TMA-MACOS-2.3.4.2

Ensure Time Machine Volumes Are Encrypted If Time Machine Is Enabled

高级别 1自动化macos

说明

One of the most important security tools for data protection on macOS is FileVault. With encryption in place, it makes it difficult for an outside party to access your data if they get physical possession of the computer. One very large weakness in data protection with FileVault is the level of protection on backup volumes. Audit: Time Machine not configured counts as compliant (no NotEncrypted destination).

检查方式

审计方法: Shell 命令

shell

[ -x /usr/bin/defaults ] || exit 1
out=$(/usr/bin/defaults read /Library/Preferences/com.apple.TimeMachine.plist 2>/dev/null)
printf '%s\n' "$out" | /usr/bin/grep -c NotEncrypted || true

预期输出: 0

修复方式

修复方法: 操作指南或基础设施补丁

GUI: System Settings > General > Time Machine > unencrypted drive > - to forget that drive as a destination > + to add a different drive as the destination > Set Up Disk > Set Encrypt Backup to enabled > Enter a password in the New Password and the same password in the Re-enter Password fields > A password hint is required, but it is recommended that you do not use any identifying information for the password.

属性

操作系统: macos-26
标签: macossystem-settings
参考: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.3.4.2 Ensure Time Machine Volumes Are Encrypted If Time Machine Is Enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target macos