Tom Bridge tbridge

Continuous Monitoring in OS X Systems and Security

Dan Griggs, cmdSecurity

Compromise of the device in inevitable. We lock down devices, we break things for our users, we forbid them certain rights, and yet it still gets broken.

Continuous Monitoring is necessary if breakage is inevitable. State change and state monitoring is critical. Define what is most sensitive about a system, lock down access to those components. Moderately secure the rest of the system for UX improvements.

Watch for the vulnerability's end result, not the vulnerability.

##El Capitan Applications Issues##

El Capitan has incompatible Applications List: /System/Library/PrivateFrameworks/SystemMigration.framework/Resources/MigrationIncompatibleApplicationsList.plist (Rich Trouton)

VMware View - 3.4.1 works in El Capitan (JHUAPL & AnswerWare)

IBMNotes - does not work in El Capitan - "fix coming in the autumn" (Jennifer Unger)

Wi-Fi/802.1X - Make sure you have Diffie Hellman keys with a group size of 2048 bits or LARGER, otherwise things may be problematic in iOS 9 & El Cap

	#!/bin/bash

	# This script is designed to evaluate a current ManagedInstalls.plist file, then make changes to the specified key. The script will then log a success message to a Slack webhook.

	MPL="/Library/Preferences/ManagedInstalls.plist"
	DEFAULTS="/usr/bin/defaults"
	PREFSTOCHECK=()
	SHOULDBE=()
	CHANGED=()
	DIDSET=()

	#!/bin/bash

	# v 0.9, released January 28th, 2017

	# This script is designed to evaluate a current ManagedInstalls.plist file, then make a change to the specified key. The script will then log a success message to a Slack webhook.
	# Original Script authored by Tom Bridge, with advice from Richard Purves, Ben Toms and others.
	# You will need to supply your own preference keys to check, as well as preferred values.
	# Make sure to get your own Slack Web Hook URL from the Customizations and Apps section of your Slack Control Panel.

	# Copyright 2017 Tom Bridge, Technolutionary LLC