TMA-SAFARI-3.2

Ensure 'AutoFill web forms: Credit cards' is 'Disabled'

SrednjaNivo 2Automatskasafari

Opis

Safari can store and retrieve payment card information in the user-level keychain. The information is collected during an online purchase, following the user's permission. It is recommended that Safari be configured to not store payment card information in cases where security is paramount. Rationale: If a user's console session is compromised, credit card information may be auto-filled into a website for a malicious purpose. Audit reads AutoFillCreditCardData from the com.apple.Safari preference domain of the account running the scan (the PDF checks the same token in com.apple.Safari.plist; manual check: Follow the below steps and verify that AutoFill web forms: Credit cards is Disabled: 1. Click Safari. 2. Click Preferences. 3. Click AutoFill. 4. Verify AutoFill web forms: Credit cards is unchecked.). Safari is sandboxed, so the reading process needs Full Disk Access on macOS 10.14+. A missing key exits non-zero and is reported as FAIL even where the built-in default is compliant. Values forced by a configuration profile live in /Library/Managed Preferences and are not read here.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(defaults read com.apple.Safari AutoFillCreditCardData 2>/dev/null) || exit 1; printf '%s\n' "$out"

Očekivani izlaz: 0

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Follow the below steps to set AutoFill web forms: Credit cards to Disabled: 1. Click Safari. 2. Click Preferences. 3. Click AutoFill. 4. Uncheck AutoFill web forms: Credit cards. Or deploy a configuration profile for com.apple.Safari setting AutoFillCreditCardData = false, or as the logged-in user run: defaults write com.apple.Safari AutoFillCreditCardData -bool false and restart Safari.

Svojstva

Operativni sistemi: Bilo koji
Oznake: safaribrowsercis-l2
Referenca: CIS macOS Safari Benchmark v2.0.0 - 3.2 Ensure 'AutoFill web forms: Credit cards' is 'Disabled'

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target safari --level 2