# Security Checks Reference

## SIP (System Integrity Protection)
- **Check**: `csrutil status`
- **Expected**: "System Integrity Protection status: enabled."
- **Remediation**: Reboot to Recovery Mode (Cmd+R), open Terminal, run `csrutil enable`
- **Severity**: Critical if disabled

## Gatekeeper
- **Check**: `spctl --status`
- **Expected**: "assessments enabled"
- **Remediation**: `sudo spctl --master-enable`
- **Severity**: Critical if disabled

## Firewall
- **Check**: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`
- **Fallback**: `defaults read /Library/Preferences/com.apple.alf globalstate` (0=off, 1=on, 2=essential)
- **Remediation**: System Settings > Network > Firewall > Turn On
- **Severity**: Critical if disabled

## FileVault
- **Check**: `fdesetup status`
- **Expected**: "FileVault is On."
- **Remediation**: System Settings > Privacy & Security > FileVault > Turn On
- **Severity**: Critical if disabled (disk not encrypted)

## Open Ports
- **Check**: `lsof -iTCP -sTCP:LISTEN -nP`
- **Review**: unexpected services listening on all interfaces (0.0.0.0 or *)
- **Severity**: Info (review needed, not automatically bad)

## SSH Configuration
- **Check**: `/etc/ssh/sshd_config`
- **Flags**: `PasswordAuthentication yes`, `PermitRootLogin yes`
- **Remediation**: Set to `no` and restart sshd
- **Severity**: Warning

## Remote Services
- **Remote Login**: `systemsetup -getremotelogin`
- **Remote Management**: `defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers`
- **Remediation**: Disable in System Settings > General > Sharing
- **Severity**: Info/Warning depending on context

## Software Updates
- **Check**: `softwareupdate -l` (can be slow, 30s timeout)
- **Remediation**: System Settings > General > Software Update
- **Severity**: Warning if updates available

## Screen Lock
- **Check**: `defaults -currentHost read com.apple.screensaver idleTime`
- **Check**: `defaults read com.apple.screensaver askForPassword`
- **Remediation**: System Settings > Lock Screen
- **Severity**: Warning if password not required