MediumOS hardeningBLWK-MAC-005

Automatic security updates are off

What this means

macOS can install security responses and system data files (XProtect malware signatures among them) automatically. That's turned off, so protection against newly found malware arrives only when you update by hand.

How to fix it

In System Settings → General → Software Update → Automatic Updates, turn on Install Security Responses and system files.

Check it yourself

Run a scan and look for BLWK-MAC-005 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads macos_security and reports this check when:

security_updates_on_known == true and security_updates_on == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1562.001

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001