Detections
Analytics
2.10 Audit Siri Settings
Information
With macOS 10.12 Sierra, Apple has introduced Siri from iOS to macOS. While there are data spillage concerns with the use of data-gathering personal assistant software, the risk here does not seem greater in sending queries to Apple through Siri than in sending search terms in a browser to Google or Microsoft. While it is possible that Siri will be used for local actions rather than Internet searches, Siri could, in theory, tell Apple about confidential Programs and Projects that should not be revealed. This appears be a usage edge case.In cases where sensitive or protected data is processed and Siri could expose that information through assisting a user in navigating their machine, it should be disabled. Siri does need to phone home to Apple, so it should not be available from air-gapped networks as part of its requirements.
Most of the use case data published has shown that Siri is a tremendous time saver on iOS where multiple screens and menus need to be navigated through. Information like sports scores, weather, movie times, and simple to-do items on existing calendars can be easily found with Siri. None of the standard use cases should be more risky than already approved activity.
For information on Apple's privacy policy for Siri, click here.
Rationale:
Where 'normal' user activity is already limited, Siri use should be controlled as well.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Perform the following to set Siri to your organization's parameters:Graphical Method:
Open System Preferences
Select Siri
Select the settings that are within your organization's requirements
Select Show All
Select Accessibility
Select Siri
7 Select Enable Type to Siri to your organization's requirements
Terminal Method:
Run the following commands to enable or disable Siri settings:
$ sudo -u <username> /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool <true/false>
$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool <true/false>
$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool <true/false>
$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool <true/false>
$ sudo -u <username> /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool <true/false>
After running the default writes, the WindowServer needs to be restarted and the caches cleared. Run the following commands to perform that action:
$ sudo /usr/bin/killall -HUP cfprefsd
$ sudo /usr/bin/killall SystemUIServer
example:
$ sudo -u firstuser /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool true
$ sudo -u firstuser /usr/bin/defaults write com.apple.Siri.plist StatusMenuVisible -bool true
$ sudo -u firstuser /usr/bin/defaults write com.apple.Siri.plist LockscreenEnabled -bool false
$ sudo /usr/bin/killall -HUP cfprefsd
$ sudo /usr/bin/killall SystemUIServer
$ sudo -u seconduser /usr/bin/defaults write com.apple.assistant.support.plist 'Assistant Enabled' -bool false
$ sudo /usr/bin/killall -HUP cfprefsd
$ sudo /usr/bin/killall SystemUIServer
$ sudo -u thirduser /usr/bin/defaults write com.apple.Siri.plist VoiceTriggerUserEnabled -bool false
$ sudo -u thirduser /usr/bin/defaults write com.apple.Siri.plist TypeToSiriEnabled -bool false
$ sudo /usr/bin/killall -HUP cfprefsd
$ sudo /usr/bin/killall SystemUIServer
Profile Method:
Create or edit a configuration profile with the PayLoadType of com.apple.applicationaccess
Add the key allowAssistant
Set the key to <true/> or <false/> based on your organization's requirements
Note: Siri can only be enabled or disabled through configuration profiles. Any additional settings need to be set through the GUI or CLI.
See Also
Item Details
Audit Name: CIS Apple macOS 11 v2.1.0 L1
References: CSCv7|5.1, CSCv7|9.2
Plugin: Unix
Control ID: 5f4938469b217d023a3f31c220bfd314577f8547e3d5b99bf2e36040658bf7c1