CCE-91419-2Platform: cpe:/o:apple:mac_os_x:10.11 | Date: (C)2018-02-22 (M)2023-07-04 |
Set Trash to Securely Erase Items
Finder must be configured to always empty Trash securely in order to prevent data recovery tools from accessing the deleted files. Files emptied from the Trash by normal means are still present on the hard drive and can be recovered up until the moment the system overwrites that particular location on disk. A malicious user with physical access to a system could take advantage of this property to access potentially sensitive files that the normal system owner or user assumed were safely deleted. Configuring Finder to always empty trash securely mitigates this risk.
Parameter:
[yes/no]
Technical Mechanism:
To check that the finder will only present the option to securely empty trash run the following command as the primary user:
system_profiler SPConfigurationProfileDataType | grep EmptyTrashSecurely
If 'EmptyTrashSecurely' is not set to '1' or there is no result, this is a finding.
CCSS Severity: | CCSS Metrics: |
CCSS Score : 6.2 | Attack Vector: LOCAL |
Exploit Score: 2.5 | Attack Complexity: LOW |
Impact Score: 3.6 | Privileges Required: NONE |
Severity: MEDIUM | User Interaction: NONE |
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Scope: UNCHANGED |
| Confidentiality: HIGH |
| Integrity: NONE |
| Availability: NONE |
| |
References: Resource Id | Reference |
---|
SCAP Repo OVAL Definition | oval:org.secpod.oval:def:44005 |