Detections
Analytics
APPL-26-000005 - The macOS system must configure user session lock when a smart token is removed.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
The screen lock must be configured to initiate automatically when the smart token is removed from the system.Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of the information system but do not want to log out because of the temporary nature of their absences. While a session lock is not an acceptable substitute for logging out of an information system for longer periods of time, they prevent a malicious user from accessing the information system when a user has removed their smart token.
[IMPORTANT]
====
Information system security officers (ISSOs) may make the risk-based decision not to enforce a session lock when a smart token is removed to maintain necessary workflow capabilities, but they are advised to first fully weigh the potential risks posed to their organization.
====
Solution
Configure the macOS system to lock the user session when a smart token is removed by installing the "com.apple.security.smartcard" configuration profile.Note: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_26_V1R1_STIG.zip
Item Details
Audit Name: DISA Apple macOS 26 Tahoe STIG v1r1
References: CAT|II, CCI|CCI-000057, Rule-ID|SV-277031r1148545_rule, STIG-ID|APPL-26-000005, Vuln-ID|V-277031
Plugin: Unix
Control ID: 1c3d53d0445422e9d7cd6dc127af333872bd95f7844c2324d2c35b57e77abb85