May 2013 - SCAP-On-Apple-Dev - lists.macosforge.org

Re: [SCAP-On-Apple-Dev] Configuration Profiles vs Plist file diddling
by Haynes, Dan 04 Jun '13

04 Jun '13

Thanks for getting this discussion started Josh and Prabhu! As Prahbu mentioned, we have the existing macos-def:plist510_test and the ind-def:xmlfilecontent_test that can support the assessment of plist files (including configuration profiles). There is also an experimental plist511_test in the OVAL Language Sandbox (https://github.com/OVALProject/Sandbox/blob/master/x-macos-plist-xpath.xsd) which utilizes xpath to reference the preference key of interest. To help show how these three tests can be used, I have attached sample definitions that check for CCE-28300-2 idle_time_for_screen_saver. Hope this helps! Thanks, Danny From: scap-on-apple-dev-bounces(a)lists.macosforge.org [mailto:scap-on-apple-dev-bounces@lists.macosforge.org] On Behalf Of Prabhu S Angadi Sent: Friday, May 31, 2013 3:38 AM To: scap-on-apple-dev(a)lists.macosforge.org Subject: Re: [SCAP-On-Apple-Dev] Configuration Profiles vs Plist file diddling Hi All, Yes! I completely agree with Josh, on the usage configuration profiles. Being the XML formatted content of these files can be easily parsed to fetch the composed policies values, to develop the SCAP OVALl definitions, using available '< xmlfilecontent_test >' or '< plist510_test >' probes for better assessment. And also, as these files can be easily deployed with customized values as per user's choice. Either by * By physically connecting the device * In an email message * On a webpage * Using over-the air configuration as described in this document so I think it will be of great use in remediation part as well. _______________________________________________________________________________________ In supportive to Josh, I have attached few Profile files, that were developed to address the Apple iOS Hardening Checklists by The University Of Texas at Austin. FMI : https://wikis.utexas.edu/display/ISO/Apple+iOS+Hardening+Checklist https://wikis.utexas.edu/display/ISO/iOS+Configuration+Profiles -- Thanks !! Prabhu S A http://www.scaprepo.com On 05/31/2013 02:50 AM, Josh Wisenbaker wrote: Hi all, I think that from an audit and remediation standpoint things can be greatly simplified by using Configuration Profiles. You can easily get a XML formatted list of the composited policies that are on the Mac and you can easily apply settings by installing a profile. Using the policy mechanisms in OS X is highly recommended over messing with files. As an example here is a profile I made that implements all of the settings for the initial loginwindow tickets that are in the tracker. This profile allows for removal without authentication so it's easy to test with. Thoughts? Josh -- Josh Wisenbaker Consulting Engineer - Apple U.S. Commercial and Governmental Sales dubs(a)apple.com<mailto:dubs@apple.com> _______________________________________________ SCAP-On-Apple-Dev mailing list SCAP-On-Apple-Dev(a)lists.macosforge.org<mailto:SCAP-On-Apple-Dev@lists.macosforge.org> https://lists.macosforge.org/mailman/listinfo/scap-on-apple-dev

3 3

Re: [SCAP-On-Apple-Dev] Anyone have access to the DISA SCAP scanner?
by Josh Wisenbaker 03 Jun '13

03 Jun '13

Hi Danny, I suppose a bit of an introduction from myself would help here. I'm Josh Wisenbaker and I'm a peer of Shawn's at Apple on the CE team. I cover the client management and deployment subject matter and do a bit of Mac App Dev coverage as well. So while I'm not a contractor, I have done plenty of work over the years with gov and mil accounts. Josh -- Josh Wisenbaker Consulting Engineer - Apple U.S. Commercial and Governmental Sales dubs(a)apple.com On May 31, 2013, at 12:30 PM, "Haynes, Dan" <dhaynes(a)mitre.org> wrote: > Hi Josh, > > I guess I forgot to ask, are you supporting the U.S. government as a contractor? > > Thanks, > > Danny > > > From: Haynes, Dan > Sent: Friday, May 31, 2013 12:03 PM > To: 'Josh Wisenbaker'; scap-on-apple-dev(a)lists.macosforge.org > Subject: RE: [SCAP-On-Apple-Dev] Anyone have access to the DISA SCAP scanner? > > Hi Josh, > > The SPAWAR SCC tool is limited to U.S. government agencies and supporting contractors. I will put you in touch with the SPAWAR team to see if you are eligible. > > If not, there are quite a few other tools available (some commercial and some open source). You can find them at the following links. > > http://nvd.nist.gov/scapproducts.cfm > > http://oval.mitre.org/adoption/productlist.html > > Thanks, > > Danny > > From: scap-on-apple-dev-bounces(a)lists.macosforge.org [mailto:scap-on-apple-dev-bounces@lists.macosforge.org] On Behalf Of Josh Wisenbaker > Sent: Friday, May 31, 2013 11:52 AM > To: scap-on-apple-dev(a)lists.macosforge.org > Subject: [SCAP-On-Apple-Dev] Anyone have access to the DISA SCAP scanner? > > Does anyone have access to the SCC 3.1 that is posted on the DISA page here? <http://iase.disa.mil/stigs/scap/index.html> > > From the screenshots I've seen it looks like a Java tool. > > Josh > > -- > Josh Wisenbaker > Consulting Engineer - Apple U.S. Commercial and Governmental Sales > dubs(a)apple.com

2 3

Anyone have access to the DISA SCAP scanner?
by Josh Wisenbaker 31 May '13

31 May '13

Does anyone have access to the SCC 3.1 that is posted on the DISA page here? <http://iase.disa.mil/stigs/scap/index.html> From the screenshots I've seen it looks like a Java tool. Josh -- Josh Wisenbaker Consulting Engineer - Apple U.S. Commercial and Governmental Sales dubs(a)apple.com

3 2

Configuration Profiles vs Plist file diddling
by Josh Wisenbaker 31 May '13

31 May '13

Hi all, I think that from an audit and remediation standpoint things can be greatly simplified by using Configuration Profiles. You can easily get a XML formatted list of the composited policies that are on the Mac and you can easily apply settings by installing a profile. Using the policy mechanisms in OS X is highly recommended over messing with files. As an example here is a profile I made that implements all of the settings for the initial loginwindow tickets that are in the tracker. This profile allows for removal without authentication so it's easy to test with. Thoughts? Josh -- Josh Wisenbaker Consulting Engineer - Apple U.S. Commercial and Governmental Sales dubs(a)apple.com

2 1

[Announce] Community-based Settings Curation for OSX & iOS
by Shawn Geddis 29 May '13

29 May '13

SCAP-On-Apple User and Dev Community, (cross-post to Fed-Talk Community) The day has final come to begin digging in your heels with your shoulder to the grindstone! Several have been working hard behind the scenes, for several months now, to establish a bulk of the initial settings for OSX and iOS for public review, discussion, modifications and ultimately for approval and posting to the data feeds provided from this project. We have had some time and resource constraints that have negatively impacted our ability to reach this point on our original target date. Now, your wait is over and we can all dig in our heels and move this effort forward in a joint effort to bring the best and brightest together in a concerted effort for Settings Curation. I wanted to give everyone a bit of structure and guidance on how we plan to proceed to maximize our time, talents and goals for this project. Flow of Settings Curation - Iterative Process Selection of the next BLOCK of settings [selection by SCAP Core Team] Generation of a Ticket for each setting [for Tracking & Reference purposes] Blog posting of next Settings Block [announce posting of next block] Daily Community Review & discussion [Community review/discussion via List] Weekly Closeout of Review [Tickets closed one week after creation] Post Curated Settings to Repository [Post updated data repositories & feeds] In addition to the users and developers in this community, this process will also have close involvement by individuals from NIST, NSA and SCAP Experts to ensure a solid review and submission process is accomplished. Timing You will notice that we are targeting a weekly closeout of settings. This will give us a 'rolling review' and ONE FULL WEEK for review/feedback/modifications of each setting. We do not anticipate any setting requiring more time than that for vetting, but if it does, we will place the settings ticket on hold for later followup. CCEs We plan to prefix the corresponding settings tickets with a designated CCE# which, among other things, will aid this community in long term tracking of activity and outcome for any given CCE / setting. Data Feeds The data feeds necessary for testing will also be pulled and hosted here as a 'developing authoritative data feed'. Once we have completed our curated We have several hundred settings right now and anticipate throughout this process that some may be significantly modified, dropped, added or approved as is. Guidance is that you jump right in on areas you are most knowledgable on and then progress to those you are unfamiliar or interested in learning more about with community discussion. Tool Vendors We encourage all tool vendors to participating and contribute validation feedback on all data tested from here against your own available tool sets. Right now this activity would be premature in the process, but keep this in mind for your organization's resource planning. We want to Thank You all in advance for waiting on us for so long and for your willingness to actively engage in the SCAP-On-Apple Project. If for any reason you have questions or comments, please do not hesitate to send them directly to this list for community feedback as well. Contact / Admin email addresses are also in the signature below. -Shawn _______________________________________________________________________ Shawn Geddis Enterprise Security Consulting Engineer, Apple [geddis(a)apple.com] SCAP-On-Apple Project/Dev Lead: Project Wiki [http://SCAP-On-Apple.MacOSForge.Org] Mailing Lists [http://scap-on-apple.macosforge.org/trac/wiki/MailingList] SCAP Contact [scap-cotact(a)macosforge.org] SCAP Admin [scap-admin(a)macosforge.org] _______________________________________________________________________

1 0