Title

Finder must be set to always empty Trash securely. (Cat III impact)

Discussion

Finder must be configured to always empty Trash securely in order to prevent data recovery tools from accessing the deleted files. Files emptied from the Trash by normal means are still present on the hard drive and can be recovered up until the moment the system overwrites that particular location on disk. A malicious user with physical access to a system could take advantage of this property to access potentially sensitive files that the normal system owner or user assumed was safely deleted. Configuring Finder to always empty trash securely mitigates this risk.

Check Content

To check that the finder will only present the option to securely empty trash run the following command as the primary user: system_profiler SPConfigurationProfileDataType | grep EmptyTrashSecurely If 'EmptyTrashSecurely' is not set to '1' or there is no result, this is a finding.

Fix Text

This setting is enforced using the "Custom Policy" configuration profile.

Additional Identifiers

Rule ID: SV-74153r2_rule

Vulnerability ID: V-59723

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.