Check: AOSX-12-000430
Apple OS X 10.12 STIG:
AOSX-12-000430
(in versions v1 r6 through v1 r1)
Title
The OS X system must have the security assessment policy subsystem enabled. (Cat I impact)
Discussion
Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. Accordingly, software defined by the organization as critical must be signed with a certificate that is recognized and approved by the organization.
Check Content
To check the status of the Security assessment policy subsystem, run the following command: /usr/bin/sudo /usr/sbin/spctl --status | /usr/bin/grep enabled If nothing is returned, this is a finding.
Fix Text
To enable the Security assessment policy subsystem, run the following command: /usr/bin/sudo /usr/sbin/spctl --master-enable
Additional Identifiers
Rule ID: SV-90723r1_rule
Vulnerability ID: V-76035
Group Title: SRG-OS-000366-GPOS-00153
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
Controls
Number | Title |
---|---|
CM-5 (3) |
Signed Components |