macOS Hardening

For a long time, macOS had a reputation of being “more secure” than Windows. Some of that is earned, macOS has solid built-in security features. But a lot of it is survivorship bias from when Macs were a smaller target. That’s no longer the case: corporate Mac fleets are large, macOS malware is growing, and threat actors increasingly target Apple platforms. The good news is that macOS has excellent native security controls - they just need to be enabled and configured properly.

Start With the Benchmarks

Before diving in, know that both of these exist and are free:

CIS Apple macOS Benchmark - Covers macOS Sonoma, Ventura, and older releases. Very thorough. Download at cisecurity.org.
macOS Security Compliance Project (mSCP) - Apple-supported project that generates compliance scripts for NIST 800-53, CIS, and DISA STIG profiles. Available at github.com/usnistgov/macos_security.

For a quick audit of your current state, the mSCP tools can generate a compliance report and a hardening script in one go.

System-Level Security Settings

Most of the critical macOS security settings live in System Settings (System Preferences on older macOS), but you can also configure them via defaults commands or MDM profiles - which is the right approach for a fleet.

FileVault (Full-Disk Encryption)

This should be on. Period. If a Mac is lost or stolen with FileVault off, the data is accessible.

# Check FileVault status
fdesetup status

# Enable FileVault (prompts for a user to set as recovery user)
sudo fdesetup enable

# Or enable silently via MDM/script (outputs personal recovery key)
sudo fdesetup enable -user username -outputplist /path/to/recovery.plist

In System Settings > Privacy & Security > FileVault you can also enable it via GUI.

Firewall

macOS has an application-level firewall that controls which apps can receive incoming connections.

# Enable the firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

# Enable stealth mode (don't respond to probe requests)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

# Block all incoming connections (most restrictive - good for personal/laptop)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on

# Check current state
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

Via GUI: System Settings > Network > Firewall

Gatekeeper

Gatekeeper ensures only signed and notarized software runs. It should always be on:

# Check Gatekeeper status
spctl --status

# Enable Gatekeeper
sudo spctl --master-enable

# Check if an app is notarized
spctl --assess --type exec /Applications/SomeApp.app

In System Settings > Privacy & Security, the setting is under “Allow applications downloaded from.”

Screen Lock and Authentication

# Require password immediately after screen saver starts (via defaults)
defaults write com.apple.screensaver askForPassword -int 1
defaults write com.apple.screensaver askForPasswordDelay -int 0

# Set screen saver to activate after 5 minutes of inactivity
defaults -currentHost write com.apple.screensaver idleTime -int 300

Via GUI: System Settings > Lock Screen - set both “Start Screen Saver after” and “Require password after screen saver begins or display is turned off” to appropriate values. Automatic login bypasses the login screen entirely:

# Check if automatic login is configured
sudo defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null

# Disable automatic login
sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser

# Hide last username at login screen
sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool true

User Account Hardening

Audit Admin Accounts

# List all admin accounts (should be minimal)
dscl . -read /Groups/admin GroupMembership

# List all local user accounts
dscl . list /Users | grep -v "^_"

Admin accounts should be limited. Regular users should not have admin rights for day-to-day use. If you need to install software, use a separate admin account or sudo.

Firmware Password (Intel Macs)

On Intel Macs, a firmware password prevents booting from external media and resetting the system without credentials. On Apple Silicon, this is handled differently via Activation Lock.

# Check firmware password status (Intel)
sudo firmwarepasswd -check

# Set a firmware password
sudo firmwarepasswd -setpasswd

Privacy and Permissions

macOS’s privacy model requires explicit permission grants for apps to access sensitive resources. Review and tighten these: System Settings > Privacy & Security:

Location Services - Review which apps have access. Most apps don’t need this.
Contacts / Calendars / Reminders - Remove apps that don’t need access.
Full Disk Access - Be very selective. Only give this to tools that genuinely require it.
Screen Recording - Audit carefully - anything with this can see everything on your screen.
Accessibility - Apps with Accessibility access can control your Mac. Audit regularly.
Microphone / Camera - Review which apps have access.

# List all TCC (Transparency, Consent, and Control) database entries
# Note: requires SIP disabled or appropriate access, usually view via System Settings
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "select client, service, auth_value from access;"

System Settings > General > Sharing - Turn off everything you don’t actively use:

# Disable file sharing
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist 2>/dev/null
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist EnabledServices -array

# Disable Remote Login (SSH)
sudo systemsetup -setremotelogin off

# Check what's currently shared
sudo sharing -l

# Disable printer sharing
sudo cupsctl --no-share-printers

Services to review and typically disable:

File Sharing - unless actively used
Printer Sharing - unless you have a shared printer
Remote Login (SSH) - unless you need remote terminal access
Remote Management (VNC/ARD) - unless actively managed remotely
Bluetooth Sharing - almost never needed
Internet Sharing - disable unless you’re using your Mac as a hotspot

System Integrity Protection (SIP)

SIP is a macOS security feature that prevents even root from modifying protected system files. Never disable this without a very good reason. Some development tools or kernel extensions may ask you to - evaluate carefully whether it’s necessary.

# Check SIP status
csrutil status

# Should show: "System Integrity Protection status: enabled."

Application Security

Safari Hardening (if used as primary browser)

# Enable fraudulent website warning
defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true

# Disable auto-opening safe files after download
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false

# Enable Do Not Track header
defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true

Audit Logging

macOS has a built-in audit system (OpenBSM) but logging defaults are minimal. For more comprehensive logging:

# Check current audit settings
sudo cat /etc/security/audit_control

# Enable detailed audit logging - add these to audit_control
# flags:lo,ad,fd,fm,-all
# minfree:5
# naflags:lo,ad

# View current audit logs
sudo praudit /var/audit/current

# List audit log files
ls /var/audit/

Unified Log (macOS 10.12+)

The modern macOS log system:

# Stream logs in real-time
log stream --predicate 'eventMessage contains "authentication"'

# Query historical logs
log show --last 1h --predicate 'process == "sshd"'

# Log failed sudo attempts
log show --predicate 'process == "sudo" && eventMessage contains "NOT"' --last 24h

MDM and Enterprise Management

If you’re managing a fleet of Macs, MDM (Mobile Device Management) is how you enforce configuration at scale. Options:

Tool	What it is
Jamf Pro	The most widely used Mac MDM in enterprise - very feature-rich
Mosyle	Popular alternative, strong security focus
Microsoft Intune	Good choice for Microsoft-centric shops
Kandji	Modern MDM with good auto-remediation features
Apple Business Manager	Apple’s own device enrollment and management platform (used alongside MDM)

MDM lets you push configuration profiles, enforce FileVault, restrict app installs, and deploy software at scale.

Useful Tools

Tool	What it’s for
Objective-See tools	Free macOS security tools by Patrick Wardle - BlockBlock, KnockKnock, LuLu, Oversight. Highly recommended.
LuLu	Free open-source macOS firewall with outbound connection control
BlockBlock	Monitors for persistence mechanisms and alerts you
KnockKnock	Scans for persistent software installed on your Mac
Oversight	Alerts when camera or microphone is activated
Santa	Open-source binary authorization tool from Google - blocks unauthorized executables
osquery	SQL-based endpoint visibility - great for auditing and monitoring
mSCP	macOS Security Compliance Project - generate hardening scripts
Lynis	Works on macOS too - quick audit tool

The Objective-See suite (all free, all open-source, all made specifically for Mac security) is especially worth installing on any Mac you care about.

Apple Silicon vs Intel - Differences Worth Knowing

Apple Silicon Macs (M1/M2/M3/M4) have some security improvements worth knowing about:

Secure Enclave - Hardware-based key storage, significantly more robust than Intel counterparts
Activation Lock - Ties the Mac to an Apple ID, preventing use if stolen (replaces firmware password)
Full Security mode - Default boot policy only allows Apple-signed OS
Kernel extensions - System extensions replaced kernel extensions on Apple Silicon; harder for attackers to load malicious kernel code

For enterprise, Apple Silicon Macs enrolled in Apple Business Manager with a MDM can be remotely wiped and locked even by Apple.

Quick Win Checklist

If you’re hardening a Mac and want to start with the highest-impact items:

Enable FileVault
Enable the application firewall with stealth mode
Set screen lock to require password immediately
Disable automatic login
Turn off all unused sharing services
Review Privacy & Security permissions for all apps
Enable automatic security updates
Install LuLu and Objective-See’s BlockBlock and KnockKnock
Audit admin accounts - regular users shouldn’t need admin rights

Reference

CIS macOS Benchmark
macOS Security Compliance Project
Objective-See Tools - Patrick Wardle’s free Mac security tools
Apple Platform Security Guide - Apple’s own documentation on macOS security architecture
DISA STIG for macOS - Government-grade hardening requirements

macOS gives you a lot of security features for free - but “for free” doesn’t mean automatically configured. The delta between a default Mac and a hardened Mac is entirely made up of settings that Apple built but left off.

Welcome

Awesome Resources

Red Teaming 101

Blue Teaming 101

GRC 101

General IT Knowledge

macOS

macOS Hardening

Start With the Benchmarks

System-Level Security Settings

FileVault (Full-Disk Encryption)

Firewall

Gatekeeper

Screen Lock and Authentication

User Account Hardening

Audit Admin Accounts

Firmware Password (Intel Macs)

Privacy and Permissions

System Integrity Protection (SIP)

Application Security

Safari Hardening (if used as primary browser)

Audit Logging

Unified Log (macOS 10.12+)

MDM and Enterprise Management

Useful Tools

Apple Silicon vs Intel - Differences Worth Knowing

Quick Win Checklist

Reference

​macOS Hardening

​Start With the Benchmarks

​System-Level Security Settings

​FileVault (Full-Disk Encryption)

​Firewall

​Gatekeeper

​Screen Lock and Authentication

​Disable Automatic Login

​Show All Users at Login (Don’t Show Last Username)

​User Account Hardening

​Audit Admin Accounts

​Firmware Password (Intel Macs)

​Privacy and Permissions

​Disable Unnecessary Services and Sharing

​System Integrity Protection (SIP)

​Application Security

​Safari Hardening (if used as primary browser)

​Audit Logging

​Unified Log (macOS 10.12+)

​MDM and Enterprise Management

​Useful Tools

​Apple Silicon vs Intel - Differences Worth Knowing

​Quick Win Checklist

​Reference

macOS Hardening

Start With the Benchmarks

System-Level Security Settings

FileVault (Full-Disk Encryption)

Firewall

Gatekeeper

Screen Lock and Authentication

Disable Automatic Login

Show All Users at Login (Don’t Show Last Username)

User Account Hardening

Audit Admin Accounts

Firmware Password (Intel Macs)

Privacy and Permissions

Disable Unnecessary Services and Sharing

System Integrity Protection (SIP)

Application Security

Safari Hardening (if used as primary browser)

Audit Logging

Unified Log (macOS 10.12+)

MDM and Enterprise Management

Useful Tools

Apple Silicon vs Intel - Differences Worth Knowing

Quick Win Checklist

Reference