WIXLIB

Account Configuration Action ItemsAction ItemASCPageDeployable ObjectDeployment MechanismCreate an administrator accountand a standard account for eachadministrator124JSS Setting, QuickAdd,ScriptCasper Imaging, Casper RemoteCreate a standard or managedaccount for each nonadministrator124QuickAdd, ScriptCasper Imaging, Casper Remote,PolicySet parental controls for managedaccounts121Script, DMG, ManagedPreferenceCasper Imaging, Casper Remote,PolicyRestrict sudo users to access requiredcommands126Script, DMGCasper Imaging, Casper Remote,PolicySecurely configure LDAPv3 access129Script, DMGCasper Imaging, Casper Remote,PolicySecurely configure Active Directoryaccess129Script, DMGCasper Imaging, Casper Remote,PolicyUse Password Assistant to generatecomplex passwords130SettingCasper Remote, PolicyAuthenticate using a smart card,token, or biometric device132DMGCasper Imaging, Casper Remote,PolicySet a strong password policy134Script, Unix CommandCasper Imaging, Casper Remote,PolicySecure the login keychain135Script, Unix CommandCasper Imaging, Casper Remote,PolicySecure keychain items137Script, Unix CommandCasper Imaging, Casper Remote,PolicyCreate keychains for specializedpurposes136Script, Unix CommandCasper Imaging, Casper Remote,PolicyUse a portable drive to storekeychains139DMGCasper Imaging, Casper Remote,Policy12

Securing Data UsingEncryptionWhen hardening Mac OS X desktop systems during installation,initialization or updating, reference the following:Action Items from ASC Page are managed by a Deployable Objectusing the appropriate Deployment Mechanism.Encryption (DAR) Action ItemsAction ItemASCPageDeployable ObjectDeployment MechanismAssign POSIX access permissionsbased on user categories144Script, Unix Command,Composer SettingCasper Imaging, Casper Remote,PolicyReview and modify folder flags146Script, Unix Command,Composer SettingCasper Imaging, Casper Remote,PolicyRestrict permissions on User HomeFolders152Script, Unix CommandCasper Imaging, Casper Remote,PolicyStrip setuid bits from some programs149Script, Unix Command,Composer SettingCasper Imaging, Casper Remote,Policy13

Information Assurancewith ApplicationsWhen hardening Mac OS X desktop systems during installation,initialization or updating, reference the following:Action Items from ASC Page are managed by a Deployable Objectusing the appropriate Deployment Mechanism.Application Configuration Action ItemsAction ItemASCPageDeployable ObjectDeployment MechanismConfigure Mail using SSL166Script, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyDisable the Preview Pane for MailMessages168ScriptApple recommends moving theseparator bar to minimize thepreview pane. Is this MCX-able?Disable Auto-Fill175DMG, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyBlock Pop-ups176DMG, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyOnly Allow Cookies from Visited Sites177DMG, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyDisable opening safe files in Safari177DMG, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyVerify certificate validity171ScriptCasper Imaging, Casper Remote,PolicyRequest MobileMe identity certificate180ScriptCasper Imaging, Casper Remote,PolicySecure iChat communications178Script, *ManagedPreferenceCasper Imaging, Casper Remote,PolicyCreate a strong password for iTunes181N/AN/ASecure remote access using VPN192DMG, Script,*Managed PreferenceCasper Imaging, Casper Remote,PolicyTurn firewall protection on183Script, Resource Kit,Managed PreferenceCasper Imaging, Casper Remote,Policy14

Information Assurancewith ServicesWhen hardening Mac OS X desktop systems during installation,initialization or updating, reference the following:Action Items from ASC Page are managed by a Deployable Objectusing the appropriate Deployment Mechanism.Services Action ItemsAction ItemASCPageDeployable ObjectDeployment MechanismConfigure IPFW2 firewall187OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicyImplement IPFW ruleset189OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicyEnable firewall logging188,103OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicyImplement inclusive ruleset189OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicySet ruleset to permit services190OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicySet more restrictive ruleset190OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicyConfiguring System to load IPFWruleset192OS Image, Package,ScriptCasper Imaging, Casper Remote,PolicyBonjour194ScriptCasper Imaging, Casper Remote,PolicySecure BTMM access throughSecurity Preferences (Back To MyMac)198Script, UserEnvironment Package,Managed PreferenceCasper Imaging, Casper Remote,PolicySet up screen sharing through VNCwith password protection200Script, DMGCasper Imaging, Casper Remote,PolicyDisable Screen Sharing whenpossible200OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable File Sharing when possible201OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Printer Sharing whenpossible204OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Scanner Sharing whenpossible204OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Web Sharing when possible204OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Remote Login when possible205OS Image, ScriptCasper Imaging, Casper Remote,PolicyEstablish key-based SSH connections207ScriptCasper Imaging, Casper Remote,Policy15

Services Action Items Cont.Action ItemASCPageDeployable ObjectDeployment MechanismConfigure ARD to manage remotetasks215Script, Built In FeatureCasper Imaging, Casper Remote,PolicyDisable Remote Management whenpossible216OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Remote Apple Events whenpossible216OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Xgrid Sharing when possible217OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Internet Sharing whenpossible219OS Image, ScriptCasper Imaging, Casper Remote,PolicyDisable Bluetooth Sharing whenpossible220OS Image, ScriptCasper Imaging, Casper Remote,Policy16

Advanced SecurityManagementWhen hardening Mac OS X desktop systems during installation,initialization or updating, reference the following:Action Items from ASC Page are managed by a Deployable Objectusing the appropriate Deployment Mechanism.Advance Management Action ItemsAction ItemASCPageDeployable ObjectDeployment MechanismCreate an authorization right to thedictionary to authorize users225Script, ManagedPreferenceCasper Imaging, Casper Remote,PolicyCreate a digital signature232ScriptCasper Imaging, Casper Remote,PolicyEnable security auditing237ScriptCasper Imaging, Casper Remote,PolicyConfigure security auditing222,238ScriptCasper Imaging, Casper Remote,PolicyGenerate auditing reports222,237ScriptCasper Imaging, Casper Remote,PolicyEnable local logging235Script, ManagedPreferenceCasper Imaging, Casper Remote,PolicyEnable remote logging220,236Script, ManagedPreferenceCasper Imaging, Casper Remote,PolicyInstall a file integrity checking tool216,232DMGCasper Imaging, Casper Remote,PolicyCreate a baseline configuration forfile integrity checking216,231OS ImageN/AInstall an antivirus tool222,239DMGCasper Imaging, Casper Remote,PolicyConfigure the antivirus tool toautomatically download virusdefinition files222,239DMG, ManagedPreferenceCasper Imaging, Casper Remote,Policy*Available as a template in the JSS17

Appendix A - MeetingSarbanes-Oxley ObjectivesThere are seven Control Objectives that relate to desktop managementunder Sarbanes-Oxley requirements that are met through the CasperSuite.They are: Grant the appropriate level of access in order to provideadministrators functionality appropriate to their role. Log the actions of each individual administrator. Ensure that no illegal or unauthorized software can be run oncorporate assets by excluding applications from execution. Allow remote administrators to observe or control a computer in away that is secure and audited. Rapidly change access credentials for remote computers Ensure that desktop screen savers activate after a set amount oftime and require a password to unlock. Ensure that data transmission is encrypted.18

Appendix A - MeetingSarbanes-Oxley ObjectivesWhile most system administrators governed by Sarbanes-Oxley arefluent in the terminology of the framework, a brief explanation ofcontrols is provided below.Automated Controls are performed by computers and are binaryin nature; they always function as designed and are not subject tointermittent error or human intervention.Access Controls define the appropriate access for different users andgrant them rights and privileges to sensitive information.Control Objectives define the desired state and are used to measurethe success or failure of a policy or procedure.Corrective Controls are aimed at restoring the system to its expectedstate.Detective Controls detect when an unwanted event occurs as aresult of human factors as well as en vironmental and security issues;we need detective controls to alert us when an unwanted eventtranspires.Preventative Controls are aimed at avoiding unwanted situations.19

Role Based AdministratorAccessControl Objectives Grant the appropriate level of access in order to provideadministrators functionality appropriate to their role. Log the actions of each individual administrator.Within the Casper Suite, individuals can be added to the system toperform the tasks for which they are responsible (see fig. 1).fig. 120

Role Based AdministratorAccessGrant All PrivilegesRevoke All PrivilegesJSS - Home Tab PrivilegesJSS - Settings Tab Inventory PrivilegesManage Inventory PreferencesManage Peripheral TypesThese users can be added viaLDAP and assigned appropriateprivileges (see fig. 2).Change PasswordJSS - Inventory Tab PrivilegesView Inventory TabPerform Advanced SearchesSave Advanced SearchesView Saved SearchesManage Removable MAC AddressManage Custom ReportsManage Saved SearchesManage Licensed SoftwareManage Supressed Inventory ItemsRecon PrivilegesAdd Computers ManuallyAdd HardwareView Details on Inventory ItemsAdd Computers RemotelyView License Serial NumbersQuickAdd PackagesDownload Files Attached to Inventory ItemsView Computer LogsCasper Admin PrivilegesEdit Inventory ItemsUse Casper AdminEdit Autorun DataSave with Casper AdminDelete Inventory ItemsJSS - Management Tab PrivilegesCasper Imaging PrivilegesUse Casper ImagingView Management TabCustomize a ConfigurationManage PoliciesStore Autorun DataManage PreStagesCreate Local AccountsManage Restricted SoftwareBind to Active Directory LocallyManage Smart Computer GroupsSet Open Firmware LocallyManage Static Computer GroupsModify Network Settings LocallyManage Management PreferencesSet ARD Fields LocallyManage Self Service PreferencesUse Advanced Options LocallyManage Scheduled TasksCasper Remote PrivilegesManage Directory BindingsManage Distribution PointsUse Casper RemoteManage Software Update ServersInstall/Uninstall Software RemotelyManage NetBoot ServersRun Scripts RemotelyMap Printers RemotelyJSS - Logs Tab PrivilegesAdd Dock Items RemotelyView Logs TabManage Local User Accounts RemotelyFlush Policy HistoriesChange Casper’s SSH Accounts RemotelyJSS - Settings Tab PrivilegesBind to Active Directory RemotelySet Open Firmware/EFI Passwords RemotelyView Settings TabReboot Computers RemotelyManage JSS AccountsPerform Maintenance Tasks RemotelyManage LDAP ServersSearch for Files/Processes RemotelyManage Buildings and DepartmentsManage Network SegmentsManage General JSS SettingsObserve Remote ComputersView Database/Web Application HealthObserve Remote Computers Without Asking atLogin WindowFlush Database LogsMass Edit Locations/ServersMass Edit Warrantiesfig. 2VNC PrivilegesObserve Remote Computers Without AskingControl Remote ComputersMass Edit Autorun DataControl Remote Computers Without Asking atLogin WindowMass Add SSH AccountsControl Remote Computers Without AskingMass Edit SSH Accounts21

Role Based AdministratorAccessWhen an individual administrator logs into any of the Casper Suiteapplications, his actions are logged in the database. The exampleprovided below illustrates a sample log listing which users controlled aparticular desktop computer (see fig. 3). Creating users and assigningtheir rights falls under Access Control; the logging of events allows fora Procedure that audits the veracity of the Control.fig. 322

Software RestrictionControl Objectives Ensure that no illegal or unauthorized software can be run oncorporate assets by blacklisting applications.Ensuring that software that violates computer usage polices, suchas Peer to Peer file sharing applications, are controlled requires theidentification and removal of software that is out of scope, andnotification about these activities to end user and management.In the case of software restriction (see fig. 4), the Casper Suite offersthe following: Detection of software by the process that loads into RandomAccess Memory (RAM), which is a Detective Control. Quitting and removing the offending Application, which is aPreventative Control Notification to end user and system administrators allows for aProcedure that enforces the Control.fig. 423

CasperVNC SecurityControl Objectives Allow remote administrators to observe or control a computer in away that is secure and audited.Casper VNC tunnels connections through SSL, which is an AccessControl on data transmission from source to host. The VNC serveris launched on demand when trying to control or observe a remoteclient, then quit when the administrator quits the Application. ThisPreventative Control ensures that only authorized Administrators canaccess machines during an active session and eliminates concernsabout passive reception from intrusion.Every connection and all remote control, including VNC, are loggedcentrally in a database as illustrated in fig. 3 above.With the introduction of Version 6 of the Casper Suite, there is now theadditional capability of sending all administrator actions to a CMDB/syslog server by specifying the directory, hostname and port of theserver (see fig. 5).fig. 524

Change Local AdministratorAccount PasswordControl Objectives Rapidly change Administrator account access on all computers.Utilizing the remote features in either the Casper Remote application(see fig. 6) or via a policy (see fig. 7,8,9) the password used to accessthe remote computers can be updated immediately for the computersthat are online and will poll for missing computers until they arefound. This Access Control ensures that any security breach involving acompromised administrator can be resolved within minutes.fig. 625

Change Local AdministratorAccount PasswordTo change local administrator accounts via a policy, first determinethe trigger (start up, login, logout, shut down, time of day, timedfrequency, etc.), activation date and execution frequency.fig. 726

Change Local AdministratorAccount PasswordThe next step is to assign computers or groups, in this case we areapplying the policy to all computers.fig. 827

Change Local AdministratorAccount PasswordThe last step is to set the command to reset the admin password. Inthis case we are resetting both the local admin account as well as theaccount used by the Casper Suite.fig. 928

Enforce Screen SaverSettingsControl Objectives Ensure that desktop screen savers activate after a set amount oftime and require a password to unlock.The Composer application is used to extract system settings (plistentries) from a machine (see fig. 10) that has the proper time activationand security settings that enforces Access Control of the OperatingSystem.fig. 1029

Enforce Screen SaverSettingsThese settings can be remotely distributed to target machines (seefig. 11) and then reinforced on any system event or custom timing viaa Policy or Managed Preference (see fig. 12). The Policy or ManagedPreference is used to ensure that the Access Control is enforced in areasonably persistent manner.fig. 11fig. 1230

Protocol SecurityControl Objectives Ensure that data transmission is encrypted.The central component of the Casper Suite, the JAMF Software Server(JSS), communicates with the other applications using industrystandard SSL encryption that allows for a single point of management.While this list addresses many of the primary Controls thatSarbanes-Oxley governs concerning Desktop Management, it is byno means exhaustive. In the absence of clear definitions or standardsof conduct, the above solutions meet specific objectives thatdemonstrate a company’s willingness to abide by the spirit of the law.The Increasing Importance of IT sys/article.php/3402561September 1, 2004By George SpaffordIT Control Objectives for Sarbanes-Oxley: The Role of IT in the Designand Implementation of Internal Control Over Financial Reporting, 2ndEditionIT Governance Institute3701 Algonquin Road, Suite 1010Rolling Meadows, IL 60008 USA31

The Apple Security Checklist Companion (ASCC) is intended for IT practitioners engaged in governance, compliance and security related to Macintosh OS X computers. How to Use This Guide The ASCC is a companion document to be used in conjunction with Mac OS X Security Configuration Guide For Version 10.6 (Snow Leopard) published in May of 2010.