The macOS system must restrict the ability of individuals to use USB storage devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252537	APPL-12-005051	SV-252537r853305_rule		Medium

Description
External writeable media devices must be disabled for users. External USB devices are a potential vector for malware and can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed. Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000319-GPOS-00164

STIG	Date
Apple macOS 12 (Monterey) Security Technical Implementation Guide	2022-09-07

Details

Check Text ( C-55993r816423_chk )
Verify the system is configured to disable USB storage devices: $ /usr/sbin/system_profiler SPConfigurationProfileDataType \| /usr/bin/egrep -A 3 'blankbd\|blankcd\|blankdvd\|disk-image\|dvdram\|harddisk-external' “blankbd" = ( deny, eject ); “blankcd" = ( deny, eject ); “blankdvd" = ( deny, eject ); “disk-image" = ( deny, eject ); “dvdram" = ( deny, eject ); “harddisk-external" = ( deny, eject ); If the result does not match the output above, this is a finding.

Check Text ( C-55993r816423_chk )

Verify the system is configured to disable USB storage devices:

$ /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/egrep -A 3 'blankbd|blankcd|blankdvd|disk-image|dvdram|harddisk-external'

“blankbd" = (
deny,
eject
);

“blankcd" = (
deny,
eject
);

“blankdvd" = (
deny,
eject
);

“disk-image" = (
deny,
eject
);

“dvdram" = (
deny,
eject
);

“harddisk-external" = (
deny,
eject
);

If the result does not match the output above, this is a finding.

Fix Text (F-55943r816424_fix)
This setting is enforced using the "Restrictions Policy" configuration profile.