3

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which can't be disabled by the person using the computer.

The only mobile computers we have which that requirement applies to belong to our system administrators, and they're all Macs. (This is apparently trivial in Windows -- pretty much every endpoint protection solution implements it.) Since they're sysadmins, they've got admin access to their Mac.

I've had a couple of endpoint protection vendors promise me a solution only to fall through when we tried it out (in particular, Symantec), and now I'm stuck.

Does anyone know of something that will meet this requirement in OS X (personal firewall software which can't be modified by the end-user, even when the user has admin access)?

1
  • So you're looking for a GPO for OSX? Aug 16, 2013 at 20:24

5 Answers 5

1

We have implemented Managed Preferences using MacOS Server and Open Directory to address this point for general users. The key problem is that this cannot block users with local admin access. Nothing can. The only real answer is your users should not have local admin privs for their day-to-day work, especially on a mobile device, if they want live by the letter of the PCI-DSS standard.

Yes, an sysadmin is a sysadmin and she should have the access rights to do her job. The standard implies that this just should not be done from a mobile device. We always challenge the developer or user that claims "I need admin access to run X software." Almost always, they don't. The software supplier is often lazy and just suggest root access to make it easy for them. They don't really care about your security practices. With proper analysis of least required privs, you can have non-root users do all they need without sysadmin access.

This gets a bit off your direct question, but we are pursuing card info tokenization with our payment gateway so we won't have the PCI requirement. Another option is to segregate your mobile device network access so one could be an admin on their local but just not have access to card processing systems. Finally, we've also built server-based VMs or Terminal Services hosts that provide the access needed and not have sysadmin access on the users local host.

Hope that helps.

0

You could try implementing NAC and a proxy which would trump anything an admin would set since it is set on the egress point (before they get out). There is an alternative called "WaterRoof" however, since you gave your users admin privileges, it defeats the purpose. A work-around would be to script specific rules, and check it through cron constantly flushing and restarting rules. Not optimal on large networks.

Another kludge, would be to create a de-facto ruleset, using cron, have those machines download and run them. This would alleviate having to touch each machine to implement them (the rules), but again, since your users are admins, they could just flush the rules.

Had I to do this, I'd send them through either NAC or a proxy to ensure no matter what, they were going through the rules I pre-defined for them.

0

Even if you disable their account from being able to disable their anti-virus software then they would be able to reenable it. Unless your department is big enough for a separation of duties structure (thus limited access to their specific job function) then this wouldn’t be able to be done that well. You should be able to fill out the form explaining why this is an acceptable risk.

0

I am a total outsider to these questions. I must not see where the problem really is. The company should own the Mac and have the owner account. The employee should have permissions to do almost everything except to interfere with the firewall and its settings. (Mac OS X is basically Unix.)

Unfortunately the employees could use systems disks to wipe out the original system with its permissions and create a new system with themselves as owner. They could then install and set up a firewall with their own settings.

Therefore, when accessing the mainframe system and its card data from outside, the mainframe should not only demand a password but should also interrogate the user's firewall to determine that it is operating as intended by your company. Just making the firewall theoretically impossible to remove is not enough. Router software is actually programmed by accessing it as though it were a remote computer, so the technology by which a mainframe-based interrogator could read the settings of a wirewall should be easy to make. The question is whether any of the firewalls have this feature.

Just curious: What provision has been made to prevent data loss by theft of the Mac computers? It seems to me that sensitive data should only exist in RAM on portable computers. If it is stored it should be stored on the mainframe. The potential for unencrypted storage anywhere away from a protected site is asking for trouble.

0

According to a blog post on 'Trusted BSD', a framework which OSX implements, a Mandatory Access Control (MAC) approach might work. The post seems to indicate that the system will require users attempting to access the resource (unprivileged and admin alike), to have certain associated security attributes.

With this framework, there may be a way to prevent access from users with local admin, or at least make access more difficult than sudo to add your user to a local group. The framework provides an implementer:

  • Control over launching the processes and switching the process into debug mode
  • Filtering of work with file system
  • Filtering of network activity
  • and others

With just the first two of these OS-enforced capabilities, you can go a long way toward enforcing the security you require.


The post indicates that implementing the TrustedBSD interface only requires you to define a few callback functions, and provides some snippets for getting started. It may be worth playing with the author's demo to learn about what OSX can enforce (and what a vender...if you ever find one...could even promise).

[1]:

So in case of MAC, no matter whether a regular user or an administrator attempts to access the resource, there is a fine option to restrict such attempt and terminate it if necessary.

In response to points from Tim O'Tie's answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .