Hardening macOS

Version 0.1: These mitigations are all based on Catalina. Supposedly, Big Sur has better security. Some of the below is still applicable and useful. When we have a Big Sur set up we will test it, and split and update these mitigations.

Authentication

• Introduction
• Disable automatic login
• Require a password when resuming
• Make that more secure passwords
• Use a password manager
• Use multi-factor authentication (MFA)
• Protect SSH access with MFA

Services and applications

• Introduction
• Restrict which apps can run
• System integration protection (SIP)
• Secure browsers that protect your privacy
• Use a secure messaging service
• Use secure email services
• Use SSH tunnels
• Use a VPN service
• Use a firewall as a VPN fail-safe mechanism
• Use alternative DNS servers
• Use a Tor proxy
• Change MAC address
• Renew IP lease
• Edit hosts file

Data

• Introduction
• Set up the time machine and backups in macOS
• Enable full disk encryption using FileVault
• Password protect files and folders

Privacy

• Introduction
• Disable location services and other privacy settings
• Remove metadata from files
• Edit exif metadata in images
• Remove metadata with hex editors
• Clean machine with BleachBit

Malware

• Introduction
• Mac myths
• Scan and clean machine
• Catch and remove daemons and launch agents
• Analysing trojans

Operations security

• Introduction
• Use email securely
• Detecting fake emails and phishing
• Browse more safely
• Check integrity of downloads
• ‘;–have i been pwned?

Guards! Guards!

• Introduction
• Alphabet soup
• macOS intrusion detection systems
• OSSEC