Ensure Siri Is Disabled

低レベル 1自動macos

説明

With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears to be a usage edge case. In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements. Most of the use case data published has shown that Siri...

チェック方法

監査方法: シェルコマンド

shell

/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess').objectForKey('allowAssistant').js
EOS

期待される出力: false

修正方法

修正方法: ガイダンスまたは IaC パッチ

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.applicationaccess 2. The key to include is allowAssistant 3. Set the key to <false/>

プロパティ

オペレーティングシステム: macos-14
タグ: macossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.5.1 Ensure Siri Is Disabled

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target macos