Lesson 2 of 5 · 9 min
Secure installation, startup security and encryption
How a Mac protects the boot process and the data on disk, and how to check FileVault, the Secure Enclave and startup security yourself.
Before an account is created or a service is turned off, two things decide how much everything else can be trusted: whether the Mac only starts software it can verify, and whether the data on disk is unreadable to anyone without your password. Both are largely automatic on a modern Mac, but “automatic” is worth checking rather than assuming.
The Secure Enclave and encryption keys
Apple silicon Macs (and older Intel Macs with a T2 chip) include a Secure Enclave: a separate coprocessor, isolated from the main processor, with its own encrypted storage. Apple’s security guide describes it as managing the device’s user data encryption keys and processing biometric data such as Touch ID, so that key material never has to leave the Secure Enclave in a usable form. On these Macs, the Secure Enclave generates and protects the cryptographic keys that encrypt the disk, which is why storage encryption is present “automatically” rather than as an optional extra.
FileVault: your password is the other half of the key
FileVault is the setting that ties that automatic encryption to your login password. Apple describes it as providing “an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password.” Turn it on from System Settings → Privacy & Security → FileVault; you will be asked to choose a recovery method, either your iCloud account or a recovery key, a string of letters and numbers Apple generates for you.
You can check FileVault’s status yourself, without changing anything, from Terminal:
fdesetup status
FileVault is On.Startup security: what runs before macOS does
FileVault protects data once macOS is running. Startup security decides whether the Mac will run macOS at all, or something that has been tampered with. On a Mac with Apple silicon, this is controlled by a secure boot policy with three levels, documented in Apple’s Platform Security guide.
| Policy | What it does |
|---|---|
| Full Security (default) | Every startup requires a fresh, Mac-specific signature from Apple, the same model used on iPhone and iPad. This is designed to stop an older, vulnerable version of macOS from being reinstalled to attack the Mac. |
| Reduced Security | Accepts a general Apple signature rather than one tied to this specific Mac. It is required to run older macOS versions or third-party kernel extensions, and is less resistant to rollback attacks. |
| Permissive Security | For users who accept a much less secure state, such as running a custom kernel. It can only be set from Terminal in recoveryOS, not from the graphical Startup Security Utility, and turning off System Integrity Protection on Apple silicon requires dropping to this level first. |
For almost everyone, the right setting is the default: Full Security. There is rarely a good reason for a single-user Mac to run in Reduced or Permissive Security, since both exist mainly to support older software or kernel-level development work. To view or change the policy, restart, press and hold the power button until “Loading startup options” appears, then open Startup Security Utility and authenticate as an administrator.
Secure installation
A “secure installation” is simply one that starts from Apple’s own installer, downloaded through Software Update or from Apple, rather than a disk image or installer obtained elsewhere. Because Full Security ties a specific, Apple-signed copy of macOS to your specific Mac, installing from an unverified source undermines the same protection this lesson just described. The next lesson in this course covers keeping that installation itself up to date.
Key takeaways
- The Secure Enclave is an isolated coprocessor that generates and guards the encryption keys used to protect data at rest and biometric data such as Touch ID.
- FileVault ties disk encryption to your login password; store the recovery key separately from the Mac, since losing both means permanent data loss.
- `fdesetup status` reports FileVault’s state without changing anything.
- On Apple silicon, Full Security is the default and recommended startup policy; Reduced and Permissive Security exist for compatibility and development needs, and Permissive Security is required before SIP can be turned off.
- Install macOS only from Apple’s own installer; anything else undermines the Mac-specific signature that Full Security relies on.
Check yourself
1. What does the Secure Enclave do?
- It scans downloaded files for malicious software
- It is an isolated coprocessor that generates and protects encryption keys and biometric data — Right.
- It blocks incoming network connections
- It stores your Apple Account password in plain text
The Secure Enclave is a separate, isolated subsystem dedicated to key management and biometric data, kept apart from the main processor.
2. What happens if you lose both your FileVault password and your recovery key?
- Apple can unlock the disk remotely
- The data becomes permanently inaccessible — Right.
- macOS falls back to no encryption
- The Secure Enclave resets itself automatically
Apple states plainly that losing both the password and the recovery key means the encrypted data cannot be recovered.
3. On an Apple silicon Mac, what is required before System Integrity Protection can be turned off?
- Nothing extra is required beyond an administrator password
- Switching the startup policy to Permissive Security — Right.
- Disabling FileVault first
- Booting from an external drive
Apple’s Platform Security guide notes that turning off SIP on Apple silicon requires acknowledging and dropping to Permissive Security first, since disabling SIP always weakens the kernel’s protection.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Security modes: Home, Coffee shop, Paranoid, Under attack — Match FireAI’s strictness to where your Mac actually is, in one tap.
- Find apps with known security flaws — Close known holes before anyone uses them: update the one app that needs it.
- Answer your first connection prompt, and what each lifetime means — Understand exactly what you’re approving the first time FireAI asks.
Sources
- Apple Platform Security: The Secure Enclave
- Apple Platform Security: Startup Disk security policy control
- Apple Support: Use FileVault to encrypt the startup disk on your Mac
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.