10 Minute Mac Security Checklist

Apple’s built-ins

• FileVault Disk encryption. A stolen Mac cannot be read. Privacy & Security → FileVault → On Save the recovery key in your password manager. A sticky note does not count. Open FileVault
• Firewall Blocks unsolicited connections coming in. Network → Firewall → On. In Options, turn on Stealth Mode if it is offered. Open Network
• Sharing Every service here is a door in. Most people need none of them. General → Sharing → turn off anything you do not use Open Sharing
• Automatic updates This is how Apple’s malware protection, XProtect, stays current. General → Software Update → the info button → Install macOS updates and Security responses, both on Open Software Update
• Find My Mac Locate, lock, or erase a lost Mac. This also turns on Activation Lock, so a thief cannot wipe it and resell it without your Apple Account. Apple Account → Find My → Find My Mac → On Open Apple Account
• Advanced Data Protection End-to-end encrypts iCloud backups, Photos, and Notes, including iMessage keys that a normal iCloud backup leaves readable by Apple. Apple Account → iCloud → Advanced Data Protection → On Setup asks for a recovery contact or a recovery key. Do not skip it. Losing the password then loses the data. Open Advanced Data Protection
• USB accessories Blocks juice-jacking and malicious dongles while the Mac is locked. Privacy & Security → Allow accessories to connect → Ask for new accessories Open Accessories
• Backups FileVault protects data from thieves. Backups protect it from loss, including ransomware. General → Time Machine → pick an external disk → encrypt the backup A second copy that lives somewhere else is better. Cloud, or a drive that stays offsite. Open Time Machine
• Screen lock No unlocked-and-walked-away window. Lock Screen → Require password after screen saver begins → Immediately Open Lock Screen
• Automatic login Automatic login bypasses FileVault at boot. Users & Groups → Automatic log in → Off Open Users and Groups
• App sources Blocks apps Apple has not notarized. On by default. Confirm it. Privacy & Security → Allow applications from → App Store & Known Developers Open Privacy and Security
• Privacy checkup Do this once, then again when you install something new. Location: revoke access you do not use. Camera: revoke access you do not use. Microphone: revoke access you do not use. Files: revoke access you do not use. Analytics & Improvements: off. Wi-Fi → your network → Details → Private Wi-Fi Address → Rotating. Finder → Settings → Advanced → Show all filename extensions. That shows an invoice.pdf.app trick.

Passwords

• A password manager A unique password for every account. Do not type one from a link in a message. Apple’s Passwords app, or Bitwarden if you also use other devices.
• Two-factor, preferably YubiKeys On your email and your Apple Account. A YubiKey where a site offers one. Otherwise an authenticator app.

Outbound firewall

• LuLu Asks the first time an app tries to connect out. Login Items & Extensions → Network Extensions The first day is noisy. Allow apps you recognize. Deny the rest. Open LuLu

Background alerts

• BlockBlock Alerts when something sets itself to run at every boot. Turn on Paste Protection and Start at Login. Open BlockBlock
• OverSight Alerts when something uses the microphone or the camera. Grant access and start at login. Open OverSight

Browser

• Few extensions, trusted only A bad extension can read saved passwords. Safari: Settings → Extensions. Remove any you do not recognize.
• Block cross-site tracking Stops sites from following you from page to page. Safari: Settings → Privacy → Prevent cross-site tracking. Chrome: Settings → Privacy → Block third-party cookies.
• One reputable blocker Strips ads, including malicious ones. AdGuard for Safari, Wipr, or uBlock Origin in Chrome.

Paid antivirus and a VPN are left out on purpose. For a typical person, both are mostly marketing. XProtect plus the layers above do the job.