End-of-life - Systems running vendor-supported software¶
Description¶
Ensure that systems are not running end-of-life, unsuported or unpatchable software.
How we measure it¶
Find all Macs managed by Kandji that checked in within the last 30 days and match their macOS version to its release cycle on https://endoflife.date/. Macs are considered compliant if their macOS release is still supported. Windows and installed applications are not covered yet.
Meta Data¶
| Attribute | Value |
|---|---|
| Metric id | vm_eol_software |
| Category | Vulnerability Management |
| SLO | 90.00% - 95.00% |
| Weight | 0.8 |
| Type |  |
References¶
| Framework | Ref | Domain | Control |
|---|---|---|---|
| ISO 27001:2022 | A.8.8 | 8 Technological controls | Management of technical vulnerabilities |
| CIS 8.1 | 2.2 | Inventory and Control of Software Assets | Ensure Authorized Software is Currently Supported |
| NIST CSF v2.0 | ID.AM-08 | Asset Management (ID.AM) | ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles |
| Essential8-ML3 | ISM-0304 | Patch applications | Applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. |
| Essential8-ML1 | ISM-1704 | Patch applications | Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. |
| Essential8-ML2 | ISM-1704 | Patch applications | Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. |
| Essential8-ML3 | ISM-1704 | Patch applications | Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed. |
| Essential8-ML1 | ISM-1905 | Patch applications | Online services that are no longer supported by vendors are removed. |
| Essential8-ML2 | ISM-1905 | Patch applications | Online services that are no longer supported by vendors are removed. |
| Essential8-ML3 | ISM-1905 | Patch applications | Online services that are no longer supported by vendors are removed. |
| Essential8-ML3 | ISM-1407 | Patch operating systems | The latest release, or the previous release, of operating systems are used. |
| Essential8-ML1 | ISM-1501 | Patch operating systems | Operating systems that are no longer supported by vendors are replaced. |
| Essential8-ML2 | ISM-1501 | Patch operating systems | Operating systems that are no longer supported by vendors are replaced. |
| Essential8-ML3 | ISM-1501 | Patch operating systems | Operating systems that are no longer supported by vendors are replaced. |
Code¶
WITH macs AS (
SELECT details.device_name || ' (' || details.serial_number || ')' AS device_name, details.os_version
FROM {{ ref('kandji_device_details') }} AS details
JOIN {{ ref('kandji_devices') }} AS devices ON devices.device_id = details.device_id
WHERE details.platform = 'Mac'
AND NOT devices.is_missing AND NOT devices.is_removed
AND CURRENT_DATE - CAST(devices.last_check_in AS DATE) <= 30
),
cycles AS (
SELECT cycle, label, is_eol, eol_from
FROM {{ ref('endoflife_cycles') }}
WHERE product = 'macos'
)
SELECT
macs.device_name AS resource,
'host' AS resource_type,
CASE WHEN cycles.cycle IS NOT NULL AND NOT coalesce(cycles.is_eol, false) THEN 1 ELSE 0 END AS compliance,
CASE
WHEN cycles.cycle IS NULL THEN 'macOS ' || macs.os_version || ' not found on endoflife.date'
WHEN cycles.is_eol THEN cycles.label || ' (' || macs.os_version || ') end of life since ' || CAST(CAST(cycles.eol_from AS DATE) AS VARCHAR)
ELSE cycles.label || ' (' || macs.os_version || ') supported'
END AS detail
FROM macs
LEFT JOIN cycles
ON macs.os_version = cycles.cycle OR macs.os_version LIKE cycles.cycle || '.%'