New Update NIST Finalizes macOS Security Guidance

[upnorth]

No operating system is immune to threats, and a thorough endpoint security strategy accommodates the requirements for each one. Toward that end, the National Institute of Standards and Technology (NIST) has published the final version of its guidance on securing macOS endpoints.

NIST SP 800-219 provides system administrators, security professionals, security policy authors, information security officers, and auditors with resources to secure and assess macOS desktop and laptop system security in an automated way. NIST derived the guidance from the open source macOS Security Compliance Project, born out of a collaboration between NIST, NASA, the Defense Information Systems Agency, and Los Alamos National Laboratory.

The goal of the mSCP is to simplify the macOS security development cycle by reducing the amount of effort required to implement security baselines, NIST says. Security baselines refers to "groups of settings used to configure a system to meet a target level or set of requirements or to verify that a system complies with requirements." The project is intended to help IT and security staff create customized security baselines of technical security controls by leveraging a library of rules, with each rule mapped to requirements from security standards, regulations, or frameworks, NIST says in the guidance document.

The mSCP provides scripts that can be used with baselines to create scripts and profiles for configuring macOS; generate a mapping between security standards, regulations, and frameworks; produce human-readable documentation in a variety of formats; customize existing baselines; and generate Security Content Automation Protocol (SCAP) content for use in automated security compliance scans. Security baselines and associated rules for configuring and managing macOS endpoint devices can be found on mSCP’s GitHub page. Organizations should take a risk-based approach for selecting the appropriate settings and defining values that consider the context under which the baseline will be used, NIST says.

"Generally, the technical security settings in macOS do not drastically change from release to release, with only a handful of new settings being introduced. By pursuing a rules-based approach, mSCP rules that remain applicable can be reused and incorporated into guidance for the latest macOS version. This enables quicker adoption of new security features that are not offered in prior versions of macOS,"

NIST Finalizes macOS Security Guidance

NIST SP800-219 introduces the macOS Security Compliance Project (mSCP) to assist organizations with creating security baselines and defining controls to protect macOS endpoints.

www.darkreading.com