usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-03-18 06:32:12 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

fix[rules] os_untrusted_tls_disable

Browse Source 
Added os_untrusted_tls_disable
This commit is contained in:
Allen Golbig
2023-11-13 12:06:26 -05:00
parent 2561cb9c6b
commit 93cdeca1a5
8 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
baselines/all_rules.yaml
View File

@@ -61,6 +61,7 @@ profile:
- os_password_sharing_disable
- os_personalized_advertising_disable
- os_require_managed_pasteboard_enforce
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_safari_password_autofill_disable
- os_screenshots_disable
@@ -71,6 +72,7 @@ profile:
- os_siri_when_locked_disabled
- os_ssl_for_exchange_activesync_enable
- os_supervised_mdm_require
- os_untrusted_tls_disable
- os_usb_accessories_when_locked_disable
- os_voice_dialing_when_locked_disabled
- section: "passwordpolicy"

1
baselines/cis_lvl1_byod.yaml
View File

@@ -24,6 +24,7 @@ profile:
- os_force_encrypted_backups_enable
- os_mail_move_messages_disable
- os_personalized_advertising_disable
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_show_control_center_lock_screen_disable
- os_show_notification_center_lock_screen_disable

1
baselines/cis_lvl1_enterprise.yaml
View File

@@ -33,6 +33,7 @@ profile:
- os_new_device_proximity_disable
- os_password_proximity_disable
- os_personalized_advertising_disable
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_show_control_center_lock_screen_disable
- os_show_notification_center_lock_screen_disable

2
baselines/cis_lvl2_byod.yaml
View File

@@ -26,10 +26,12 @@ profile:
- os_mail_maildrop_disable
- os_mail_move_messages_disable
- os_personalized_advertising_disable
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_show_control_center_lock_screen_disable
- os_show_notification_center_lock_screen_disable
- os_siri_when_locked_disabled
- os_untrusted_tls_disable
- os_voice_dialing_when_locked_disabled
- section: "passwordpolicy"
rules:

2
baselines/cis_lvl2_enterprise.yaml
View File

@@ -39,11 +39,13 @@ profile:
- os_pairing_non_configurator_hosts_disable
- os_password_proximity_disable
- os_personalized_advertising_disable
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_screenshots_disable
- os_show_control_center_lock_screen_disable
- os_show_notification_center_lock_screen_disable
- os_siri_when_locked_disabled
- os_untrusted_tls_disable
- os_usb_accessories_when_locked_disable
- os_voice_dialing_when_locked_disabled
- section: "passwordpolicy"

2
baselines/cisv8.yaml
View File

@@ -45,12 +45,14 @@ profile:
- os_pairing_non_configurator_hosts_disable
- os_password_proximity_disable
- os_personalized_advertising_disable
- os_safari_force_fraud_warning_enable
- os_safari_cookies_set
- os_safari_password_autofill_disable
- os_screenshots_disable
- os_show_control_center_lock_screen_disable
- os_show_notification_center_lock_screen_disable
- os_siri_when_locked_disabled
- os_untrusted_tls_disable
- os_usb_accessories_when_locked_disable
- os_voice_dialing_when_locked_disabled
- section: "passwordpolicy"

8
includes/mscp-data.yaml
View File

@@ -108,10 +108,10 @@ titles:
800-171: NIST 800-171 Rev 2
cis_lvl1: CIS Apple macOS 13.0 Ventura v1.1.0 Benchmark (Level 1)
cis_lvl2: CIS Apple macOS 13.0 Ventura v1.1.0 Benchmark (Level 2)
cis_lvl1_byod: CIS Apple iOS 17 v1.1.0 Benchmark (Level 1) - End-User Owned Devices
cis_lvl2_byod: CIS Apple iOS 17 v1.1.0 Benchmark (Level 2) - End-User Owned Devices
cis_lvl1_enterprise: CIS Apple iOS 17 v1.1.0 Benchmark (Level 1) - Institutionally-Owned Devices
cis_lvl2_enterprise: CIS Apple iOS 17 v1.1.0 Benchmark (Level 2) - Institutionally-Owned Devices
cis_lvl1_byod: CIS Apple iOS 17 v1.0.0 Benchmark (Level 1) - End-User Owned Devices
cis_lvl2_byod: CIS Apple iOS 17 v1.0.0 Benchmark (Level 2) - End-User Owned Devices
cis_lvl1_enterprise: CIS Apple iOS 17 v1.0.0 Benchmark (Level 1) - Institutionally-Owned Devices
cis_lvl2_enterprise: CIS Apple iOS 17 v1.0.0 Benchmark (Level 2) - Institutionally-Owned Devices
cisv8: CIS Controls Version 8
cmmc_lvl1: US CMMC 2.0 Level 1
cmmc_lvl2: US CMMC 2.0 Level 2

38
rules/os/os_untrusted_tls_disable.yaml Normal file
View File

@@ -0,0 +1,38 @@
id: os_untrusted_tls_disable
title: "Ensure Allow Users to Accept Untrusted TLS Certificates is set to Disabled"
discussion: |
Users _MUST_ not be allowed to accept self-signed or unverified certificates.
check: " "
fix: |
This is implemented by a Configuration Profile.
references:
cce:
- CCE-93465-3
cci:
- N/A
800-53r5:
- N/A
disa_stig:
- N/A
sfr:
- N/A
800-171r2:
- N/A
cis:
benchmark:
- 2.2.1.6 (level 2 - End-User Owned Devices)
- 3.2.1.13 (level 2 - Institutionally-Owned Devices)
controls v8:
- 4.1
iOS:
- "17.0"
tags:
- ios
- cis_lvl2_byod
- cis_lvl2_enterprise
- cisv8
supervised: false
mobileconfig: true
mobileconfig_info:
com.apple.applicationaccess:
allowUntrustedTLSPrompt: false