Slides from 2018 MacAD.UK confernce Synopsis: https://www.macad.uk/speaker/henry-stamerjohann/ When tasked with (re)building a security baseline for macOS clients, where do you start? There’s obviously decisions to be made about what’s feasible in your organization (beyond if admin privileges should be the default). You need to weigh system stability and security with end-user productivity. Luckily for the macOS platform a rich ecosystem of tools exist to fill in the gaps and general guidance is available. The crucial part of making mindful and informed decisions is to first aggregate data from your IT environment. You can then decide what configurations to deploy and run recurring compliance checks based on an appropriate strategy. This session will cover fundamentals, highlight advanced considerations, and outline practical examples to apply when you’re conducting a (new) baseline for macOS clients.

1. Henry Stamerjohann
Apfelwerk GmbH & Co. KG
Twitter: @head_min
Slack: @henry
hello (again)

2. Building your macOS Baseline
Requirements

3. • Wide variety of endpoints in a mobile world
• Mission to secure Hardware / Software configurations
• Continuous Vulnerability Assessment
• We are responsible for data (GDPR / EU-DSGVO)
Today

4. • You’re asked to apply a Windows Security guideline to Macs
• You’re questioned how Group Policy Objects (GPOs) can apply to Macs
• You’re glued into looping-discussion how MDM / APNs works
• InfoSec challenges you with: "Why should we trust 17.0.0.0/8"
Imagine

6. Security Baseline

7. Network
segmentation
Access control
management
System auditing
Compartmen-
talization
Physical access
Verify
digital signatures
Vulnerability
assessment
Aggregate,
alert upon logs
Managed
Updates
Intrusion
detection
Inventory
Control
Secondary
factors
Remediation
plan
Components
Platform
firmware security
Full disc
encryption Forensics

8. Intrusion
detection
Network
segmentation
Access control
management
System auditing
Compartmen-
talization
Physical access
Verify
digital signatures
Vulnerability
assessment
Aggregate,
alert upon logs
Managed
Updates
Inventory
Control
Secondary
factors
Remediation
plan
Components
Platform
firmware security
Full disc
encryption Forensics

9. Intrusion
detection
Network
segmentation
Access control
management
System auditing
Compartmen-
talization
Physical access
Verify
digital signatures
Vulnerability
assessment
Aggregate,
alert upon logs
Managed
Updates
Inventory
Control
Secondary
factors
Remediation
plan
Components
Platform
firmware security
Full disc
encryption Forensics
Training

10. • Basic (security) plan for IT systems
• Identify and implement security measures
• Complete for operational environment
• Specific implementation documents
Essentials

11. • Enforce compliance standards
• Appropriate strategy to address security and end-user productivity
• Include (simple) post-incident templates
• Your security posture
Objectives

12. • Patch your systems and software frequently
• Disable services and limit access where possible
• Ensure configuration settings stay compliant
• Close the gaps when detected & keep improving
Procedures

13. Creating policies too rigid,
you’ll be taking the risk to fail !

14. Structure

15. Example: Security Baseline from CERN

17. Microsoft Security Compliance Toolkit

18. www.cisecurity.org/benchmark/apple_os/

19. github.com/drduh/macOS-Security-and-Privacy-Guide

20. github.com/drduh/macOS-Security-and-Privacy-Guide

21. • Config Profiles (MDM, manually deployed)
• Scripts / CLI tools / Software
• Conditionals / Extension Attributes
• MDM commands (wipe/lock)
Configuration elements

22. • Inventory information, management system
• Scheduled intervals
• Reporting / Dashboards / Logging
• Change Detection, Alerting
• Automation / programmed remediation
Control Facilities

23. github.com/kristovatlas/osx-config-check

25. How many binaries and scripts inside?
App Binaries Scripts
Firefox.app
Google Chrome.app
Atom.app
Xcode.app
8
12
30
1224 270
(bash, python, perl, node,..)
144
(bash, python, node,..)
6
(bash)
-
122
Executable Bingo!

26. support.apple.com/en-us/HT208103

27. Repercussions
Acknowledge risk of executing malicious binaries
Developers could blindly insert "bad code" or
"backdoor mechanism", etc.

28. media.ccc.de/v/34c3-9249-hardening_open_source_development
34C3

29. Devs …what can go wrong ?
• Flaws in development toolchains
• Risk of code execution
• Package managers (npm, hombrew)
• Code or build scripts compromised
• Hiding code from git diff (UTF-8 Character spoofing)
• ASCII control characters copy/paste compromised

30. Executable Bingo!

31. www.tenable.com/products/nessus/nessus-professional

32. https://www.inspec.io

36. brew.sh

37. Application Lifecycle &
Change management

38. Inspect content

39. Fingerprint binaries
OracleJava9-9.0.1.0.11.pkg

40. Fingerprint binaries
OracleJava9-9.0.4.0.11.pkg

41. Inspect for difference in detail

42. Discuss responsibly

44. Security Baseline
(Management infrastructure)

45. • Configuration management to control server state
• Build Multiple layers of defense
• Limit access / API access
• Use logging and intrusion detection
Management services

46. Local logs

48. Log aggregation

49. Log aggregation

50. Log aggregation

51. http://dev-sec.io

52. http://dev-sec.io

53. OSQuery
(Change detection)

54. https://osquery.io

55. https://osquery.io

56. https://osquery.io

57. Recurring check

58. Recurring check

59. Google Santa
(Binary control)

60. https://github.com/google/santa

61. https://santa.readthedocs.io/en/latest/

63. Scan executable content

64. Scan executable content

65. Scan executable content

68. brew-openssl-1.0.2h.json
Diff for analyze
brew-openssl-1.0.2n.json

69. Event streams
Action
action (clause)
execute once the
probe fires
Event
point of
instrumentation
in the system
Ship
aggregate
results &
sync config
Probe
filter when certain
event (described)
happens
>>> Event stream data is stored for historic inspection

70. https://zentral.io

71. github.com/zentralopensource/zentral

72. Open BSM audit

73. Open BSM audit

74. Open BSM audit

75. http://services.google.com/fh/files/misc/fleet_management_at_scale_white_paper.pdf

76. Rebuild your
Security Baseline

77. Data Protection & Regulation

78. TY!

79. Q & A

80. Links
https://github.com/apfelwerk/macadUK2018-baseline-requirements