Detections
Analytics

2.9.1.1 Ensure the OS Is Not Active When Resuming from Standby (Intel)

Information

In order to use a computer with Full Disk Encryption (FDE), macOS must keep encryption keys in memory to allow the use of the disk that has been FileVault protected. The storage volume has been unlocked and acts as if it were not encrypted. When the system is not in use, the volume is protected through encryption. When the system is sleeping and available to quickly resume, the encryption keys remain in memory.

https://www.helpnetsecurity.com/2018/08/20/laptop-sleep-security/

Mac systems should be set to hibernate after sleeping for a risk-acceptable time period. The default value for "standbydelay" is three hours (10800 seconds). This value is likely appropriate for most desktops. If Mac desktops are deployed in unmonitored, less physically secure areas with confidential data, this value might be adjusted. The desktop would have to retain power, however, so that the running OS or physical RAM could be attacked.

MacBooks should be set so that the standbydelay is 15 minutes (900 seconds) or less. This setting should allow laptop users in most cases to stay within physically secured areas while going to a conference room, auditorium, or other internal location without having to unlock the encryption. When the user goes home at night, the laptop will auto-hibernate after 15 minutes and require the FileVault password to unlock prior to logging back into the system when it resumes.

MacBooks should also be set to a hibernate mode that removes power from the RAM. This will stop the possibility of cold boot attacks on the system.

Macs running Apple silicon chips, rather than Intel chips, do not require the same configuration as Intel-based Macs.

To mitigate the risk of data loss, the system should power down and lock the encrypted drive after a specified time. Laptops should hibernate 15 minutes or less after sleeping.

Solution

Terminal Method:

Run the following command to set the hibernate delays and to ensure the FileVault keys are set to be destroyed on standby:

% /usr/bin/sudo /usr/bin/pmset -a standbydelaylow <value<=900>
% /usr/bin/sudo /usr/bin/pmset -a standbydelayhigh <value<=900>
% /usr/bin/sudo /usr/bin/pmset -a highstandbythreshold <value>=90>
% /usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1
% /usr/bin/sudo /usr/bin/pmset -a hibernatemode 25

example

:

% /usr/bin/sudo /usr/bin/pmset -a standbydelaylow 500
% /usr/bin/sudo /usr/bin/pmset -a standbydelayhigh 500
% /usr/bin/sudo /usr/bin/pmset -a highstandbythreshold 100
% /usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1
% /usr/bin/sudo /usr/bin/pmset -a hibernatemode 25

Impact:

The laptop will take additional time to resume normal operation if only sleeping rather than hibernating.

Setting hibernatemode to 25 will disable the "always-on" feature of the Apple Silicon Macs.

See Also

https://workbench.cisecurity.org/benchmarks/18636

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|16.11

Plugin: Unix

Control ID: 9236e5c66794d603362dcf290424def3f59dc40a25990dc735f7e35de9562016