Protect the device itself

A strong password on your accounts does little if someone can simply take the laptop and read the disk directly, or if the Mac is running months-old software with fixes it never installed. This lesson covers the protections that live on the device itself, from the drive to the lock screen.

FileVault: encrypting the disk

FileVault encrypts your startup disk so it cannot be read without your login password or recovery key, even if the drive is removed from the Mac entirely. Apple explains that ‘if you have a Mac with Apple silicon or an Apple T2 Security Chip, your data is encrypted automatically. Turning on FileVault provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password.’ On a Mac without Apple silicon or a T2 chip, FileVault has to be turned on manually to get that protection at all, and it requires an administrator to set up.

When you turn it on, you choose how to unlock the disk if you ever forget your login password: with your Apple Account, or with a recovery key you write down yourself. Apple’s own warning is blunt: ‘Don’t forget your recovery key. If you turn on FileVault and then forget your login password and can’t reset it, and you also forget your recovery key, you won’t be able to log in, and your files and settings will be lost forever.’ Store that recovery key somewhere as carefully as you would a physical key.

$ fdesetup status
FileVault is On.

A login password worth the name

FileVault’s protection only holds up if the login password guarding it is not trivial to guess. The same password guidance from the previous lesson, length over forced complexity, no reuse, applies just as much to the account you log in with every morning as to any website account.

Staying updated, again

The previous course in this university covers vulnerabilities and patches in depth; the short version for this plan is that System Settings > General > Software Update, with automatic updates turned on, is not optional. A perfectly configured Mac running outdated software still carries every weakness Apple has already published a fix for.

Find My: locating and locking a lost Mac

If a Mac is lost or stolen, Find My can locate it on a map, and Apple describes marking it lost as something that ‘locks it with a passcode or your Apple Account password’ and lets you ‘display a message so others can contact you if they find your device.’ Apple also notes that remote erasing generally requires two-factor authentication to already be turned on; without it, you would need to erase the device through iCloud.com instead. Setting up Find My before a device goes missing, not after, is what makes it useful.

Lockdown Mode: for the small number of people who need it

Apple describes Lockdown Mode as ‘an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.’ Turning it on changes how the Mac behaves: Apple lists effects including that most Messages attachment types are blocked, certain web technologies are blocked in Safari (which can break some sites), unknown FaceTime callers cannot reach you, and device connections require the Mac to be unlocked with explicit approval. It is a real trade-off in convenience, appropriate for someone whose threat model, from the first lesson in this course, genuinely includes that level of adversary, not a default setting for everyone.