I Managed Macs for Years, But Never Hardened Them: CIS Benchmark with an MDM

I managed Macs for years without knowing whether they were really hardened. This is how I'm mapping the CIS Benchmark onto a fleet of company Macs with NIST mSCP and the Iru MDM, what the first check found, the gotchas, and how we plan the rollout.

Chapters

• 0:00 I Never Really Hardened Our Macs
• 0:43 The Before: Manual Macs in Latin America
• 1:33 SOC 2 Gave Goals, Not Settings
• 2:07 A New MDM and a Better Question
• 2:48 The CIS Benchmark I Didn't Know Existed
• 3:23 Level 1 vs Level 2
• 3:58 Think of a Restaurant Chain
• 4:30 Broad Goal vs Exact Setting
• 5:06 The Whole Chain in Motion
• 5:35 NIST mSCP Builds the Baseline
• 6:14 Blueprints and Library Items in Iru
• 6:44 The First Check: Basics Were On
• 7:12 Trap: We're Hardened, Right?
• 7:39 Gap One: Stealth Mode Was Off
• 8:05 In Iru: stealth mode
• 8:24 Gap Two: One Timeout, Two Places
• 8:53 In Iru: screen saver timeout
• 9:13 Gap Three: The Grace Period
• 9:39 In Iru: password after lock
• 9:56 Gap Four: On, But Not Enforced
• 10:26 Lesson: One Setting, One Home
• 10:54 Lesson: The Password Reset Trap
• 11:25 Lesson: One Benchmark per macOS Version
• 11:59 Lesson: One Mac Isn't the Fleet
• 12:27 Lesson: Hygiene Comes First
• 13:01 Trap: Turn Everything On at Once
• 13:30 Test in a VM With Snapshots
• 14:00 Pilot First, Then Waves
• 14:32 The Admin Rights Question
• 15:11 An Alert When a New Admin Appears
• 15:34 A DNS Firewall Blocks Bad Domains
• 16:07 What's Next: Still Exploring
• 16:38 Recap: Your Hardening Checklist

More courses and explainers on the Taistek YouTube channel. New videos every week.

Free download: get my SOC 2 checklist, study guides and ISO 27001 templates at taistek.com/free-resources.