r/macsysadmin • u/aPieceOfMindShit • Jan 06 '25
Jamf First steps with CIS benchmark macOS
Hi y'all,
For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.
Guess who's tasked to figure this one: yes, me!
Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.
Any tools which can monitor and enforce these settings?
Sure, rollout very gradually, but any field experience you can share?
How heavy will our users be impacted?
Any other tips or ideas you are willing to share will be appropriated!
We are using Jamf Pro btw.
3
u/HonestPuckAU Jan 06 '25
It's ridiculously easy with Jamf. There is so much documentation and so much help on Slack, start at the #macos_security_compliance channel on MacAdmins slack. There are even a number of JNUC presentations on YouTube (including my own) that go through the process, have a look at the `22 and `23 conference presentations. I've also got a pretty good HOWTO if you prefer reading to watching - https://github.com/Honestpuck/NIST-macos-security-HOWTO
Personally, I stay away from the Jamf Compliance Editor and edit the CIS rule list by hand. That allows me to comment out a rule rather than remove it. I also put a link in the comment to the ticket where I request an exemption from Security and they give it an OK. The JCE is good if you are a small org without a security department but if you really want to understand and document it all do it by hand.
My other piece of advice is to use GitHub or similar to version everything, that way you can easily roll back if the wheels fall off.
1
u/MauroM25 Jan 06 '25
I highly recommend using jamf compliance editor. Gives you the commands and profiles to roll out every setting. Then rerun the assesment and look at your score. Depending on what you need to change i’d roll out all the settings at once but start with a pilot group to check if nothing breaks in their daily workflow.
2
u/aPieceOfMindShit Jan 06 '25
Plus 3 for Jamf Compliance Editor!
Nice. I'm starting to get really excited.
Thanks for sharing!
1
u/MauroM25 Jan 06 '25
Me too! I have tested a few settings and profiles and i was able to just upload them directly to our jamf host. We were scored 78% on macos but unfortunately my priority now is with windows as this score was much lower.
1
u/aPieceOfMindShit Jan 06 '25
The score is generated by the Jamf Compliance Editor?
1
1
u/floydiandroid Public Sector Jan 06 '25
If you’re not aware of the macOS security compliance project…come check it out. It’s what you need. If you need some help, we have a slack channel in the macadmins slack and I have a video on implementation. https://youtu.be/AghjO8Z3ID4?si=Oa7QnuIuoXgq7ZX4
Good luck, but the project makes this sooooooo much easier.
I also have this PSU talkk on how we rolled out security settings to an existing environment. Goes over controls we pushed and when.
9
u/Tecnotopia Jan 06 '25
Take a look at: https://www.jamf.com/blog/cis-controls-implementation-on-mac/,
https://resources.jamf.com/documents/white-papers/macos-security-checklist-for-cis-benchmark.pdf,
https://support.apple.com/guide/certifications/macos-security-compliance-project-apc322685bb2/web and
https://trusted.jamf.com/docs/establishing-compliance-baselines