An error occurred:

Check: APPL-14-003020

Apple macOS 14 (Sonoma) STIG: APPL-14-003020 (in versions v2 r2 through v1 r1)

Title

The macOS system must enforce smart card authentication. (Cat II impact)

Discussion

Smart card authentication must be enforced. The use of smart card credentials facilitates standardization and reduces the risk of unauthorized access. When enforceSmartCard is set to "true", the smart card must be used for logon, authorization, and unlocking the screen saver. CAUTION: enforceSmartCard will apply to the whole system. No users will be able to log on with their password unless the profile is removed or a user is exempt from smart card enforcement. Note: enforceSmartcard requires allowSmartcard to be set to true in order to work. Satisfies: SRG-OS-000067-GPOS-00035,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000375-GPOS-00160,SRG-OS-000376-GPOS-00161

Check Content

Verify the macOS system is configured to enforce multifactor authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('enforceSmartCard').js EOS If the result is not "true", this is a finding.

Fix Text

Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile. Note: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.

Additional Identifiers

Rule ID: SV-259545r1009598_rule

Vulnerability ID: V-259545

Group Title: SRG-OS-000067-GPOS-00035

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.
Number Definition
CCI-000186

For public key-based authentication, enforce authorized access to the corresponding private key.
CCI-000765

Implement multifactor authentication for access to privileged accounts.
CCI-000766

Implement multifactor authentication for access to non-privileged accounts.
CCI-000767

The information system implements multifactor authentication for local access to privileged accounts.
CCI-000768

The information system implements multifactor authentication for local access to non-privileged accounts.
CCI-001941

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
CCI-001948

The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001953

Accept Personal Identity Verification-compliant credentials.
CCI-004046

Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Controls

Controls tied to check. These are derived from the CCIs shown above.
Number Title
IA-2(1)

Network Access to Privileged Accounts
IA-2(2)

Network Access to Non-privileged Accounts
IA-2(3)

Local Access to Privileged Accounts
IA-2(4)

Local Access to Non-privileged Accounts
IA-2(8)

Network Access to Privileged Accounts - Replay Resistant
IA-2(11)

Remote Access - Separate Device
IA-2(12)

Acceptance of PIV Credentials
IA-5(2)

Pki-based Authentication