Check: APPL-14-003030
Apple macOS 14 (Sonoma) STIG:
APPL-14-003030
(in versions v1 r2 through v1 r1)
Title
The macOS system must allow smart card authentication. (Cat II impact)
Discussion
Smart card authentication must be allowed. The use of smart card credentials facilitates standardization and reduces the risk of unauthorized access. When enabled, the smart card can be used for logon, authorization, and screen saver unlocking. Satisfies: SRG-OS-000068-GPOS-00036,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000376-GPOS-00161
Check Content
Verify the macOS system is configured to allow smart card authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('allowSmartCard').js EOS If the result is not "true", this is a finding.
Fix Text
Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile. Note: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
Additional Identifiers
Rule ID: SV-259546r941260_rule
Vulnerability ID: V-259546
Group Title: SRG-OS-000068-GPOS-00036
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000187 |
The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group. |
| CCI-000765 |
The information system implements multifactor authentication for network access to privileged accounts. |
| CCI-000766 |
The information system implements multifactor authentication for network access to non-privileged accounts. |
| CCI-000767 |
The information system implements multifactor authentication for local access to privileged accounts. |
| CCI-000768 |
The information system implements multifactor authentication for local access to non-privileged accounts. |
| CCI-001941 |
The information system implements replay-resistant authentication mechanisms for network access to privileged accounts. |
| CCI-001953 |
The information system accepts Personal Identity Verification (PIV) credentials. |
Controls
| Number | Title |
|---|---|
| IA-2 (1) |
Network Access To Privileged Accounts |
| IA-2 (2) |
Network Access To Non-Privileged Accounts |
| IA-2 (3) |
Local Access To Privileged Accounts |
| IA-2 (4) |
Local Access To Non-Privileged Accounts |
| IA-2 (8) |
Network Access To Privileged Accounts - Replay Resistant |
| IA-2 (12) |
Acceptance Of Piv Credentials |
| IA-5 (2) |
Pki-Based Authentication |