An error occurred:

Check: APPL-14-003030

Apple macOS 14 (Sonoma) STIG: APPL-14-003030 (in versions v2 r2 through v1 r1)

Title

The macOS system must allow smart card authentication. (Cat II impact)

Discussion

Smart card authentication must be allowed. The use of smart card credentials facilitates standardization and reduces the risk of unauthorized access. When enabled, the smart card can be used for logon, authorization, and screen saver unlocking. Satisfies: SRG-OS-000068-GPOS-00036,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000376-GPOS-00161

Check Content

Verify the macOS system is configured to allow smart card authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('allowSmartCard').js EOS If the result is not "true", this is a finding.

Fix Text

Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile. Note: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.

Additional Identifiers

Rule ID: SV-259546r1009599_rule

Vulnerability ID: V-259546

Group Title: SRG-OS-000068-GPOS-00036

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.
Number Definition
CCI-000187

For public key-based authentication, map the authenticated identity to the account of the individual or group.
CCI-000765

Implement multifactor authentication for access to privileged accounts.
CCI-000766

Implement multifactor authentication for access to non-privileged accounts.
CCI-000767

The information system implements multifactor authentication for local access to privileged accounts.
CCI-000768

The information system implements multifactor authentication for local access to non-privileged accounts.
CCI-001941

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
CCI-001953

Accept Personal Identity Verification-compliant credentials.

Controls

Controls tied to check. These are derived from the CCIs shown above.
Number Title
IA-2(1)

Network Access to Privileged Accounts
IA-2(2)

Network Access to Non-privileged Accounts
IA-2(3)

Local Access to Privileged Accounts
IA-2(4)

Local Access to Non-privileged Accounts
IA-2(8)

Network Access to Privileged Accounts - Replay Resistant
IA-2(12)

Acceptance of PIV Credentials
IA-5(2)

Pki-based Authentication