The macOS system must restrict the ability of individuals to use USB storage devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257243	APPL-13-005051	SV-257243r905362_rule		Medium

Description
External writeable media devices must be disabled for users. External USB devices are a potential vector for malware and can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed.

STIG	Date
Apple macOS 13 (Ventura) Security Technical Implementation Guide	2023-04-12

Details

Check Text ( C-60928r905360_chk )
Verify the macOS system is configured to disable USB storage devices with the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType \| /usr/bin/grep -A 32 "mount-controls" bd = ( "read-only" ); blankbd = ( deny, eject ); blankcd = ( deny, eject ); blankdvd = ( deny, eject ); cd = ( "read-only" ); "disk-image" = ( "read-only" ); dvd = ( "read-only" ); dvdram = ( deny, eject ); "harddisk-external" = ( deny, eject ); If the result does not match the output above and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Check Text ( C-60928r905360_chk )

Verify the macOS system is configured to disable USB storage devices with the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -A 32 "mount-controls"

bd = (
"read-only"
);
blankbd = (
deny,
eject
);
blankcd = (
deny,
eject
);
blankdvd = (
deny,
eject
);
cd = (
"read-only"
);
"disk-image" = (
"read-only"
);
dvd = (
"read-only"
);
dvdram = (
deny,
eject
);
"harddisk-external" = (
deny,
eject
);

If the result does not match the output above and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Fix Text (F-60869r905361_fix)
Configure the macOS system to disable USB storage devices by installing the "Restrictions Policy" configuration profile.