOS-00146

Check Content

To check if the audit service is running, use the following command: launchctl print-disabled system| grep auditd If the return is not: "com.apple.auditd" => false" the audit service is disabled, and this is a finding.

Fix Text

To enable the audit service, run the following command: /usr/bin/sudo /bin/launchctl enable system/com.apple.auditd The system may need to be restarted for the update to take effect.

Additional Identifiers

Rule ID: SV-230772r855681_rule

Vulnerability ID: V-230772

Group Title: SRG-OS-000037-GPOS-00015

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-000130	Ensure that audit records contain information that establishes what type of event occurred.
CCI-000131	Ensure that audit records containing information that establishes when the event occurred.
CCI-000132	Ensure that audit records containing information that establishes where the event occurred.
CCI-000133	Ensure that audit records containing information that establishes the source of the event.
CCI-000134	Ensure that audit records containing information that establishes the outcome of the event.
CCI-000135	Generate audit records containing the organization-defined additional information that is to be included in the audit records.
CCI-000159	Use internal system clocks to generate time stamps for audit records.
CCI-001464	Initiates session audits automatically at system start-up.
CCI-001487	Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
CCI-001889	Record time stamps for audit records that meet organization-defined granularity of time measurement.
CCI-001890	Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
CCI-001914	Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds.
CCI-002130	Automatically audit account enabling actions.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-2(4)	Automated Audit Actions
AU-3	Content of Audit Records
AU-3(1)	Additional Audit Information
AU-8	Time Stamps
AU-12(3)	Changes by Authorized Individuals
AU-14(1)	System Start-up