Hardening a Mac.
WHAT TO ENABLE
Full disk encryption Automatic screen lock with a short timeout The firewall Automatic security updates The platform's malware protections, which are enabled by default
WHAT TO VERIFY
That system integrity protection is enabled.
WHY
Disabling it is occasionally suggested to solve problems, and it removes a major protection.
WHAT TO CONFIGURE
A standard account for daily use A separate administrator account A strong password, and a recorded recovery key
WHAT TO REVIEW
Login items and background definitions Installed profiles Privacy permissions granted Applications permitted to accept incoming connections
WHY PRIVACY PERMISSIONS SPECIFICALLY
Full disk access and accessibility control are powerful, and are frequently granted and forgotten.
WHAT TO REVOKE
Anything no longer needed.
WHAT TO BE CAUTIOUS OF
Software requesting accessibility control without a clear reason Profiles you did not install Certificates added to the trust store
WHAT TO DO ABOUT SECOND-HAND MACHINES
Erase and reinstall, rather than trusting the existing installation.
WHAT TO PLAN
Replacement of machines no longer receiving security updates.
