id: system_settings_firewall_stealth_mode_enable
title: Enable Firewall Stealth Mode
discussion: |
  Firewall Stealth Mode _MUST_ be enabled.

  When stealth mode is enabled, the Mac will not respond to any probing requests, and only requests from authorized applications will still be authorized.

  [IMPORTANT]
  ====
  Enabling firewall stealth mode may prevent certain remote mechanisms used for maintenance and compliance scanning from properly functioning. Information System Security Officers (ISSOs) are advised to first fully weigh the potential risks posed to their organization before opting not to enable stealth mode.
  ====
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\
  .objectForKey('EnableStealthMode').js
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-95370-3
  cci:
    - N/A
  800-53r5:
    - CM-7
    - CM-7(1)
    - SC-7(16)
    - SC-7
  800-53r4:
    - SC-7
    - CM-7
    - CM-7(1)
    - SC-7(16)
  srg:
    - N/A
  disa_stig:
    - N/A
  800-171r3:
    - 03.04.06
    - 03.13.01
  cis:
    benchmark:
      - 2.2.2 (level 1)
    controls v8:
      - 4.1
      - 4.5
      - 4.8
  cmmc:
    - CM.L2-3.4.6
    - CM.L2-3.4.7
    - SC.L1-3.13.1
  bio:
    - 8.27.01
macOS:
  - '26.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - nlmapgov_plus
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.security.firewall:
    EnableStealthMode: true
    EnableFirewall: true
