1 DRAFT NIST Special Publication 800-179 2 Revision 1 3 Guide to Securing macOS 10.12 4 Systems for IT Professionals 5 A NIST Security Configuration Checklist 6 7 8 9 Lee Badger 10 Murugiah Souppaya 11 Mark Trapnell 12 Eric Trapnell 13 Dylan Yaga 14 Karen Scarfone 15 16 17 18 C O M P U T E R S E C U R I T Y 19 20 21 DRAFT NIST Special Publication 800-179 22 Revision 1 23 24 Guide to Securing macOS 10.12 25 Systems for IT Professionals 26 A NIST Security Configuration Checklist 27 28 Lee Badger 29 Murugiah Souppaya 30 Mark Trapnell 31 Eric Trapnell 32 Dylan Yaga 33 Computer Security Division 34 Information Technology Laboratory 35 36 Karen Scarfone 37 Scarfone Cybersecurity 38 Clifton, VA 39 40 41 42 43 44 October 2018 45 46 47 48 49 U.S. Department of Commerce 50 Wilbur L. Ross, Jr., Secretary 51 52 National Institute of Standards and Technology 53 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology NIST SP 800-179 REV. 1 (DRAFT) SECURING MACOS 10.12 SYSTEMS: NIST SECURITY CONFIGURATION CHECKLIST 54 Authority 55 This publication has been developed by NIST in accordance with its statutory responsibilities under the 56 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law 57 (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, 58 including minimum requirements for federal information systems, but such standards and guidelines shall 59 not apply to national security systems without the express approval of appropriate federal officials 60 exercising policy authority over such systems. This guideline is consistent with the requirements of the 61 Office of Management and Budget (OMB) Circular A-130. 62 Nothing in this publication should be taken to contradict the standards and guidelines made mandatory 63 and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should 64 these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of 65 Commerce, Director of the OMB, or any other federal official. This publication may be used by 66 nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. 67 Attribution would, however, be appreciated by NIST. 68 National Institute of Standards and Technology Special Publication 800-179 Revision 1 69 Natl. Inst. Stand. Technol. Spec. Publ. 800-179 Rev. 1, 130 pages (October 2018) 70 CODEN: NSPUE2 71 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 72 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 73 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 74 available for the purpose. 75 There may be references in this publication to other publications currently under development by NIST in 76 accordance with its assigned statutory responsibilities. The information in this publication, including concepts and 77 methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, 78 until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain 79 operative. For planning and transition purposes, federal agencies may wish to closely follow the development of 80 these new publications by NIST. 81 Organizations are encouraged to review all draft publications during public comment periods and provide feedback 82 to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 83 https://csrc.nist.gov/publications. 84 85 Public comment period: October 19, 2018 through November 16, 2018 86 National Institute of Standards and Technology 87 Attn: Computer Security Division, Information Technology Laboratory 88 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 89 Email: [email protected] 90 All comments are subject to release under the Freedom of Information Act (FOIA). 91 i NIST SP 800-179 REV. 1 (DRAFT) SECURING MACOS 10.12 SYSTEMS: NIST SECURITY CONFIGURATION CHECKLIST 92 Reports on Computer Systems Technology 93 The Information Technology Laboratory (ITL) at the National Institute of Standards and 94 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 95 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 96 methods, reference data, proof of concept implementations, and technical analyses to advance 97 the development and productive use of information technology. ITL’s responsibilities include the 98 development of management, administrative, technical, and physical standards and guidelines for 99 the cost-effective security and privacy of other than national security-related information in 100 federal information systems. The Special Publication 800-series reports on ITL’s research, 101 guidelines, and outreach efforts in information system security, and its collaborative activities 102 with industry, government, and academic organizations. 103 104 Abstract 105 This publication assists IT professionals in securing Apple macOS 10.12 desktop and laptop 106 systems within various environments. It provides detailed information about the security features 107 of macOS 10.12 and security configuration guidelines. The publication recommends and 108 explains tested, secure settings with the objective of simplifying the administrative burden of 109 improving the security of macOS 10.12 systems in three types of environments: Standalone, 110 Managed, and Specialized Security-Limited Functionality. 111 112 Keywords 113 Apple OS X; checklist; endpoint device security; hardening guide; host security; macOS; mobile 114 device security; operating system security; secure configuration. ii NIST SP 800-179 REV. 1 (DRAFT) SECURING MACOS 10.12 SYSTEMS: NIST SECURITY CONFIGURATION CHECKLIST 115 116 Supplemental Content 117 For additional documents that support this publication, see: 118 https://github.com/usnistgov/applesec. 119 120 Trademark Information 121 All registered trademarks or trademarks belong to their respective organizations. iii NIST SP 800-179 REV. 1 (DRAFT) SECURING MACOS 10.12 SYSTEMS: NIST SECURITY CONFIGURATION CHECKLIST 122 Table of Contents 123 Executive Summary ..................................................................................................... ix 124 Changes in SP 800-179 Revision 1 ............................................................................ xii 125 1. Introduction ............................................................................................................ 1 126 1.1 Purpose and Scope ........................................................................................ 1 127 1.2 Audience ......................................................................................................... 1 128 1.3 Document Structure ........................................................................................ 1 129 2. macOS Security Guide Development ................................................................... 3 130 2.1 macOS System Roles and Requirements ....................................................... 3 131 2.2 Security Categorization of Information and Information Systems ................... 4 132 2.3 Threats to macOS Technologies..................................................................... 6 133 2.3.1 Local Threats ........................................................................................ 6 134 2.3.2 Remote Threats .................................................................................... 9 135 2.4 macOS Environments ................................................................................... 12 136 2.4.1 Standalone ......................................................................................... 13 137 2.4.2 Managed ............................................................................................ 13 138 2.4.3 Specialized Security-Limited Functionality (SSLF) ............................. 14 139 2.5 Security Controls Documentation.................................................................. 15 140 2.6 Implementation and Testing of Security Controls ......................................... 16 141 2.7 Monitoring and Maintenance ......................................................................... 16 142 2.8 Summary of Recommendations .................................................................... 17 143 3. macOS Security Components Overview ............................................................ 19 144 3.1 System Integrity Protection ........................................................................... 19 145 3.2 Gatekeeper ................................................................................................... 19 146 3.3 Software Updates ......................................................................................... 19 147 3.4 Privacy Settings ............................................................................................ 19 148 3.5 Credential Management ................................................................................ 20 149 3.6 Host-Based Firewalls .................................................................................... 20 150 3.7 Storage Encryption ....................................................................................... 21 151