Detections
Analytics

2.13 Audit Siri Settings

Information

With macOS 10.12 Sierra Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case.

In cases where sensitive and protected data is processed and Siri could help a user navigate their machine and expose that information it should be disabled. Siri does need to phone home to Apple so it should not be available from air-gapped networks as part of its requirements.

Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity.

For information on Apple's privacy policy for Siri, click here.

Rationale:

Where 'normal' user activity is already limited, Siri use should be controlled as well.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to set Siri to your organization's parameters:
Graphical Method:

Open System Preferences

Select Siri

Select the settings that are within your organization's requirements

Terminal Method:
Run the following commands to enable or disable Siri settings:

$ sudo -u <username> /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool <true/false>

$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool <true/false>

$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool <true/false>

$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool <true/false>

After running the default writes, the Windows Server needs to be restarted and the caches cleared. Run the following commands to perform that action:

$ sudo /usr/bin/killall -HUP cfprefsd

$ sudo /usr/bin/killall SystemUIServer




example:

$ sudo -u firstuser /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool true

$ sudo -u firstuser /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool true

$ sudo -u firstuser /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool false

$ sudo /usr/bin/killall -HUP cfprefsd

$ sudo /usr/bin/killall SystemUIServer

$ sudo -u seconduser /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool false

$ sudo /usr/bin/killall -HUP cfprefsd

$ sudo /usr/bin/killall SystemUIServer

$ sudo -u thirduser /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool false

$ sudo /usr/bin/killall -HUP cfprefsd

$ sudo /usr/bin/killall SystemUIServer

Profile Method:

Create or edit a configuration profile with the PayLoadType of com.apple.applicationaccess

Add the key allowAssistant

Set the key to </true> or </false> based on your organization's requirements

Note: Siri can only be enabled or disabled through configuration profiles. Any additional settings need to be set through the GUI of CLI

See Also

https://workbench.cisecurity.org/files/3569

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1, CSCv7|9.2

Plugin: Unix

Control ID: a501184d89cd01d32f6d82cf2e91006752981976f77fcf7ee950cecfb541e83a