Context-aware security: one laptop, many networks

A desktop in an office sits on one network for years. A laptop does not: in a single day it may join a home network, an office network, a train hotspot and a hotel Wi-Fi. A firewall policy that is right for one of those places is wrong for another. Sharing files with the printer at home is useful; accepting incoming connections from strangers on a café network is not.

Zero trust frameworks make the same point in more formal words. NIST SP 800-207 says access decisions should be dynamic and take into account the observable state of the device and its environment, and CISA’s Zero Trust Maturity Model describes policies that adapt as risk changes. Context-aware security is that idea applied on one machine: the same rules engine, with a strictness that follows where you are.

Which context signals can a laptop trust?

• The network’s security: an open network (no password) or one using old encryption such as WEP or WPA1 protects nothing between you and the access point. WPA2 and WPA3 are the current standards (Wi-Fi Alliance).
• The network’s name: useful to recognise home or work, but easy to copy. Anyone can create a hotspot with a familiar name, the classic “evil twin” that sets up an adversary-in-the-middle position (MITRE ATT&CK T1557).
• Your own choice: you know you are at a conference; the Mac may not.
• Time of day and activity: a work app at 3 a.m. may deserve a different answer than at 3 p.m.

Notice that a network name alone is weak evidence. A safe design combines several signals and, when unsure, falls back to the stricter policy. NIST SP 800-153, on wireless LAN security, recommends treating untrusted wireless networks with caution and configuring devices for them accordingly.

How FireAI does it: security modes

FireAI has four ready-made strictness levels. Your own rules and an explicit Allow rule for an app always win over a mode.

• Home: the everyday level.
• Coffee shop: blocks incoming connections, file and screen sharing with other devices on the network, and unencrypted mail or FTP.
• Paranoid: adds blocking of tracking, unsigned apps and all unencrypted ports; even Apple’s own tools must be approved.
• Under attack: only apps with an explicit Allow rule can connect; DNS and the local network keep working, and there are no prompts.

Coffee Shop Armor: reacting to the network

Coffee Shop Armor checks how every Wi-Fi network the Mac joins is secured: open, weak (WEP or WPA1) or strong (WPA2 or WPA3). On an open or weak network, it switches FireAI from Home to Coffee shop mode on its own. It also warns you when a network whose name you have used before shows up with weaker security than last time, the usual sign of a fake copy. Two design choices are worth noticing:

• It only ever makes FireAI stricter. If you picked Paranoid or Under attack, it leaves your choice alone, and it never switches you back down by itself.
• It is honest about its limits: a fake network with a strong password and a copied name looks the same as the real one from outside. The warning catches the common case, not every trick, which is why Coffee shop mode stays the safe default on unfamiliar networks.

Places: rules that follow your Wi-Fi

Modes are one dial. Places go further: a place such as Home or Work is a named set of rules plus a security mode, tied to a list of Wi-Fi networks. With automatic switching on, FireAI changes place when the Wi-Fi changes. Rules can be scoped to one place or left to apply everywhere, and auto-switching pauses while an activity profile is running. AirDrop Shield completes the picture: it shows whether your Mac is visible over AirDrop to everyone, and nudges you when it is on a network you don’t trust; it reads that setting but never changes it for you.

The lesson for any context-aware system: automatic tightening is safe, automatic loosening is where mistakes hide. Let the machine raise the guard; keep lowering it a human decision.