Detections
Analytics

2.13 Review Siri Settings

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

With macOS 10.12 Sierra Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case.

In cases where sensitive and protected data is processed and Siri could help a user navigate their machine and expose that information it should be disabled. Siri does need to phone home to Apple so it should not be available from air-gapped networks as part of its requirements.

Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity.

For information on Apple's privacy policy for Siri, click here.

Rationale:

Where 'normal' user activity is already limited, Siri use should be controlled as well.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to set Siri to your organizations parameters:
Graphical Method:

Open System Preferences

Select Siri

Select the settings that are within your organization's parameters

Terminal Method:
Run the following commands to enable or disable Siri settings:

$ sudo -u <username> defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool <true/false>

$ sudo -u <username> defaults write com.apple.Siri.plist LockscreenEnabled -bool <true/false>

$ sudo -u <username> defaults write com.apple.Siri.plist StatusMenuVisible -bool <true/false>

$ sudo -u <username> defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool <true/false>

After running the default writes, the Windows Server needs to be restarted and the caches cleared. Run the following commands to perform that action:

$ sudo killall -HUP cfprefsd

$ sudo killall SystemUIServer

example:

$ sudo -u firstuser defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool true

$ sudo -u firstuser defaults write com.apple.Siri.plist StatusMenuVisible -bool true

$ sudo -u firstuser defaults write com.apple.Siri.plist LockscreenEnabled -bool false

$ sudo killall -HUP cfprefsd

$ sudo killall SystemUIServer

$ sudo -u seconduser defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool false

$ sudo killall -HUP cfprefsd

$ sudo killall SystemUIServer

$ sudo -u thirduser defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool false

$ sudo killall -HUP cfprefsd

$ sudo killall SystemUIServer

See Also

https://workbench.cisecurity.org/files/3193

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5

Plugin: Unix

Control ID: a2f55e805365f0427e5ae84ac1ee9a950459cb5eb35fba4e0c80a44efd72d739