lynis

> Apple is the only one that refuses to publish any dates. I don’t mean to defend Apple here, but one reason Apple may do that is because they essentially consider themselves a hardware company, and so the things they support are device models, not software versions. For me, a good-enough approximation has been that you can consider a macOS version [major dot minor] to be supported until the day [major dot (minor+1)] comes out, or the day [(major+3) dot 1] comes out, whichever happens earlier [1]. (Full disclosure: I’m the author of that merge request.) [1]: https://github.com/CISOfy/lynis/pull/1006

I'm surprised that lynis [i] isn't mentioned when it's a discussion about linux security hardening. A dead simple tool that covers a wide range of security considerations. [i] https://github.com/CISOfy/lynis

Hardening macOS https://blog.bejarano.io/hardening-macos.html Guide to Securing Apple OS X 10.10 Systems for IT Professionals: A NIST Security Configuration Checklist https://www.nist.gov/publications/guide-securing-apple-os-x-... Securing macOS in 2018 https://www.davd.eu/securing-macos/ Free OS X Security Tools https://objective-see.com/products.html Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems https://github.com/CISOfy/lynis

The sources I recall while writing this: - https://github.com/drduh/macOS-Security-and-Privacy-Guide - https://github.com/CISOfy/lynis - https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.s... - https://help.apple.com/machelp/mac/10.12/index.html#/mh11389 - http://newosxbook.com/files/moxii3/AppendixA.pdf Hope it helps!

It almost does all that you ask. There is a big downside of the toolkit: it is filled with abbreviations, XML files, and binaries. For that reason, I still develop an alternative project focused on Linux, macOS, and Unix-derivatives. It is named Lynis and was founded in 2007. GitHub link: https://github.com/CISOfy/lynis

You might like Lynis (https://github.com/CISOfy/lynis). A lightweight security scanner that can be integrated as well.

Someone submitted my security tool Lynis during Black Hat Europe: https://github.com/CISOfy/lynis (original link https://news.ycombinator.com/item?id=12870753). The result was a spike in GitHub stars, more users and feedback. So a great way to increase an open source project.

There are a few solutions for that. I worked on https://github.com/HewlettPackard/reconbf another popular one is https://github.com/CISOfy/lynis

* Project name: Lynis (https://github.com/CISOfy/lynis/), GPLv3 * Project description: security auditing tool for Linux, macOS, and UNIX-derivatives. The primary goal is to assist in security assessments and help with system hardening. Written in shell script and project is mature (almost 9 years). * Upcoming goals: More application specific tests (like MongoDB, Redis, Tomcat, nginx), so we can provide more value as a project. * Needed skills: application knowledge and able to write some basic shell script. * Contributors link: https://github.com/CISOfy/lynis/blob/master/CONTRIBUTIONS.md * Your license(s): GPLv3

At our company (CISOfy) we created a solution around our existing open source project Lynis (https://github.com/CISOfy/lynis). This way the tool in itself provides value, yet the separate Enterprise offering as well. Lynis itself is useful for a single system, yet companies might be attracted by Enterprise features (like collecting all data centrally, dashboards, reports, compliance reporting). A similar way might work for your web application, by making two different products, each with their own audience. My tip as founder: start testing the viability of your product/business first. Consider the reasons why people would or would not pay. Ask people in your field who might use it and if they would be willing to pay (and how much).