Mac security: patches, FileVault and access boundaries

Keep a Mac safer by installing patches, turning on FileVault and reviewing app permissions. Store the recovery key away from the Mac itself, and protect the Apple Account like any other primary account. Much of this is shared with iPhone; the Apple Account, Find My and Lockdown Mode are covered more fully in iPhone and iPad security. This page focuses on the Mac’s own paths: system updates, disk encryption, installing apps, permissions and the firewall.

Get patches from System Settings

A Mac update closes operating-system security holes and sometimes refreshes Safari and bundled tools as well. Get it from the system itself, not from an unknown installer file.

1. Go to System Settings > General > Software Update.
2. If a version is waiting, install it. The Mac should preferably be on power and a stable network; some installs need a restart.
3. Turn on automatic updates so downloads happen in the background and installation asks you or follows what that same screen is set to do.
4. After install, open the same screen and check that it says you are up to date.
5. Update App Store apps from the App Store itself. A program that came from outside has its own update path; check that too from time to time.

If the Mac is too old to get a new macOS, you have the same decision as on any other device: is it still a place for sensitive work? Keeping an unpatched version only because an old program still runs on it also connects that program to your network and accounts.

Understand FileVault together with the recovery key

FileVault encrypts the startup disk so that if a laptop is stolen while it is off or locked, removing the drive is not enough to read the files. Once you have signed in with your account, the files are open for that session; that is why the screen lock still matters separately.

1. Go to System Settings > Privacy & Security.
2. Turn on FileVault further down the page. The administrator account password will be required.
3. Choose a recovery method. If a recovery key is shown, write it down at that moment somewhere other than this Mac. If you accept recovery through the Apple Account, that account itself must be well protected.
4. Wait for the initial encryption to finish. Keep the laptop on power during this.
5. Do not leave the key only on the desktop or inside iCloud on the same device. Keep it in a password manager and on paper, away from the laptop.

Other users on the same Mac should each be able to unlock the disk with their own sign-in. Do not treat a guest account as a way around the lock. FileVault does not automatically cover an external disk; encrypt that separately if you move sensitive files on it.

The lock screen and signing in

1. Go to System Settings > Lock Screen.
2. Set the password requirement to immediately, or to the shortest time that is workable — not “never” and not after an hour.
3. In Users & Groups, turn off automatic login.
4. If someone sometimes uses your Mac, create a standard account for them, not an administrator account. You can do your own everyday work from a standard account too and only use an administrator for system changes.
5. Turn the guest account off if you do not need it, or if you leave it for visitors, make sure it cannot reach your files.

Unlocking with an Apple Watch is convenient; if the watch leaves your wrist, or you leave it unlocked on the table, that convenience weakens the same lock. A fingerprint is convenience too; you still need to know the account password and keep it separately.

Where you install software from

A Mac by default prefers apps from the App Store or from an identified developer. Habitually bypassing that layer with “Open Anyway” for every file sitting in Downloads makes the layer pointless.

1. Go to System Settings > Privacy & Security and, in the Security section, see that installs are allowed from the App Store and identified developers.
2. Get an app from the maker’s official site or the App Store, not from a button in the middle of an article.
3. If the system blocked a program and you know the source another way, use the Open Anyway notice on this same Privacy & Security page once and on purpose — do not make the right-click Open menu an everyday habit.
4. Do not install unknown “Mac cleaner” and optimizer packages; the Mac already runs its own security tools in the background, and those programs usually ask for more permissions than they add in protection.
5. If you use Homebrew or a similar tool to install command-line software, treat it as a separate install path and update both the tool and its packages. Do not copy a formula from a random page.

Review app permissions

On a Mac, Full Disk Access, Accessibility, Screen Recording and Input Monitoring are permissions that unwanted software is especially interested in. An ordinary notes app does not need them.

1. Go to System Settings > Privacy & Security.
2. Open Camera, Microphone, Location, Photos and Files and Folders one by one, and remove access for apps you no longer use.
3. Look more carefully at Full Disk Access, Accessibility, Input Monitoring and Screen Recording. Only a tool whose need you understand should be there; a known backup or assistive tool usually has a clear reason.
4. After you delete an app, check this list again; a permission is sometimes left behind.
5. If an app suddenly asks for Full Disk Access for a simple job, say no and look at its source again.

The firewall

1. Go to System Settings > Network and open Firewall. On some versions the same option appears under Network or in a section of its own.
2. Turn the firewall on.
3. Look at the further options: blocking all incoming connections is stricter for a travel laptop and will break some sharing. The balanced mode is to allow specific apps.
4. If you have turned on file or screen sharing, review that under General or Sharing settings and do not leave it on an unknown network.

Find My Mac and the Apple Account on a Mac

1. Go to System Settings > [your name] > iCloud.
2. Find Find My Mac; it may be under See All. Turn it on so that Activation Lock is also applied on supported hardware.
3. If the Mac is lost, mark it as lost from Find My on another device or from the official website, and do not remove it from the list.
4. Review Apple Account sign-in and security, connected devices and the recovery method from this same System Settings pane or from an iPhone. Creating a recovery key and Advanced Data Protection are described in the iPhone guide; on a Mac they change the same account.
5. Do not make the Apple Account password the same as the Mac login password.

Lockdown Mode on a Mac

If you have a real reason to think you may be targeted with a sophisticated tool, turn Lockdown Mode on for the Mac separately from the iPhone. Most people do not need it.

1. Update all of your Apple devices.
2. Go to System Settings > Privacy & Security > Lockdown Mode.
3. Turn it on, confirm, then choose turn on and restart and enter the login password.
4. After the restart, if a site you need for essential work breaks, you can exclude that site in Safari; every exclusion reduces protection.

AirDrop, Handoff and a cloud desktop folder

1. Go to System Settings > General > AirDrop & Handoff.
2. Set AirDrop to Contacts Only or Receiving Off, not to Everyone, except for a few specific minutes.
3. If you sync Desktop and Documents with iCloud, remember that a deletion in one place can follow you elsewhere, and that an open sensitive file can go to the cloud from there. For a highly sensitive document use a separate layer and the file-storage guide.
4. Handoff and the continuity clipboard are convenient between devices on the same account; on a shared Mac, that means what you copied on the iPhone may be available here.

Startup security on Apple silicon Macs

Macs with Apple chips can show the startup security level in Recovery. Full Security makes it harder to load an unverified operating system. Reducing it is sometimes suggested in order to install another system.

1. If you need this setting, start the Mac in Recovery and open Startup Security Utility from the Utilities menu.
2. Keep Full Security unless you have a clear reason not to.
3. When you finish, put it back to the stricter state.
4. Do not use an unknown flash drive as an everyday system.

Before selling, giving away or leaving a Mac for repair

1. Take a backup; Time Machine or another method from the backup guide.
2. If FileVault is on, have the recovery key to hand so you are not stuck mid-erase.
3. From System Settings, sign out of the Apple Account and erase content through the official transfer or reset path so Activation Lock does not remain for the next owner.
4. Before you hand it over, turn the Mac on and check that the setup assistant appears.
5. For a repair, if you are not erasing the device, keep the lock and do not turn off Find My without reading the official repair path.

Common mistakes

• Leaving FileVault off on a laptop that moves every day.
• Keeping the only copy of the recovery key on that same Mac.
• Making “Open Anyway” a habit for every downloaded file.
• Giving Full Disk Access to every tool that asks.
• Sharing one Apple Account among several people on one Mac without separate user accounts.
• Leaving an update uninstalled because “this is not a good time to restart”, and letting that go on for weeks.

Sharing and remote sign-in

A Mac can open files, the screen and a command line to the network. On a laptop you carry around, leaving these on without needing them widens the attack surface.

1. Go to System Settings > General > Sharing.
2. Turn off File Sharing, Screen Sharing, Remote Management and Remote Login (ssh) if you do not use them.
3. If remote login is needed, allow only a specific user and keep it on a limited network, not on every hotel Wi-Fi.
4. If the Mac’s name is visible on public networks, change it to something that does not announce who owns it or where they work.

Do not turn off System Integrity Protection

System Integrity Protection stops even an administrator account from changing sensitive parts of the operating system. Some old how-tos tell you to turn it off in Recovery with a command in order to install a particular tool. That removes an important layer and is not usually needed for everyday use. If you ever have to, turn it back on when you finish and understand why it was required. The same logic applies to lowering startup security.

Management profiles and certificates

As on iPhone, a configuration profile can add settings and certificates to a Mac. If you do not belong to an organisation that should manage the Mac, such a profile is a question mark.

1. In System Settings, open the device management or profiles section; on newer versions it is often under Privacy & Security or General.
2. Remove an unfamiliar profile.
3. If you cannot remove it, get help through Apple’s official support path or that organisation, not from a tool that arrived in a message.

The account recovery key and Advanced Data Protection on a Mac

The paths on a Mac differ a little from iPhone, but they change the same account.

1. Go to System Settings > [your name] > Sign-In & Security.
2. Review two-factor authentication, trusted numbers and the device list.
3. If you create a recovery key, open Recovery Key from this same Sign-In & Security section, write the key on paper and confirm it. Do not store it in iCloud Drive or in the passwords of that same account.
4. For Advanced Data Protection, go to System Settings > [your name] > iCloud > Advanced Data Protection and turn it on only after you have stored a recovery method separately.
5. What this layer means, and its limits, are in the iPhone guide; on a Mac you apply the same decision to the whole account.

Encrypt Time Machine

An unencrypted backup on a disk that stays plugged into the Mac hands over everything together if that bag is stolen.

1. Go to System Settings > General > Time Machine.
2. Add the backup disk and turn on backup encryption.
3. Keep that disk’s passphrase somewhere other than the Mac itself.
4. After the first copy, unplug the disk if you are travelling so that one theft does not take both.
5. Restore one file as a test; more detail is in the backup guide.

Know Recovery before you need it

Some tasks, including Startup Security Utility or a reinstall, require Recovery. On Apple silicon Macs you usually enter it by holding the power button until startup options appear. On Intel Macs the key combination is different. Read the official path for your model once so that on the day the screen will not come up you are not hunting through a random tutorial. Do not use Recovery to turn protections off without a reason.

If you forget the login password or FileVault

If FileVault is on and you do not know the login password, the way back is the recovery key or the Apple Account you chose when you turned it on. Without those, the content is effectively gone. Take that seriously before you forget, not after. Tools that claim to unlock a Mac without the key are either false or unsafe themselves. If you have only forgotten the login password and you still have the key, use that key according to Apple’s official guidance.

Notifications and cracked software

A notification preview on the Mac lock screen also shows the first line of a message. Reduce previews for sensitive apps in notification settings. Installing abandoned software, serial generators and a “full free version” is still a common way malware arrives on a Mac. If you need the program, buy it from its maker or get a free alternative from an official source, not from a dmg file on a forum.

An encrypted disk image for a set of files

If you want to move several documents together, the Mac’s own Disk Utility can create an encrypted disk image. That is a file layer, not a substitute for FileVault.

1. Open Disk Utility.
2. Create a new image, choose strong encryption and set a long passphrase.
3. After you fill it, eject the image and open it once to test that it works.
4. If you send the image to someone, send the passphrase on another channel.
5. Do not leave plaintext copies of the files on the desktop.

Login items and background items

Malware on a Mac often puts itself in a list that runs automatically when you sign in. The system itself has a place to see those items.

1. Go to System Settings > General > Login Items & Extensions. On some versions the title is only Login Items.
2. Review the programs that open at sign-in and remove any name you do not recognise.
3. Look at background items as well: permission for a program to run in the background should have a clear reason.
4. After you install a new app, open this screen once more; many tools add themselves there without a clear explanation.
5. If something you removed comes back, delete that app from the Applications folder and remember where you installed it from.

AirPlay and a hot corner to lock

A Mac can act as an AirPlay receiver. On a shared network that means other people may be able to send content to the screen unless you have limited it.

1. Go to System Settings > General > AirDrop & Handoff.
2. Turn the AirPlay receiver off if you do not need it, or set it to require a password or to allow only devices on the same account.
3. For a quick lock, you can set a hot corner in desktop and dock settings, or from the lock screen settings, so that moving the pointer into one corner locks the screen. Practise it once.

Rapid Security Responses and how the login password relates to FileVault

Besides a large system update, Apple sometimes publishes a Rapid Security Response that closes a hole without a full operating-system install. On the same Software Update screen, check that these responses are installed automatically too. Declining them without a reason delays that same urgent patch.

On a Mac the login password usually unlocks FileVault as well. That means a weak login password also weakens the disk layer. Make the password long and not reused, and do not make it the same as the Apple Account password. If several accounts exist on a FileVault-protected Mac, each user unlocks the system with their own password; a user without a password effectively has no access to the disk while it is off.

Review installed applications from time to time

1. Open the Applications folder and move tools you do not recognise, or no longer want, to the Trash.
2. Delete the app fully from there, rather than only removing its icon from the Dock.
3. After deletion, check privacy permissions and login items again.
4. Keep Safari and other browsers updated from their official paths; everyday browsing habits are in the safer-browsing guide.

If the Mac is lost

The path is like the iPhone: as soon as you can, mark the Mac as lost in Find My from another device on the same account, and do not remove it from the list so that Activation Lock remains. Review the Apple Account password from a healthy device. If FileVault was already on, someone who picked up a powered-off machine cannot read the files; if there was only a screen lock and FileVault was off, removing the drive may be enough. Take that as a lesson for the next device after an incident, rather than hunting for a miracle tool now.

Passwords on the Mac itself

The Passwords app or iCloud Keychain can store site passwords. That is convenient provided the Mac has a lock and the Apple Account is well protected. It is better to keep really important passwords in a manager that has a separate export; choosing that tool is covered in the password-manager guide. Treat autofill cautiously on a shared Mac, and sign out or switch user before you leave the desk.

Location Services on a Mac

A Mac can also give location to apps. Most desktop work does not need that.

1. Go to System Settings > Privacy & Security > Location Services.
2. Review the apps that receive location and turn off any that do not need it.
3. Glance at System Services too if the list is there; do not turn off something you do not recognise without a reason, but judge a third-party app separately. Find My Mac itself needs Location Services; do not turn the master switch off if you want to find a lost Mac.

What to do from today

1. Install Software Update and turn on automatic updates.
2. Check FileVault and keep the recovery key somewhere else.
3. Make the lock screen immediate and turn off automatic login.
4. Review Full Disk Access, Accessibility and Screen Recording permissions.
5. Turn on the firewall and Find My Mac, and limit AirDrop.