← Back to Apple macOS 13 (Ventura) Security Technical Implementation Guide

V-257245

CAT III (Low)

The macOS system must restrict the ability of individuals to write to external optical media.

Rule ID

SV-257245r991589_rule

STIG

Apple macOS 13 (Ventura) Security Technical Implementation Guide

Version

V1R5

CCIs

CCI-000366

Discussion

External writeable media devices must be disabled for users. External optical media devices can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed.

Check Content

Verify the macOS system is configured to disable writing to external optical media devices with the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep "BurnSupport"

BurnSupport = off;

If "BurnSupport" is not set to "off" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Fix Text

Configure the macOS system to disable writing to external optical media devices by installing the "Restrictions Policy" configuration profile.