Attack surface and a hardening baseline

Hardening a computer does not mean making it unbreakable. It means removing the doors and windows nobody uses, so the ones that remain are easier to watch. This course walks through that process for a single Mac used by one person: no fleet of servers, no IT department, just the settings and checks anyone can do themselves.

What “attack surface” means

The attack surface of a computer is everything on it that could be reached or abused: every account that can log in, every service listening for a network connection, every app that can run, every port left open. Each one is a small bet that nothing will ever go wrong with it. A hardening baseline is the set of changes that reduces the number of bets you are making, without pretending the remaining ones are risk-free.

macOS already starts from a reasonably strong position: recent Macs encrypt storage by default, code has to be signed to run, and System Integrity Protection stops even an administrator account from silently rewriting core system files. The next four lessons cover the parts you can still improve: how the disk is encrypted and how the machine boots, who has an account and what they can do, which services and ports are open, and how to verify the defences that are already built in.

Design principles behind the settings

The individual settings in this course all serve a small set of underlying ideas. Least privilege means giving an account, or a piece of software, only the access it needs, never more “in case it is useful later.” Process isolation and domain separation mean keeping one app’s mistakes from spilling into another’s: a compromised browser tab should not be able to read your email client’s files. Privileged and non-privileged states are the distinction between an administrator account and a standard one, and between a process running as root and one running as an ordinary user. None of these ideas is specific to macOS; they are the same principles any modern operating system is built around, and every setting in the rest of this course is really one of them applied to a specific screen or command.

Why order matters

Some changes protect you even if you never do anything else; others only matter once the basics are in place. A sensible baseline does the high-value, low-effort changes first.

1. Encrypt the disk (FileVault) so the data is protected even if the Mac is lost, stolen, or seized while it is off.
2. Keep macOS and apps updated, since most fixes for known weaknesses arrive as software updates, not new settings.
3. Separate accounts and privileges: use a standard account day to day, keep administrator access for when it is actually needed.
4. Turn off services and ports you do not use: file sharing, screen sharing, and remote login are common defaults left on for no reason.
5. Verify. macOS ships with defences already active; check that they still are, on a schedule, with the read-only commands covered in this course.

Costs, and what this course will not tell you to do

Every one of these changes has a cost: an encrypted disk needs a recovery key stored somewhere safe; a standard account means typing a password more often; a closed port might be one you actually needed for a printer or a backup drive. Hardening is a series of trade-offs, and the right trade-off depends on what the machine is for and who might target it.

This course will never suggest turning off System Integrity Protection, Gatekeeper, or the disk encryption Apple silicon Macs apply by default. Some hardening guides written for advanced users include steps like that, or ship scripts and third-party rule lists to import into a low-level firewall. They are aimed at people willing to accept the risk of a broken update or a harder-to-diagnose fault; the guidance in this course is deliberately narrower, and every setting is checked against Apple’s own documentation before it is included.