2.5.1.1 Ensure FileVault Is Enabled

Information

FileVault secures a system's data by automatically encrypting its boot volume and requiring a password or recovery key to access it.

Filevault may also be enabled using command line using the fdesetup command. To use this functionality, consult the Der Flounder blog for more details:

https://derflounder.wordpress.com/2015/02/02/managing-yosemites-filevault-2-with-fdesetup/ https://derflounder.wordpress.com/2019/01/15/unlock-or-decrypt-your-filevault-encrypted-boot-drive-from-the-command-line-on-macos-mojave/

Rationale:

Encrypting sensitive data minimizes the likelihood of unauthorized users gaining access to it.

Impact:

Mounting a FileVaulted volume from an alternate boot source will require a valid password to decrypt it.

Solution

Perform the following to enable FileVault:
Graphical Method:

Open System Preferences

Select Security & Privacy

Select FileVault

Select Turn on FileVault

Additional Information:

FileVault may not be desirable on a virtual OS. As long as the hypervisor and file storage are encrypted the virtual OS does not need to be. Rather than checking if the OS is virtual and passing the control regardless of the encryption of the host system the normal check will be run. Security officials can evaluate the comprehensive controls outside of the OS being tested.

See Also

https://workbench.cisecurity.org/files/3573