Protect the network

Everything this course has covered so far protects the device and the accounts on it. This lesson turns to the connection between your Mac and everything else: the Wi-Fi it joins, the lookups it makes, and the traffic that leaves it.

The built-in macOS firewall: inbound, by default

macOS ships with a firewall, found in System Settings > Network > Firewall. Apple describes what it does plainly: ‘A firewall can protect your Mac from unwanted contact initiated by other computers when you’re connected to the internet or a network.’ That is an inbound firewall: it is built to stop connections coming to your Mac from outside, not to control what your own apps send out. Once turned on, you can also review which apps and services are allowed to accept incoming connections, in the same Firewall settings.

That leaves a real gap: nothing in the built-in firewall tells you which of your own apps are quietly sending data out, to whom, or lets you block one app’s outbound traffic while leaving the rest alone. Seeing and controlling outbound connections, per app, needs a separate, dedicated tool.

Wi-Fi: the basics that matter most

The US Cybersecurity and Infrastructure Security Agency (CISA) lists foundational steps for securing a wireless network, starting with the basics people skip: changing default administrator passwords on the router, since ‘most network devices...are pre-configured with default administrator passwords’, and encryption, noting that ‘WPA3 is currently the strongest encryption’, with WPA2 as an acceptable minimum. CISA also recommends giving the network a distinct name, keeping router firmware updated, and, on public Wi-Fi you do not control, disabling file sharing and confirming the network name before connecting rather than trusting whichever open network looks familiar.

• Use WPA3 where your router and devices support it, WPA2 as a minimum; never leave a network open.
• Change the router’s default administrator password; it is one of the first things scanned for on any network.
• Keep router firmware updated, the same way you keep macOS and apps updated.
• On a public network, turn off file sharing and treat any traffic that is not HTTPS as visible to others on that network.

DNS: the lookup that usually is not private

Before your Mac can reach a website, it looks up the site’s address through DNS, and that lookup is ordinarily sent in the clear. Cloudflare’s technical documentation puts it directly: ‘By default, DNS queries and responses are sent in plaintext..., which means they can be read by networks, ISPs, or anybody able to monitor transmissions. Even if a website uses HTTPS, the DNS query required to navigate to that website is exposed.’ Two newer standards, DNS over TLS and DNS over HTTPS, encrypt that lookup instead, which Cloudflare compares to putting a plain postcard in an envelope: the destination is still delivered, but it is no longer readable in transit.

VPNs: what they change, and what they do not

A VPN routes your connection through an encrypted tunnel to a server run by the VPN provider, which hides your traffic and IP address from your local network and your internet provider. EFF is equally clear about the limits: ‘A VPN is not a tool for anonymity’, since it does not stop location, cookie or fingerprinting-based tracking, and everything your ISP would otherwise see becomes visible to the VPN provider instead: ‘VPN providers are also subject to law enforcement requests’, the same as an ISP. EFF’s conclusion is not to avoid VPNs but to be selective: ‘Do not use a VPN that you do not trust’, and look for independent security audits and a clear, specific privacy policy before choosing one.