Comment by throwaway8334 | Hacker News Reader

Comment by throwaway8334 | Hacker News Reader

You can get most of the way to hardening to CIS level 1 picking more up-to-date fork of these https://github.com/jamf/CIS-for-macOS-Catalina-CP.

FWIW, CIS level 1 will mean people get locked out of their machines very frequently. Complex 15 character passwords with 3 retries from memory. So you need a half-decent MDM to unlock quickly. There is no half-decent MDM out there. Only shit ones but workable like Jamf.

Also the username does't get auto-populated on login so the typo can be in username but the user assumes it is with password. Very fast way to get lock outs.

To pass a full security review you might want to play with Google Santa. But that is intense.

Also disabling things like AirDrop and biometric unlock is a productivity inhibitor.

Disabling Bonjour can cause strange problems for some people (e.g. using Reflector 4).

Basically I hate my mac that is hardened all the way so have a second machine (Mac Studio Ultra) in a more secure location that is less hardened and more pleasant to work with.

Couldn't you do something weird like have your mac be super hardened and then run a VM of OSX inside of that with more convenience features enabled?

Like using a jump box basically but with no external machine

> There is no half-decent MDM out there. Only shit ones but workable like Jamf.

Can you please elaborate? What problems would you pay to see solved in MDMs?

CIS benchmarks are guidelines and aren’t intended to be applied blindly. You should consider the benchmark as the optimal least permissive perspective and adjust to solve the problems you have.

Many of the folks who contribute to CIS come from .gov backgrounds and have a bias towards the compliance controls that state/local have to deal with. Note the word compliance vs. security. The password thing for example is driven by IRS Pub 1075 — most everyone else has moved on to more rational standards.

> no half-decent MDM out there. Only shit ones … like Jamf

Out of curiosity, have you looked beyond usual suspects such as JAMF or inTune to targeted solutions like https://mosyle.com/ or ultra straightforward like Apple’s new https://www.apple.com/business/essentials/ ?

// Your last comment is interesting, I think there’s a lot to be said for a dedicated trusted-work-only machine, with no email, no web browsing other than admin panels.

Santa isn’t that bad if your endpoints pretty much only run Chrome, which is a large swath of enterprises these days (not all of them of course).

mosyle is an ok MDM. Just ok, not great, but it works.

Reply on news.ycombinator.com