Ensure the OS Is Not Active When Resuming from Standby (Intel)

中レベル 2手動レビューmacos

説明

In order to use a computer with Full Disk Encryption (FDE), macOS must keep encryption keys in memory to allow the use of the disk that has been FileVault protected. The storage volume has been unlocked and acts as if it were not encrypted. When the system is not in use, the volume is protected through encryption. When the system is sleeping and available to quickly resume, the encryption keys remain in the Secure Enclave (if the device is a Mac with a T1 security chip, it remains in memory). https://www.helpnetsecurity.com/2018/08/20/laptop-sleep-security/ Mac systems should be set to hibernate after sleeping for a risk-acceptable time period. The default value for "standbydelay" is three hours (10800 seconds). This value is likely appropriate for most desktops. If Mac desktops are deployed in unmonitored, less physically secure areas with confidential data, this value might be adjus...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Terminal Method: Run the following command to verify the hibernation settings and that FileVault keys are destroyed on standby: % /usr/bin/sudo /usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep -e MacBook If there is an output, run the following: % /usr/bin/sudo /usr/bin/pmset -b -g | /usr/bin/grep -e standby The output should include a standbydelaylow value ≤ 900, a standbydelayhigh value ≤ 900, and a highstandbythreshold value ≥ 90. % /usr/bin/sudo /usr/bin/pmset -b -g | /usr/bin/grep hibernatemode hibernatemode 25 example: % /usr/bin/sudo /usr/sbin/system_profiler SPHardwareDataType | /usr/bin/grep -e MacBook Model Name: MacBook Pro Model Identifier: MacBookPro13,1 % /usr/bin/sudo /usr/bin/pmset -b -g | /usr/bin/grep -e standby standbydelaylow 600 standby 1 standbydelayhigh 600 highstandbythreshold 50 % /usr/bin/sudo /usr/bin/pmset -b -g | /usr/bin/grep hibernatemode hibernatemode 25 Note: To verify if you are running an Intel processor, run /usr/sbin/sysctl -n machdep.cpu.brand_string. The output will include Intel.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Terminal Method: Run the following command to set the hibernate delays and to ensure the FileVault keys are set to be destroyed on standby: % /usr/bin/sudo /usr/bin/pmset -a standbydelaylow <value≤900> % /usr/bin/sudo /usr/bin/pmset -a standbydelayhigh <value≤900> % /usr/bin/sudo /usr/bin/pmset -a highstandbythreshold <value≥90> % /usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1 % /usr/bin/sudo /usr/bin/pmset -a hibernatemode 25 example: % /usr/bin/sudo /usr/bin/pmset -a standbydelaylow 500 % /usr/bin/sudo /usr/bin/pmset -a standbydelayhigh 500 % /usr/bin/sudo /usr/bin/pmset -a highstandbythreshold 100 % /usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1 % /usr/bin/sudo /usr/bin/pmset -a hibernatemode 25

プロパティ

オペレーティングシステム: macos-14
タグ: macossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.9.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel)