10 Minute Mac Security Checklist

Built-in macOS settings

• FileVault Encrypt your disk so a stolen Mac cannot be read. Privacy & Security → FileVault → On Recovery key Keep a paper copy of any recovery key safe and separate from your Mac, with a password manager only as a second copy. Open FileVault
• Firewall Blocks unsolicited connections coming in. Network → Firewall → On
  Options → Enable stealth mode Open Network
• Sharing Limits unwanted access through sharing and receiving services. General → Sharing: unused services off
  General → AirDrop & Continuity: AirDrop → Contacts Only
  General → AirDrop & Continuity: AirPlay Receiver → Off if unused AirPlay Choose “Current User” if you need AirPlay Receiver, under “AirDrop & Handoff” on older macOS versions. Open Sharing
• Automatic updates Keeps macOS, security protections, and apps patched. General → Software Update → Automatic Updates: macOS and security/system-data updates on
  App Store → Settings → Automatic Updates on Open Software Update
• Find My Mac Helps locate, lock, or erase a lost Mac and enables Activation Lock on supported models. Apple Account → Find My → Find My Mac → On Open Apple Account
• Advanced Data Protection End-to-end encrypts iCloud backups, Photos, and Notes, including iMessage keys that a normal iCloud backup leaves readable by Apple. Apple Account → iCloud → Advanced Data Protection → On Recovery method Set up a recovery contact or key before enabling this, because Apple cannot recover your encrypted data if you lose access. Open Advanced Data Protection
• USB accessories Blocks juice-jacking and malicious dongles while the Mac is locked. Privacy & Security → Allow accessories to connect → Ask for new accessories Open Accessories
• Backups Protects against data loss, including ransomware, while FileVault protects against theft. General → Time Machine → pick an external disk → encrypt the backup Offsite backup Keep a second copy offsite, in the cloud or on a separate drive. Open Time Machine
• Screen lock Limits access to an unattended Mac. Lock Screen → turn display off after 5 minutes on battery and power adapter
  Lock Screen → require password after screen saver or display sleep → Immediately Open Lock Screen
• Automatic login Automatic login bypasses FileVault at boot. Users & Groups → Automatic log in → Off Open Users and Groups
• App sources Helps block untrusted apps before they run. Privacy & Security → Allow applications from → App Store & Known Developers Open Privacy and Security
• Privacy checkup Limits which apps can access your data and sensors. Revoke unused Location, Camera, Microphone, and Files access
  Analytics & Improvements → Off
  Wi-Fi → your network → Details → Private Wi-Fi Address → Rotating
  Finder → Settings → Advanced → Show all filename extensions → On

Passwords

• A password manager Unique passwords prevent one breached account from exposing your others. Apple’s Passwords app or Bitwarden if you also use other devices.
• Two-factor, preferably YubiKeys On your email and your Apple Account. Use a YubiKey where supported. Otherwise an authenticator app.

Outbound firewall

• LuLu Asks the first time an app tries to connect out. Login Items & Extensions → Network Extensions Connection prompts Expect frequent prompts at first.
  Allow apps you recognize and deny the rest. Install LuLu

Background alerts

• BlockBlock Alerts when something sets itself to run at every boot. Turn on Paste Protection and Start at Login. Install BlockBlock
• OverSight Alerts when something uses the microphone or the camera. Grant access and Start at Login. Install OverSight

Browser

• Review Browser Extensions A bad extension can read saved passwords. Safari → Settings → Extensions → remove any you do not recognize
• Browser protections Reduces tracking and exposure to malicious sites and downloads. Safari → General → Open “Safe” Files After Downloading → Off
  Safari → Security → Warn When Visiting a Fraudulent Website → On
  Safari → Privacy → Prevent Cross-Site Tracking → On
  Chrome → Privacy and Security → Third-Party Cookies → Block Third-Party Cookies
• Install an Ad Blocker Strips ads, including malicious ones. Safari → uBlock Origin Lite
  Chrome → uBlock Origin Lite

If you are a high-risk target

These break normal features. Skip them unless you already know you need them.

• Lockdown Mode Restricts message previews, just-in-time compilation, and wired accessories while locked (Apple’s description). Privacy & Security → Lockdown Mode Open Lockdown Mode
• Contact Key Verification Adds extra iMessage identity checks for high-risk users (Apple’s description). Apple Account → Contact Key Verification Open Apple Account

Going further Optional

Real protection, more work. These do not count toward the checklist above. Skip them if Part 1 is done.

Santa

Open-source allowlisting from North Pole Security. It can block programs Gatekeeper does not know yet. It is also the most setup on this page. In Standalone mode you are the judge of every unknown program. If you would click Allow without looking, skip it. You would get prompts, not protection.

Three modes, set with a config profile. Docs.

• Monitor. Logs everything. Blocks nothing.
• Lockdown. Blocks anything not explicitly allowed. Strongest. Breaks things until the rules mature.
• Standalone. Default-deny, but prompts the first time an unknown binary runs. The practical middle.

Install the signed package from GitHub Releases, or brew install --cask santa. Approve it under Login Items & Extensions → Endpoint Security Extensions. Deploy a profile setting ClientMode: 1 monitor, 2 lockdown, 3 standalone. Check with santactl status.

More Objective-See tools

• RansomWhere? Watches for ransomware-style mass encryption.
  Install RansomWhere
• ReiKey Detects keylogger-style keyboard taps.
  Install ReiKey
• KnockKnock Occasionally audit everything installed to persist.
  Install KnockKnock
• Netiquette Shows which processes hold existing network connections, complementing LuLu’s prompts for new ones.
  Install Netiquette
• Do Not Disturb Alerts to physical access, especially useful if your laptop travels.
  Install Do Not Disturb
• TaskExplorer Inspect a running process’s signature, libraries, and connections, with optional VirusTotal checks.
  Install TaskExplorer
• WhatsYourSign Right-click a download to see its signature before you run it. Reputation For a reputation check, look up the file’s hash on VirusTotal rather than uploading the file.
  Install WhatsYourSign
• ProcessMonitor An advanced live process stream with command lines.
  Install ProcessMonitor

DNS filtering

A second egress layer, below the app. Blocks known-bad and tracker domains for every app, including ones a firewall already allowed. NextDNS is the easy pick. Install its signed encrypted-DNS profile so it applies system-wide. ControlD and AdGuard DNS are the alternatives.

iCloud Private Relay, which needs iCloud+, hides your IP and DNS from sites in Safari. It is the zero-config alternative to filtered DNS, and it blinds LuLu for Safari traffic. Pick one.

A non-admin daily account

A Standard account for daily use means every install asks for the admin password. Real gain, real friction. Worth it on a shared Mac, or if you want the extra gate. Users & Groups → Add Account → Standard.

Additional Resources

• Full Yubikey Guide by Pablo / Opsek
• Full Opsec Guide by Officer's Notes
• Scan Files Online
• Clean PDFs
• Automatic Scanner by Samet