The operating system must restrict the ability of individuals to use USB storage devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-67689	AOSX-11-000850	SV-82179r1_rule		Medium

Description
External hard drives, such as USB, must be disabled for users. USB hard drives are a potential vector for malware and can be used to exfiltrate sensitive data, if an approved data-loss prevention (DLP) solution is not installed.

STIG	Date
Apple OS X 10.11 Security Technical Implementation Guide	2018-01-04

Details

Check Text ( C-68255r1_chk )
If an approved HBSS DCM/DLP solution is installed, this is not applicable. To ensure external USB drives are disabled, run the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -A 3 harddisk-external If the option "eject,alert" is not set for "harddisk-external", this is a finding.

Fix Text (F-73803r1_fix)
This setting is enforced using the "Restrictions Policy" configuration profile.