Most of us understand the need for strong passwords to protect our accounts and devices from unauthorized access. We may, however, neglect to take advantage of additional security features offered by software and hardware manufacturers.
Apple provides several built-in tools you can use to safeguard your Mac from thieves, malicious operators, and anyone else who shouldn’t have access to your personal data. These features are easy to use, simple to set up, and can save you future trouble if someone does target your device. Let's take a look at some of the most important.
1. Secure Your Data With FileVault
In recent versions of macOS, Setup Assistant prompts you to activate FileVault during the installation process. Those unfamiliar with the feature may avoid turning it on if they don't understand it, and those rushing through the setup process may not even notice the option.
FileVault adds an extra layer of security, beyond your admin user account password, by encrypting the entire macOS volume. This means no one can access the data on your hard drive without the decryption password.
The extra protection prevents unauthorized individuals from physically accessing the contents of your computer. Without FileVault enabled, a savvy user can bypass your admin user account and help themselves to your files, as long as they have access to your drive.
Fortunately, using FileVault is a simple and effective way to increase device security and protect your data. To enable encryption, follow these steps:
- Open System Preferences.
- Choose Security and Privacy.
- Select the FileVault tab.
- Unlock the Security Padlock.
- Click Turn On FileVault.
If your device has multiple users, you must select Enable User for each account that should have permission to unlock the disk.
Click Continue, and a prompt will appear asking how you’d prefer to reset your FileVault password if you forget it. For this, you have two options: using your Apple ID/iCloud account, or with a generated recovery key. Both options come with a warning. If you choose to use iCloud as a reset method, you should have strong security on that account. Alternatively, if you prefer to generate a recovery key, you must keep it in a safe place that no one but you can access.
Locking yourself out of an encrypted volume means erasing the entire drive to regain access, so you’ll want to be diligent with your password and recovery method.
When enabled for the first time, FileVault works in the background to encrypt your drive. You should connect your device to power and allow the process to complete. Encryption time varies based on the size of your hard drive, and it’s best not to interrupt the procedure. Once completed, your newly encrypted volume will make it difficult for would-be data thieves to physically access your personal information.
2. Protect Your Mac With a Firmware Password
A firmware password adds an additional layer of security to your device. When enabled, the feature prompts you for a password whenever you try to boot from an alternate volume, such as the recovery partition, attached external storage, or when using most Mac startup key combinations.
By default, unauthorized users can take advantage of certain Mac features, such as recovery or single-user mode, to tamper with your device. But a firmware password prohibits access to those areas.
Because newer versions of FileVault include similar protection measures, Apple Silicon Macs no longer require a firmware password. However, many people still have Macs with Intel chips, so can benefit from the extra security.
To set a firmware password on an Intel Mac, boot to your recovery partition by holding Cmd + R during startup and follow these instructions:
- Click the Utilities menu.
- Choose Startup Security Utility or Firmware Password Utility.
- Enter a strong password you’ll remember.
- Restart your Mac from the Apple menu.
That’s it. A firmware password now protects your device from unauthorized tampering and provides the ideal complement to FileVault encryption.
Remembering your firmware password is critical. If you forget what you entered, regaining access to your device will require proof of purchase, a trip to an Apple Authorized Service Provider, and a bill for the trouble.
This strict process ensures only the device owner can request to remove the security feature when required. We recommend noting down your firmware password in a password manager.
3. Use Find My Mac to Track, Lock, and Wipe Your Device
Find My Mac is the ultimate technological defense against thieves. The iCloud feature allows you to track your Mac if it goes missing, remotely lock your device with a firmware password, and wipe your hard drive to protect its data. You can even check the battery level of a snatched device so you know when and where it’s going to lose power.
There's no good reason to avoid using Find My Mac, and setting up the feature only takes a few minutes. Here's how to configure it:
- Open System Preferences.
- Choose Apple ID or Internet Accounts.
- Select iCloud from the list.
- Tick Find My Mac, then Allow access.
To use Find My Mac’s features, navigate to iCloud.com, sign in, and choose Find iPhone. From here, you can access a list of your devices and perform the necessary actions.
Find My Mac is such an important feature because it not only helps you protect and recover a lost or stolen device, but it also deters thieves by its very existence. If more users adopt this and similar security features, stealing a computer, phone, or other protected device becomes a pointless act.
4. Apple ID Two-Factor Authentication
Enabling two-factor authentication for all your accounts, including your Apple ID, is a simple and effective way to increase security. While most people are familiar with this measure, some have yet to adopt the feature. A secure Apple ID is paramount to overall device security, as access to the account allows anyone to reset the FileVault password and disable Find My Mac.
If you haven’t enabled two-factor authentication on your Apple ID, we strongly recommend you do so now. The quickest way to set up the feature is through the Apple ID panel in System Preferences. Simply choose the Password and Security option and follow the prompts.
5. System Integrity Protection
While the above tools require your activation, Apple also provides automatic security features in macOS, including System Integrity Protection (SIP).
SIP, introduced in El Capitan (macOS 10.11), prevents the root user account and malicious operators from modifying important parts of the system. The feature runs automatically and doesn’t require any additional setup. With SIP in place, only Apple processes have the authority to modify system files, restricting the damage malicious operators can do if they gain access to your system.
While SIP is an automatic function, devices running a version of macOS earlier than 10.11 are missing the feature. If you're using an outdated operating system, we highly recommend upgrading unless you have a good reason not to do so. If you can't upgrade, it's probably time to replace your Mac.
Is Your Mac Secure?
When it comes to Mac security, Apple provides a fleet of useful tools. FileVault encrypts your hard drive to protect your data, and a firmware password for devices running Intel chips adds an extra layer of security. iCloud’s Find My Mac feature is an invaluable tool for deterring thieves and managing lost or misappropriated devices.
Meanwhile, enabling Apple ID two-factor authentication is one of the first steps a security-conscious user should take, as it helps strengthen other protection measures on your Mac. SIP prevents unauthorized tampering at the system level and is an automatic feature integrated into macOS 10.11 and later.
On its own, each tool provides notable security benefits. But using these features in combination turns your Mac into a near-impenetrable fortress.