2.7.2 Time Machine Volumes Are Encrypted

Information

One of the most important security tools for data protection on macOS is FileVault. With encryption in place it makes it difficult for an outside party to access your data if they get physical possession of the computer. One very large weakness in data protection with FileVault is the level of protection on backup volumes. If the internal drive is encrypted but the external backup volume that goes home in the same laptop bag is not it is self-defeating. Apple tries to make this mistake easily avoided by providing a checkbox to enable encryption when setting-up a time machine backup. Using this option does require some password management, particularly if a large drive is used with multiple computers. A unique complex password to unlock the drive can be stored in keychains on multiple systems for ease of use.

While some portable drives may contain non-sensitive data and encryption may make interoperability with other systems difficult backup volumes should be protected just like boot volumes.

Rationale:

Backup volumes need to be encrypted

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Perform the following to enable encryption on the TimeMachine drive:
Graphical Method:

Open System Preferences

Select Time Machine

Select Select Disk...

Select the existing TimeMachine backup drive from the Available Drive list

Set Encrypt backups

Select Use Disk

Note: You can set encryption through Disk Utility or diskutil in terminal.

See Also

https://workbench.cisecurity.org/files/3013

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28(1)

Plugin: Unix

Control ID: 0ad73fd3f4b425b79fd0352947db77d8b0e4215af5b5982f2767d94d3dabf00b