Detections
Analytics

2.6.1.1 Audit iCloud Keychain

Information

The iCloud keychain is Apple's password manager that works with macOS and iOS. The capability allows users to store passwords in either iOS or macOS for use in Safari on both platforms and other iOS-integrated applications. The most pervasive use is driven by iOS use rather than macOS. The passwords stored in a macOS keychain on an Enterprise-managed computer could be stored in Apple's cloud and then be available on a personal computer using the same account. The stored passwords could be for organizational as well as for personal accounts.

If passwords are no longer being used as organizational tokens, they are not in scope for iCloud keychain storage.

Rationale:

Ensure that the iCloud keychain is used consistently with organizational requirements.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.applicationaccess

The key to include is allowCloudKeychainSync

The key should be set <true/>, to allow iCloud keychain syncing, or <false/>, to disable it, based on your organization's requirements

Additional Information:

To verify individual users:

Audit:

Graphical Method:

Perform the following steps to verify the iCloud keychain sync service:

Open System Preferences

Select Apple ID

Select iCloud

Verify that Keychain is set to your organization's requirements

Terminal Method:

For each user, run this command to verify the iCloud keychain sync services:

$ /usr/bin/sudo -u <username> /usr/bin/defaults read /Users/<username>/Library/Preferences/MobileMeAccounts | grep -B 1 KEYCHAIN_SYNC

Enabled = <0,1>;

Name = 'KEYCHAIN_SYNC';

The output will be either a 0, disabled, or 1, enabled. Verify if the setting meets your organization's requirements

example:

$ /usr/bin/sudo -u seconduser /usr/bin/defaults read /Users/seconduser/Library/Preferences/MobileMeAccounts | grep -B 1 KEYCHAIN_SYNC

 Enabled = 0;

 Name = 'KEYCHAIN_SYNC';

or

Remediation:

Graphical Method:

Perform the following steps to set iCloud keychain sync based on your organization's requirements:

Open System Preferences

Select Apple ID

Select iCloud

Set Keychain to meet your organization's requirements

See Also

https://workbench.cisecurity.org/benchmarks/14563

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|AC-20(1), 800-53|AC-20(2), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1, CSCv7|9.2

Plugin: Unix

Control ID: 85d88a5c79b4d9596b3fe642f380a65868afcb0d4dab2d13f8af267920638b0d