Ana səhifə

Authors: Adam Gray cism


Yüklə 279 Kb.
səhifə5/11
tarix25.06.2016
ölçüsü279 Kb.
1   2   3   4   5   6   7   8   9   10   11

Desktop & Screen Saver


A screensaver with ‘require a password’ (as indicated in the Security section below) can prevent unauthorized access to the desktop. If you install Check Point Full Disk Encryption the screen saver for Check Point will automatically be enabled.


  • On the Screen Saver tab, select a screen saver that does not reveal information on or about the computer (for example, avoid Computer Name, Pictures Folder, or Choose Folder...) and leave Use random screen saver unchecked.

  • Set Start screen saver to 10 minutes or a value consistent with local policy.

  • Use Security System Preference Pane to require a password to wake from a screen saver (see below).

Security


For the FileVault section of the Security Preferences, refer to the Securing the System and the Data/Encrypting Home Folders section of this checklist.
To reduce the risk of unauthorized desktop or System Preferences access

  • Check Require password to wake this computer from sleep or screen saver.

  • Check Disable automatic login to require all users to authenticate before accessing the desktop.

  • Check Require password to unlock each System Preference pane.

  • Check Log out after 60 minutes of inactivity, substituting for 60 an appropriate number of minutes based on your local policy.

  • Check Use secure virtual memory to prevent tampering and unauthorized access to the memory space of running applications.

By default any infrared receiver can invoke the Front Row application on a Mac with infrared built in. On systems with infrared receivers, it is possible to reduce the risk of the system being controlled by unauthorized of infrared receivers, you should either use the Pair button of the Security System Preference to restrict the use of one infrared receiver that you have paired with the system. You can always unpair and switch receivers.



  • Check Disable remote control infrared receiver.

The Firewall tab of the Security System Preference pane lets you configure the Mac OS X built-in application level firewall but not the command line ipfw firewall that was used in Tiger and below. The firewall in Mac OS X 10.5 works using application signing. When you enable the firewall only signed applications are capable of communicating with hosts outside your system. By default all internal communications for Apple services are signed. Every application that is installed is signed and various attributes are tracked. By default the firewall is disabled.


Note: Mac OS X Server has an improved interface for configuring the firewall and/or ipfw. See the Mac OS X Server specific section for details. If you are using Mac OS X Server then the Firewall tab will not be present in the Sharing System Preference.
If you use the built-in Firewall tab in the Security System Preference pane:

  • Enable the firewall by choosing either the Allow only essential services (which enables only Apple services) or the Set access for Specific Services and Applications

  • If using specific services add third party packages to be allowed

  • Click on the Advanced button

  • Check the box for Enable Firewall Logging (if you want to log traffic)

  • Check the box for Enable Stealth Mode (if you do not want the system to respond on ports that are not opened).

Sandbox


The sandbox facility was added to Mac OS X 10.5 to help limit resources that a process has access to. Using sandbox you can implement Mandatory Access Controls, which allow you to limit what access that processes, sockets and threads have to files, folder, sockets, ports and memory. The sandbox facility can limit this access and provide a more granular approach to securing a system. Access to resources can now be doled out more granularly than can be within the confines of the POSIX file system.

  • Test and implement sandbox in your servers and images where appropriate.

Spotlight


Spotlight indexes files on Mac OS X to speed up searching. These indexes could be another way to find sensitive information on your computer. However, by disabling Spotlight you remove one of the more popular features of Mac OS X so be wary when doing so.

CDs & DVDs


Removable media may contain malware that, when automatically executed by the computer, infects or compromises it.

  • To prevent the computer from automatically running anything when a CD or DVD is inserted, change all settings to Ignore.

Energy Saver


Often an attacker will attempt to reboot a computer to change security settings or in hopes that existing security settings won’t be present on reboot.

  • Uncheck both Restart automatically options to disable two ways an attacker could have an effect on a reboot. These options could, however, result in a denial of service because the system will be down until an administrator is able to attend to it. System maintainers should weigh the risks of each and configure the settings accordingly.

To prevent an attacker from waking up a sleeping computer via the network or modem:



  • Uncheck both Wake Options.

It is easy to put a computer to sleep if you have physical access to the system. In data center environments this could result in an easy denial of service for users attempting to access web sites and other confidential material. To disable this feature:



  • Uncheck Allow power button to sleep the computer.

Print & Fax


By default no printers are shared. You can enable Printer sharing per printer. By default printer and fax sharing is disabled. To only share printers that are required:

  • Uncheck each printer that should not be shared.

The Mobile Me System Preference controls the computer’s ability to synchronize files or other content with a Mobile Me account. To avoid sharing data in this way:

  • Uncheck Synchronize with Mobile Me on the Sync pane and disable iDisk synchronization on the iDisk pane.

Your iDisk is synchronized with the Apple WebDAV servers. Many people use this option to transfer files. If you want to share files that are stored on your iDisk the permissions and access to these files can be set using the Mobile Me System Preference. To customize this:



  • Click on the iDisk tab of the Mobile Me System Preferences.

  • Check the box for Password protect your Public Folder.

  • Use the Set Password (looks like a key next to the password field) button to set a strong password.

  • Choose whether you want public users to have access to Read only or Read and Write data from the iDisk.

Note: If you have a Mobile Me account then you can download and use Apple’s Backup application to back files up to your Mobile Me account or another hard drive. This gives you a low cost backup solution that is capable of backing files up in a way that preservers their unique attributes. You can also use time machine to backup your important files to a local or wireless hard drive.


Back to My Mac is a service that allows the use of file sharing and screen sharing of your Mac from another Mac over the Internet or an internal network. This service should be disabled.
To disable this:

  • Click on the Back to My Mac tab of the Mobile Me System Preferences.

  • Check the stop button. It will prompt for your password enter the administrator name and password and click ok.

  • To customize this service if it is going to be run click on the Open Sharing Preferences button in the Back to My Mac tab of the Mobile Me System Preferences.

  • Choose the specific services you would like to share such as file sharing or screen sharing.

To customize this:



  • Click on the Back to My Mac tab of the Mobile Me System Preferences.

  • Check the stop button. It will prompt for your password enter the administrator name and password and click ok.

  • To customize this service if it is going to be run click on the Open Sharing Preferences button in the Back to My Mac tab of the Mobile Me System Preferences.

  • Choose the specific services you would like to share such as file sharing or screen sharing.
1   2   3   4   5   6   7   8   9   10   11


Verilənlər bazası müəlliflik hüququ ilə müdafiə olunur ©atelim.com 2016
rəhbərliyinə müraciət