Check: AOSX-10-000430
Apple OS X 10-10 Workstation STIG:
AOSX-10-000430
(in versions v1 r5 through v1 r4)
Title
The Security assessment policy subsystem must be enabled. (Cat I impact)
Discussion
Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. Accordingly, software defined by the organization as critical software must be signed with a certificate that is recognized and approved by the organization.
Check Content
To check the status of the Security assessment policy subsystem, run the following command: sudo spctl --status | grep enabled If nothing is returned, this is a finding.
Fix Text
To enable the Security assessment policy subsystem, run the following command: sudo spctl --master-enable
Additional Identifiers
Rule ID: SV-74051r1_rule
Vulnerability ID: V-59621
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
Controls
Number | Title |
---|---|
CM-5 (3) |
Signed Components |