The endpoint is the perimeter: why the laptop needs its own firewall

For a long time, network security was built like a castle: a strong wall at the edge of the company network, and a lot of trust inside it. Firewalls, proxies and intrusion detection sat at the boundary, and a laptop on the office network was treated as “inside”. That model has two weaknesses that got worse every year. Attackers who get one foot inside can move freely, and laptops spend much of their life outside the wall entirely: at home, in cafés, in hotels, on train Wi-Fi.

What zero trust changes

Zero trust, as described by NIST in Special Publication 800-207, drops the idea that location equals trust. Every request to a resource is evaluated on its own merits: who is asking, from which device, in what state, for what. The network is assumed to be hostile, even the company’s own. CISA’s Zero Trust Maturity Model organises the work into pillars, and one of them is the device itself: its identity, its health, and its ability to enforce policy wherever it is.

That last point matters for a simple reason. The company firewall only protects traffic that passes through it. When an employee opens a laptop at an airport, nothing between that laptop and the internet belongs to the company. Whatever protection travels with the device is the only protection there is.

What a host-based firewall contributes

A host-based firewall runs on the endpoint and sees what a network firewall cannot: which application opened each connection. A perimeter device sees an address and a port; the endpoint knows it was a particular signed app, or an unsigned binary nobody installed on purpose. That context is exactly what zero trust asks for, and it stays with the laptop on every network.

• Per-application control: an app can be allowed to reach its own servers and nothing else.
• Outbound control: the connections a compromised app makes to send data out, not just the ones coming in.
• Policy that follows the device: the same rules at the office, at home and on public Wi-Fi.
• Local evidence: a record of what each app contacted, useful when something goes wrong.

What it does not replace

A host firewall is one layer, not the whole defence. It does not patch software, it does not replace backups, it does not scan files for malicious code, and it cannot fix a stolen password. Zero trust works because the layers add up: strong identity, up-to-date devices, least-privilege access, and visibility on the endpoint. The course on layers of security and the macOS hardening course cover the other pieces.

How FireAI fits

FireAI is a host-based firewall for the Mac. It checks every connection an app makes, identifies the app by its code signature rather than its name, and applies your rules wherever the Mac is. Its security modes and Coffee Shop Armor tighten the policy when the Mac joins an untrusted network, which is exactly the situation where the office perimeter no longer helps. The rest of this course looks at how each of those pieces works, starting with how a Mac firewall hooks into the system at all.

Try it: map your own perimeter

Before choosing any tool, spend ten minutes describing the perimeter you actually have. The exercise is the same one a security team runs for a fleet of laptops, just smaller.

• List the networks your Mac joined in the last week: home, work, a café, a hotel, a phone hotspot. Each one is a different level of trust.
• Open Activity Monitor and look at the Network tab: which apps sent or received data today? Are there any you did not expect?
• In System Settings › Network › Firewall, check whether the built-in firewall is on, and remember that it is about incoming connections.
• For each network, write one sentence on what should be allowed there. If the answers differ, you need a policy that follows the Mac, not the building.

That last point is the whole argument of this lesson. When the answer to “what should be allowed?” depends on where the laptop is and which app is asking, the decision has to be made on the laptop itself.