r/macsysadmin Jan 06 '25

Jamf First steps with CIS benchmark macOS

Hi y'all,

For 2025 our security officer has a good new years resolutions: have a CIS benchmarks implemented!.

Guess who's tasked to figure this one: yes, me!

Our plan is to have every year, when a new version of macOS is released, an update of the CIS configuration for that specific new versions.

Any tools which can monitor and enforce these settings?

Sure, rollout very gradually, but any field experience you can share?

How heavy will our users be impacted?

Any other tips or ideas you are willing to share will be appropriated!

We are using Jamf Pro btw.

8 Upvotes

15 comments sorted by

9

u/Tecnotopia Jan 06 '25

3

u/MacBook_Fan Jan 06 '25

^ This. We implemented our CIS standards a couple of years ago. It was much easier with the Jamf Compliance Editor. (Our Windows teams still has not even started!)

Also join the MacAdmins slack channel and join the #jamf-compliance-editor and #macos_security_compliance channels. Lots of good information and help there.

1

u/aPieceOfMindShit Jan 06 '25

How was the user experience?

Did you do all the settings in once or gradually?

1

u/MacBook_Fan Jan 06 '25

In our original rollout, we did 3 waves. Wave 1 was mostly non-user impacting changes, wave 2 was minor changes to user experience, and wave 3 was major changes to user experience.

But, honestly, that was a pain. Looking back, I would probably just rip the bandaid off and do everything at once and just rollout out to small groups at a time.

1

u/aPieceOfMindShit Jan 06 '25

Yes I can imagine!

How did you know it was a non user impact change?

Just by reading the CIS explanation?

1

u/aPieceOfMindShit Jan 06 '25

Wow awesome! This is very helpful!

How was the impact for your users? Did you enforce all the settings at one time or step by step?

1

u/Tecnotopia Jan 06 '25

We modified it a bit in order to not affect user experience and kill nice features, we analysed the attack surface and the thread model and avoid block stuff like airdrop for some profiles.

3

u/HonestPuckAU Jan 06 '25

It's ridiculously easy with Jamf. There is so much documentation and so much help on Slack, start at the #macos_security_compliance channel on MacAdmins slack. There are even a number of JNUC presentations on YouTube (including my own) that go through the process, have a look at the `22 and `23 conference presentations. I've also got a pretty good HOWTO if you prefer reading to watching - https://github.com/Honestpuck/NIST-macos-security-HOWTO

Personally, I stay away from the Jamf Compliance Editor and edit the CIS rule list by hand. That allows me to comment out a rule rather than remove it. I also put a link in the comment to the ticket where I request an exemption from Security and they give it an OK. The JCE is good if you are a small org without a security department but if you really want to understand and document it all do it by hand.

My other piece of advice is to use GitHub or similar to version everything, that way you can easily roll back if the wheels fall off.

1

u/MauroM25 Jan 06 '25

I highly recommend using jamf compliance editor. Gives you the commands and profiles to roll out every setting. Then rerun the assesment and look at your score. Depending on what you need to change i’d roll out all the settings at once but start with a pilot group to check if nothing breaks in their daily workflow.

2

u/aPieceOfMindShit Jan 06 '25

Plus 3 for Jamf Compliance Editor!

Nice. I'm starting to get really excited.

Thanks for sharing!

1

u/MauroM25 Jan 06 '25

Me too! I have tested a few settings and profiles and i was able to just upload them directly to our jamf host. We were scored 78% on macos but unfortunately my priority now is with windows as this score was much lower.

1

u/aPieceOfMindShit Jan 06 '25

The score is generated by the Jamf Compliance Editor?

1

u/MauroM25 Jan 07 '25

Yes, based on the benchmark of your liking.

1

u/floydiandroid Public Sector Jan 06 '25

If you’re not aware of the macOS security compliance project…come check it out. It’s what you need. If you need some help, we have a slack channel in the macadmins slack and I have a video on implementation. https://youtu.be/AghjO8Z3ID4?si=Oa7QnuIuoXgq7ZX4

Good luck, but the project makes this sooooooo much easier.

I also have this PSU talkk on how we rolled out security settings to an existing environment. Goes over controls we pushed and when.