Scouring the web for a macOS analog of Windows Exploit Suggester - Next Generation (WES-NG) (mentioned recently), I stumbled onto Howard Oakley's Scanning your Macs for security problems with Nessus.
Agreeing wholeheartedly with his assessment ("Installation is a bit fiddly and left me with a feeling of discomfort. The installer which you download is but the start of the process: this eventually takes you through to the Nessus web interface, which then downloads further and unspecified packages and installs them somewhere. For a security tool this is worryingly opaque and obfuscated, and I cannot see any convincing reason for having to do it that way."), I opted to install Nessus in a virtualized instance of the target Mac and run it against just 127.0.0.1 to find known vulnerabilities.
As Howard observes, the Basic Network Scan is anything but:
While Nessus is focused on vulnerability scanning, Lynis offers a light-weight, installer-free option for system auditing and hardening:
# git clone https://github.com/CISOfy/lynis # cd lynis # ./lynis audit system
though its results were quite disappointing compared with Nessus, which correctly reported a slew of crticial issues that Lynis missed, like:
fort: "Audit and fix your Mac's security in one command. No agent, no signup, open source." Announced in r/macsysadmin & r/CLI.
macOS Security Compliance Project:
"The macOS Security Compliance Project (mSCP) is an open source effort to provide a programmatic approach to generating security guidance. The project can be used to output customized documentation, scripts (logging and remediation), configuration profiles, and an audit checklist based on the baseline used. It is authoritative through NIST Special Publication 800-219, Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)."
/mac | May 09, 2019