The Mac security settings that actually matter

Twenty-four checks, ordered by how much they matter, each with the command to run and where to fix it.

Most Mac security advice is a list of twenty settings with no sense of which ones matter. These are the checks worth actually running, each with the command to check it and where to fix it. All of them run as a normal user.

The five that matter most

FileVault

fdesetup status

Without it, anyone who takes the machine reads the disk. This is the single highest-value setting on the list. System Settings, Privacy & Security, FileVault.

Firewall, and stealth mode

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

The firewall blocks unexpected inbound connections. Stealth mode goes further and stops your Mac answering probes at all, so it does not show up in a scan of the café network. Stealth is off by default. System Settings, Network, Firewall, Options.

Screen lock delay

sysadminctl -screenLock status

A five-minute grace period means a five-minute window for anyone who walks past your open laptop. Immediate, or close to it. System Settings, Lock Screen.

Apps listening on all interfaces

lsof -nP -iTCP -sTCP:LISTEN | grep -E '\*:|0\.0\.0\.0'

Anything bound to * or 0.0.0.0 is reachable by every device on your current network. Development servers are the usual offenders. Bind them to 127.0.0.1.

Sharing services

Screen Sharing, Remote Login and File Sharing left on from one occasion and never turned off are a standing invitation on any network you later join. System Settings, General, Sharing.

The ones that are usually fine, and worth confirming

Gatekeeper and System Integrity Protection

spctl --status
csrutil status

Both on by default. If either is off, something or someone turned it off deliberately, and that is worth understanding.

Malware definitions

defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString

XProtect is Apple's built-in scanner and it updates silently. What matters is the age of the file, not the number. If it has not changed in a couple of months, updates are not reaching the machine.

Automatic updates

defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled

The ones nobody checks, that matter more than they look

Custom root certificates

security dump-trust-settings -d

A certificate authority added to your Mac's trust store can issue a certificate for any website and your Mac will accept it. That is total visibility into your encrypted traffic. On a personal machine this should be empty. A corporate profile or a debugging proxy such as Charles or mitmproxy will add one, which is fine if you know about it.

Configuration profiles

profiles list

Profiles can set proxies, install certificates, and change security settings. On a personal machine you should recognise everything listed.

What runs automatically

ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
launchctl list | grep -v com.apple

Establishing persistence is the step nearly all malware has to take, and it is also what every legitimate installer does. The point is not that entries exist; it is whether you recognise them.

AirDrop visibility

Set to Everyone, strangers can send you files in public. Contacts Only is the sensible default. Control Centre, AirDrop.

Your Mac's name

scutil --get ComputerName

This is broadcast on every network you join. "Sai's MacBook Pro" tells a room full of strangers your name and what hardware you carry.

Guest account and automatic login

defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled

Automatic login in particular defeats FileVault's protection against someone who opens the lid.

Doing this continuously instead of once

The problem with a checklist is that it is a snapshot. Settings drift, installers add launch agents, you turn on Screen Sharing for one call and forget, and the network changes several times a day.

Argus runs these twenty-four checks continuously and shows them on one board from the notch, and tells you when any of them change. It is free, open source, and makes no network connections.