What do we mean by hardening macOS devices and why is it important? Read on to learn more.
The legend of macOS devices being “unhackable” is starting to fade, and IT admins and managed service providers (MSPs) are wising up. Although Apple has successfully marketed its machines as impenetrable, we now have years of data demonstrating the increase of successful cyber attacks against them. For IT admins managing Macs, the need for device and information security is no longer in question. Instead, the question has become: How do I implement comprehensive macOS device security without making it my full-time job?
When we think about device security, it’s natural to focus on the risks associated with end users. After all, phishing is a primary threat vector, so the importance of implementing training, testing, policies, and procedures can’t be understated. On the other hand, there are ways to strengthen macOS security without relying on end users and instead focusing on the device itself.
Hardening macOS devices is a topic many IT professionals are curious about but can’t find a lot of information on. Simply put, endpoint hardening makes devices more resilient against threat actors, including insider threats, cybercriminals, and hacktivists.
While the concept isn’t rocket science, implementing a device hardening plan has its challenges. First, you’ll need to decide what security controls to apply. Fortunately, there are proven security recommendations and compliance frameworks that are known to minimize attack surfaces. For instance, Addigy has macOS-specific security configuration recommendations. You can also follow the National Institute of Standards and Technology (NIST) guidelines or CIS Benchmarks.
Selecting a security standard can be tricky. Some environments or business types have unique requirements. There may also be issues with compatibility that require different OS versions or third-party tools. Being aware of possible obstacles and the ways to maneuver around them will help ensure a seamless transition.
Although hardening devices is meant to mitigate risk, it’s important to remember that enforcing stricter security protocols has implications for end users too. Their usability may be impacted, workflows disrupted, or any number of unintended consequences. To catch issues early and provide the best possible user experience, provide them with a channel for feedback and be sure to act upon their concerns.
It may seem like implementing security standards and responding to the resulting end-user issues will be a lot of work, but with the right Apple MDM, compliance support can be streamlined. Most tasks can be automated, requiring little day-to-day oversight. Instead of individually applying security policies, you’re able to share them across devices, locations, and clients. You can ensure that devices that fall outside of the ideal state are automatically remediated. And, when remediation is not possible, you can automate a notification, so you are able to react quickly. You can even automate workflows to get feedback from end users.
The right Apple MDM solution makes it easier to enable, disable, manage, and automate security features across your macOS fleet to harden the devices in your network. There is no one-size-fits-all approach to securing macOS devices, but there are many tried and true guidelines to consider.
FileVault prevents unauthorized users from retrieving information stored on a protected device by automatically encrypting data on the Mac startup disc drive. With a qualified MDM, you can enable, disable and manage FileVault remotely and even escrow recovery keys for future use.
Device Lock & Device Wipe protects sensitive data if a device is lost or stolen. When enabled, a simple MDM command can remotely lock a device until it is returned to its rightful user. A machine can also be wiped entirely, even if the device is locked, so that sensitive data doesn’t fall into the wrong hands.
Firewalls provide a barrier to your private internal network. An Apple MDM makes it easy to enable a firewall within any machine in your portfolio or across large groups of endpoints on your network.
Gatekeeper makes sure that only trusted software runs on your machines by preventing downloads from sources other than the App Store or certified developers. Uncertified apps are a dangerous threat vector and, once enabled, Gatekeeper keeps them out.
Password Best Practices can have an enormous impact on device security. At the least, enforcing basic requirements like length, complexity, and history restrictions helps with password hygiene. MDM solutions like Addigy can take it a step further, allowing users to log in to their macOS devices with familiar and secure Identity provider credentials — like those from Okta, Google, AzureAD, and O365 — or using multi-factor authentication (MFA). Plus, with zero-touch deployment, Mac password resets can be automated, relieving the need for a technician.
Antivirus & Antimalware applications are important for macOS devices, despite their native antivirus system processes. When choosing tools, remember that Privacy Preferences Policy Control (PPPC), Kernel Extension (kEXT), and/or System Extensions (sEXT) are often required for macOS machines. Your MDM solution provider can offer guidance and documentation regarding implementation and automation.
macOS Updates provide enhancements and bug fixes, but most importantly, they offer security improvements. Making macOS updates a priority will help ensure your machines are always up-to-date and protected. With an Apple MDM, you can automate updates and control when they’re delivered.
Hardening macOS devices is a smart layer of added security. While it doesn’t completely eliminate vulnerability (nothing can do that), it will help mitigate risk and reduce attack vectors. And with the right strategy and tools in place, it won’t drain your resources either.To learn more about securing macOS devices, watch the recap of our webinar on the topic.
