Audit Connected FAT32 and ExFAT Drives

低等級 2人工審核macos

說明

While FAT32 and exFAT offer cross-platform convenience, they introduce critical security gaps. These formats do not support encryption without third-party products (on any platform). Consequently, FAT32 and exFAT should be reserved strictly for temporary, non-sensitive data transfers, while any sustained use or sensitive data storage should utilize APFS (Encrypted). Note: While the recommendation for FAT32 and ExFAT drives is not automated, we have included a script check within CIS-CAT if your organization does want to not allow either format to be used and does not have an existing solution. Prohibiting FAT32 and exFAT devices centers on the total absence of native access controls and data-at-rest protection. Unlike APFS or HFS+, which allow for granular folder restrictions, FAT32 and exFAT operate with an effective "777" permission state, granting every user and process on a system...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Terminal Method: Run the following command to list any FAT32 or ExFAT external Volumes are connected: % diskutil list external | grep -E 'DOS_FAT_32|Microsoft Basic Data' Any FAT32 or ExFAT drives connected should meet your organization's existing device policies for external drives.

修補方式

修補方法: 操作指南或基礎設施修補檔

Any connected FAT32 or ExFAT volumes need to be audited to verify that they meet your organization's existing device policies for external drives. Note: Removable storage is generally formatted in FAT32 or ExFAT. Those drives generally are used by additional non-Apple devices and are outside the scope of the benchmark. If your organization has a use for those devices, removable storage should only be connected when importing data to your Apple device. After import, those drive(s) should be immediately ejected and then disconnected from the computer.

屬性

作業系統: macos-14
標籤: loggingmacossonoma
參考資料: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.3.3 Audit Connected FAT32 and ExFAT Drives