Ensure Power Nap Is Disabled for Intel Macs

BajaNivel 1Automatizadamacos

Descripción

Power Nap allows the system to stay in low power mode, especially while on battery power, and periodically connect to previously known networks with stored credentials for user applications to phone home and get updates. This capability requires FileVault to remain unlocked and the use of previously joined networks to be risk accepted based on the SSID without user input. This control has been updated to check the status on both battery and AC Power. The presence of an electrical outlet does not completely correlate with logical and physical security of the device or available networks. Disabling this feature mitigates the risk of an attacker remotely waking the system and gaining access. The use of Power Nap adds to the risk of compromised physical and logical security. The user should be able to decrypt FileVault and have the applications download what is required when the computer...

Cómo se verifica

Método de auditoría: Comando de shell

shell

[ -x /usr/bin/pmset ] || exit 1
/usr/sbin/sysctl -n machdep.cpu.brand_string | /usr/bin/grep -q Intel || { echo 0; exit 0; }
/usr/bin/pmset -g custom | /usr/bin/awk '$1 == "powernap" && $2 == 1 {n++} END {print n+0}'

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Graphical Method: Perform the following steps to disable Power Nap: Desktop Instructions: 1. Open System Settings 2. Select Energy Saver 3. Set Power Nap to disabled 4. Select UPS (if applicable) 5. Set Power Nap to disabled Laptop Instructions: 1. Open System Settings 2. Select Battery 3. Select Power Adapter (for laptops only) 4. Set Power Nap to disabled 5. Select Battery 6. Set Power Nap to disabled 7. Select UPS (if applicable) 8. Set Power Nap to disabled Terminal Method: Run the following command to disable Power Nap: % /usr/bin/sudo /usr/bin/pmset -a powernap 0

Propiedades

Sistemas operativos: macos-14
Etiquetas: macossonoma
Referencia: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.9.2 Ensure Power Nap Is Disabled for Intel Macs

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos