macOS 10.14 Mojave

This guidance was developed following testing performed on MacBook Pro and MacBook Air devices running macOS 10.14 (Mojave)

It’s important to remember that this guidance has been conceived as a way to satisfy the 12 End User Device Security Principles. As such, it consists of recommendations and should not be seen as a set of mandatory instructions requiring no further thought.

Risk owners and administrators should agree a configuration which balances business requirements, usability and security.

We recommend the following architectural choices for macOS 10.14 as part of a remote working scenario:

• All data should be routed over a secure enterprise VPN to ensure the confidentiality and integrity of the traffic, and to benefit from enterprise protective monitoring solutions.

• User accounts should be created locally on macOS devices and managed remotely using Mobile Device Management (MDM).

• Users should not be permitted to install arbitrary third-party applications on the device. Applications which users require should be pre-installed, provisioned as part of the device image, or installed using MDM.

When configured in this way, risk owners should be aware of the following technical risks associated with this platform:

To meet the principles outlined in the End User Devices Security Framework, several recommendations are given in the table below.

Recommended network architecture

All remote or mobile working scenarios should use a typical remote access architecture with a VPN terminating into an access layer (or DMZ). The following network diagram describes the recommended architecture for this platform.

A Mobile Device Management server is required. Apple’s macOS Server Profile Manager is sufficient for this purpose. Alternatively, third-party products exist which may offer additional functionality over and above Profile Manager.

The steps below should be followed to prepare your organization’s infrastructure for hosting a deployment of these devices:

• Set up an MDM server (e.g. Profile Manager on macOS Server). This may require setting up the Open Directory component of a macOS Server.

• Ensure all Configuration Profiles are signed to prevent modification in transit, or post install

• Create policies on Profile Manager for:

  • Ensure ‘Use SSL’ is selected for all server settings

  • VPN

  • Passcode

  • Disk encryption and key escrow

  • Exchange/Mail/Calendar Settings.

  • Disabling access to the Preference Panes in Restrictions (macOS) for iCloud and Network as access to these could be used to disable the VPN.

See the Recommended Policies and Settings section for more detail on the above.

You can also consider creating policies in other sections of Profile Manager. In particular, we recommend that administrators:

• Allow list applications to further reduce the risk of malicious code being executed

• Tighten permissions on USB mass storage and optical devices to help prevent data loss through removable media

• Use Restrictions to deny list locations from which users should not run applications, or allow list trusted applications that users are allowed to run

• Include internal CA Certificates where appropriate to ensure users can authenticate network services

• Include corporate network profiles (e.g. 802.1X or Wi-Fi) to ensure that network access credentials are distributed securely

Device provisioning steps

Follow these steps to provision each end user device onto your organization’s network in preparation for distribution to end users.

These instructions assume the device is new or the operating system has been wiped and reinstalled.

1. On first boot, the device will present a number of prompts. In these prompts:

   • Firstly, create a local Administrator account. This will be used to locally manage the device. Credentials should not be given to the end user. A strong password should be entered at this stage.

   • Secondly, skip the Apple ID creation and entry.

   • Location Services can be enabled if required.

   • The device can be registered with Apple if required.

2. Local settings should now be set. A script is provided to automatically provision these settings, but they can also be configured manually.

   • Disable any non-required services (e.g.infrared)

   • Enable low-overhead security features (e.g. firewall, updates)

   • Set user security policies (e.g. timeouts, screen lock, password hints)

   • Create a standard user account

   • Make the user’s home folder accessible only to that user

   • Lock down the user’s Terminal/Shell access. The user should have a limited Bash profile, which can be set as part of .bash_profile. This file should be owned by the root user so that modifications cannot be made. The user’s PATH should be set to a folder in the user’s directory and required applications symlinked to this directory

   • If MDM policies are not used to enforce FileVault and key escrow, manually configure disk encryption on the device. Either:

     • Create a separate Disk Encryption user which will have a strong password used to decrypt the disk.

       • Only give the Disk Encryption user access to decrypt the disk

       • Part of this password could be from a password entry token such as a YubiKey

     • Allow the primary user to unlock the disk using their login passcode.

   • Turn on automatic updates via System Preferences -> Software Update settings

   • Turn off initial iCloud login prompt for first user login. This will stop the user being prompted to use iCloud.

   • To help prevent DMA and cold-boot attacks, set a Firmware Password

3. The device should now be enrollled with the MDM server and the configuration profiles applied, including those to enforce FileVault and key escrow if not set locally

4. At this stage, any additional third-party applications can be installed (e.g. productivity apps)

5. Distribute the device, disk encryption password and user password separately to the user

6. The user should then change their password and skip the Apple ID registration step at the next time they log on

Device imaging

Instead of provisioning each device individually, an alternative option is to produce a master device image which can be deployed onto devices. The recommended approach for creating a standard disk image is to install the OS, create a local admin account and apply local policies, then install any required applications on a client machine.

The client machine is then connected to an imaging server in target disk mode. Apple’s System Image Utility can then be used to create a NetRestore or NetBoot image of the device. The image can then be used to provision other machines. NetBoot images can also be created from macOS installers downloaded from Apple, though care should be taken to ensure that the version downloaded can be deployed on the specific hardware you are using.

Note

Enabling FileVault 2 and MDM enrollment must only be done after the device has been imaged. This ensures that the cryptographic keys involved in these security features are unique. This, however, can be achieved during MDM enrollment using options under the ‘FileVault’ tab within the ‘Security and Privacy’ submenu, including the configuration of recovery key escrow.

Apple’s website has a support article that contains details about creating images for device-specific versions of macOS.

This section details important security policy settings which are recommended for a macOS deployment. Other settings (e.g. server address etc.) should be chosen according to the relevant network configuration. These settings should be applied through a profile (or combination of profiles) created on the MDM server.

The settings below are named as they appear in Apple Configurator and Profile Manager. Other products may use different names for these settings.

The media access settings can be used to limit user access to removable media such as USB drives, writeable optical media and AirDrop.

Your organization should have a consistent authentication policy which applies to all users and devices capable of accessing its data. You can use the BCSF’s published password guidance to help inform any password policy. An administrator should configure the relevant on-device settings in line with your authentication policy.

For further guidance on defining an authentication policy, see the EUD Security Guidance introduction.

To enforce this policy on macOS devices, the following settings are available, and should be set according to the policy:

• Allow simple value

• Require alpha-numeric value

• Minimum passcode length

• Minimum number of complex characters

• Maximum Auto-Lock

• Maximum number of failed attempts

Hardware strengthening

On macOS devices without a T2 processor, passwords for FileVault 2 are not strengthened using hardware. As such, it must be sufficiently complex to prevent offline brute force attacks. Account login attempts are limited by policy, so user account passwords need to be strong enough to resist manual guessing attempts. If one password is used for both FileVault 2 and account login, it should be sufficiently complex to prevent offline brute force attacks.

For devices with a T2 processor, the login password cannot be brute forced offline or extracted with a physical attack, so only needs to resist simple guessing attacks.

VPN profile

The deployed VPN should be configured according to BCSF PRIME profile for IPsec.

The recommended IPsec cipher suite profile for protecting information is called PRIME. A non-authoritative summary is provided in the table below:

Encryption

AES-128 in GCM-128 (and optionally CBC)

The deployed VPN solution should be configured to negotiate the parameters below. Not all of these settings can be configured on the device or MDM VPN profile, therefore the configuration also needs to be enforced from the VPN server.

In OS X 10.9, the mechanism for configuring the VPN On Demand settings changed, and none of the tested MDM utilities currently have a GUI for this new mechanism. To configure the VPN On Demand to trigger for all outgoing connections, follow the steps below:

• Configure the VPN settings using the MDM and test the profile on the device to ensure it connects manually

• Export the VPN configuration profile (unsigned) from the MDM as a .mobileconfig file. Convert this to text using plutil if required.

• Using a text editor, modify the XML configuration inside the exported file. Within the IKEv2 key, add rules for OnDemandEnabled & OnDemandRules as shown below:

IKEv2
OnDemandEnabled
1
OnDemandRules
Action
Connect

Copy

• Import the modified configuration to the MDM and deploy to the device

In Profile Manager, it is possible to set the option ‘Always on VPN (supervised only)’. However, this causes the profile install to fail on macOS devices, so the approach described above should be used instead. Note also that for a macOS device to successfully verify the VPN server certificate, the certificate must have a Subject Alternative Name (SAN) entry that matches the common name.

The following additional points address issues specific to macOS deployments.

iCloud

We recommend that users do not use iCloud as this may allow data to leak through iCloud backup and application storage. This can be achieved by not signing into the Apple ID when prompted by the operating system. Other Apple applications such as iTunes can be used with an Apple ID without enabling iCloud integration if they are required.

FileVault

In order for the enterprise to retain the ability to access the device in the event the FileVault 2 encryption password is lost, it should be ensured that the local administrator user has permission to unlock the FileVault encryption. This option is available within the Security & Privacy section of System Settings, under FileVault with the option to escrow recovery keys set under the ‘Escrow Personal Recovery Key’ option.

If key escrow is not possible or multiple versions of macOS need to be supported, a keychain can also be created by setting a Master Password (from the Users & Groups service menu). This keychain can be distributed to all managed macOS devices before enabling FileVault and will be acknowledged during the process of enabling FileVault. Apple support has more information on this process.

Extensions

In OS X 10.10, the extension feature was added. This allows application developers to extend the functionality of their application to third parties. As an example, the sharing extension could allow a user to share information to social network sites from an application.

Your organization should control which applications are installed in the environment and limit the ability for applications to interface to the user via Extensions. This can partially be configured as part of your organization’s MDM solution.

Firewall Configuration

The Security & Privacy options allow additional configuration of the firewall. MDM policies can be used to give finer grained control over firewall rules on the system, if required. As an example, a policy can be enabled to block all incoming connections to the device.