The macOS Application Firewall must be enabled.

From Apple OS X 10.13 Security Technical Implementation Guide

Associated with: CCI-000366

SV-96395r1_rule The macOS Application Firewall must be enabled.

Vulnerability discussion

The Application Firewall is the built-in firewall that comes with macOS and must be enabled. Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.

Check content

If an approved HBSS solution is installed, this is not applicable. To check if the macOS firewall has been enabled, run the following command: /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate If the result is "disabled", this is a finding.

Fix text

To enable the firewall, run the following command: /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.