A practical security baseline for Apple devices
A security baseline starts with the data and the accounts you need to protect. It holds up only when you've checked each control on the devices themselves and know what to do when one fails.
In short
- Confirm each control on the device itself, for example that FileVault is on and its recovery key reached your MDM.
- Keep a list of devices that are behind on updates, and give every exception an end date.
- Test your recovery steps before an incident, and name the person who acts on each alert.
Protect access and stored data
Require a passcode that suits the data on each device, and turn on FileVault on every Mac. FileVault protects a lost Mac, but if someone forgets their password and the recovery key is missing, you risk losing access to the Mac. So escrow each recovery key somewhere secure, such as your MDM, and test a recovery with an authorised administrator. Keep the group who can retrieve those keys small, because a recovery key opens the Mac.
Protect work accounts with strong authentication, so a stolen password alone doesn't get anyone in. Give people the rights their work needs. Keep administrator access on separate accounts and review it when someone changes role.
Keep operating systems and apps up to date
Set a minimum macOS, iOS and iPadOS version and a deadline for each update, based on the risk and on what your apps support. A fix for a flaw that's already being exploited can't wait as long as a feature update. When the deadline passes, look at the version each device reports and follow up on the ones that missed it. Browsers and business apps get security fixes too, so track their updates the same way.
macOS has Gatekeeper and XProtect built in, and Apple updates them between macOS releases. Make sure your update settings let those background updates through. If your risk assessment calls for endpoint detection on top, test the extra tool on your own hardware and software before you roll it out. Security agents need system extensions and privacy permissions, and a clash with another tool may only show up on your setup.
Control apps and connections
Deploy apps through one agreed process, from sources you trust. Before you approve an app, review the system extensions and privacy permissions it asks for, and the access its vendor gets. An approved app can still expose data if it's set up badly, so look at its settings too.
Use encrypted connections, and set network access per service. Test the access rules that check who is signing in and what state the device is in. A blanket VPN rule can miss a stolen account or a leaky app, because it only controls the network path.
Track devices that fall outside the baseline
Keep a list of devices that haven't checked in, aren't encrypted or run a version outside your supported range. If compliance status decides who gets access, check how recent the report is first. Give each exception an owner and an expiry date.
If your security suite also watches for attacks, find out which component does that job and name the person who receives its alerts.
Practise recovery before you need it
Write down how staff report a lost device, how you revoke the sessions on it and how that person gets back to work. Test a restore from your backups while nothing depends on it. Decide in advance when you keep a device as evidence, when you cut it off from the network and when you erase it.
A remote lock or erase only works once the device receives the command, so it has to be online and still managed. Check that the command ran, and decide what you'll do about a device that never comes back online. Give staff one clear contact for security incidents.
Depending on what you run today, we begin with a review of your Apple security baseline or a test of your recovery steps.
Get new articles by email
Related articles
Endpoint protection for a managed Mac fleet
Your MDM controls how your Macs are set up. Noticing an attack on one of them is a separate job, and someone has to own it and act when an alert comes in.
How to compare Apple MDM platforms
Vendor websites help you draw up a shortlist. To choose from it, run the same everyday tasks on a test device on every platform and see how much work each one leaves for your team.
Apple device security under Swiss and EU data protection law
An MDM can turn on FileVault, require a passcode and record the state of your Macs, iPhones and iPads. Those settings and records help with data protection. Which legal duties you have, though, depends on the personal data you process and the risks that come with it.
