The OS X system must restrict the ability of individuals to use USB storage devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76101	AOSX-12-000850	SV-90789r1_rule		Medium

Description
External hard drives, such as USB, must be disabled for users. USB hard drives are a potential vector for malware and can be used to exfiltrate sensitive data if an approved data-loss prevention (DLP) solution is not installed.

STIG	Date
Apple OS X 10.12 Security Technical Implementation Guide	2018-12-24

Details

Check Text ( C-75785r1_chk )
If an approved HBSS DCM/DLP solution is installed, this is not applicable. To verify external USB drives are disabled, run the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -A 3 harddisk-external If the option "eject,alert" is not set for "harddisk-external", this is a finding.

Fix Text (F-82739r1_fix)
This setting is enforced using the "Restrictions Policy" configuration profile.