Lesson 6: macOS Security Compliance Project Flashcards
(24 cards)
What is the macOS Security Compliance Project (mSCP)?
The mSCP is an open-source project on GitHub maintained by top IT security professionals.
What are the primary uses of the mSCP?
To create configuration profiles, compliance scripts, and guidance documentation.
Where can instructions for setting up and using the mSCP be found?
In the mSCP Wiki.
What are the prerequisites for using the mSCP?
Command line tools for Xcode, Python3 modules, and Ruby gems.
Which branch should you avoid working from in the mSCP?
The main branch.
What should you use instead of the main branch in the mSCP?
One of the OS-specific branches.
What built-in baselines can be used with mSCP?
CIS Benchmarks and custom-tailored baselines.
What script is used to create a tailored baseline in mSCP?
generate_baseline.py
What do the -k and -t options do in generate_baseline.py?
-k specifies the baseline; -t enables tailoring.
Where should configuration profile settings be deployed when possible?
Via Jamf Pro, rather than mSCP scripts.
What script generates signed configuration profiles and documentation?
generate_guidance.py
What file formats are generated by default with generate_guidance.py?
HTML and PDF guidance documentation.
What does the -p option in generate_guidance.py do?
Generates unsigned configuration profiles and corresponding plists.
What does the -H option in generate_guidance.py do?
Generates signed configuration profiles using the subject key ID.
What does the -l option in generate_guidance.py do?
Adds a custom branding image.
What does the -s option in generate_guidance.py do?
Generates a compliance script.
What does the -x option in generate_guidance.py do?
Generates documentation in .xls format.
How do you retrieve the subject key ID for signing certificates?
Use a Terminal command with security find-certificate and openssl asn1parse.
Can signed configuration profiles from mSCP be used in Jamf Pro?
Yes, they can be uploaded and deployed.
What is the purpose of the compliance script in mSCP?
To scan for and remediate noncompliant settings.
What do --check and --fix do in a Jamf Pro policy using the compliance script?
--check initiates a scan; --fix remediates non-compliant settings.
What option can be used to customize existing baselines when running the generate_baseline.py script?
-t
What is required to generate signed configuration profiles when running the generate_guidance.py script?
The -H option and the subject key ID of a signing certificate.
How can the compliance script be run on managed computers with a policy in Jamf Pro?
Use --check as parameter 4 to run a scan and --fix as parameter 5 to remediate noncompliant settings.
