How to Enhance macOS Security Settings: Complete Guide

Introduction / Why This Is Needed

macOS is renowned for its built-in security mechanisms, but achieving maximum protection requires manual configuration of several key components. This guide will walk you through the essential steps: disk encryption, network traffic filtering, system file protection, application installation control, and access key management. Upon completion, you will have a system resilient against data loss, unauthorized access, and attacks.

Requirements / Preparation

Before you begin, ensure that:

• You have macOS 12 Monterey or newer installed.
• You are logged in with an administrator account.
• A backup of important data has been created (e.g., via Time Machine)—some settings will require a restart.
• Access to a stable internet connection for downloading updates.

Step 1: Enable FileVault for Disk Encryption

FileVault uses AES-128-XTS to encrypt the entire disk. If your Mac is lost or stolen, your data will remain inaccessible without the password.

1. Open System Settings → Privacy & Security → FileVault.
2. Click Turn On FileVault.
3. Choose an unlock method: your account password or your iCloud account. For security, using a password is recommended.
4. The encryption process will begin. The time required depends on disk size and system activity. Do not interrupt the process.

💡 Tip: If there are multiple user accounts on the Mac, add them to the list of users who can unlock the disk by clicking "Enable Users…".

Alternatively, via Terminal (requires administrator password):

sudo fdesetup enable

Step 2: Configure the Firewall for Network Protection

The built-in Firewall filters incoming connections, blocking unauthorized access to network services.

1. In System Settings → Network, select your active connection (Wi-Fi or Ethernet).
2. Click the Firewall button.
3. Ensure the Firewall is enabled (green indicator). If not, click Turn On.
4. Click Options for detailed configuration:
   • Automatically allow built-in software—leave enabled.
   • Automatically allow downloaded signed software—enable this.
   • Enable stealth mode—recommended to hide your Mac from network scanners.
   • Add applications that require incoming access (e.g., game servers) by clicking +.

Check the Firewall status in Terminal:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

A return value of 1 means it is enabled.

Step 3: Verify and Enable System Integrity Protection (SIP)

SIP protects system directories (e.g., /System, /usr) from modification, even by the root user. This is the foundation of macOS integrity.

1. Restart your Mac and immediately press Command (⌘) + R to enter Recovery Mode.
2. Open Utilities → Terminal.
3. Check the current status:

   csrutil status
   

   Expected output: System Integrity Protection status: enabled.
4. If SIP is disabled, enable it:

   csrutil enable
   

5. Restart your Mac normally.

⚠️ Important: Enabling SIP may break the functionality of third-party utilities that modify the system (e.g., certain drivers or older versions of Wine). Ensure compatibility with your software.

Step 4: Configure Gatekeeper for Application Control

Gatekeeper verifies the digital signature and notarization of applications, blocking potentially malicious software.

1. Open System Settings → Privacy & Security → General.
2. In the Allow apps downloaded from section, select:
   • App Store—only the official store.
   • App Store and identified developers—optimal balance (recommended).
   • Anywhere—disables checks, not recommended.
3. For individual apps from unknown sources, you can add an exception: an alert will appear when you try to launch it; click Open Anyway.

Via Terminal, you can change this setting:

sudo spctl --master-enable  # Enable Gatekeeper (App Store and identified developers)

Complete disable (not recommended):

sudo spctl --master-disable

Step 5: Set a Password for Access Keys (Keychain Access)

Access keys in Keychain Access store passwords, certificates, and Secure Notes. A password adds a layer of protection when accessing this data.

1. Launch Keychain Access (via Spotlight or /Applications/Utilities).
2. From the menu, select Edit → Change Settings for Keychain "login"….
3. Enter a new password (it is recommended to use the same one as your user account or a more complex one).
4. Confirm the password.
5. Now, a password will be requested every time you access your keychain (e.g., when autofilling a password in a browser).

💡 Tip: The keychain password cannot be recovered. Write it down in a secure place or use a password manager (e.g., Bitwarden or 1Password).

Step 6: Enable Automatic Updates

Regular updates patch known vulnerabilities. Configure automatic installation.

1. In System Settings → General → Software Update.
2. Toggle on:
   • Automatically keep my Mac up to date.
   • Automatically update apps downloaded from the App Store.
   • Install security updates automatically.
3. Click Advanced to schedule a time for installation (e.g., overnight).

Via Terminal:

sudo softwareupdate --schedule on  # Enable automatic updates

Verification

After configuration, verify that all components are functioning correctly:

• FileVault: System Settings → Privacy & Security → FileVault. Status should be "FileVault is On."
• Firewall: System Settings → Network → Firewall. Indicator should be green. Or in Terminal: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate will return 1.
• SIP: In Terminal, run csrutil status. It should return enabled.
• Gatekeeper: System Settings → Privacy & Security → General. The "Allow apps downloaded from" section should be set to "App Store and identified developers" or stricter.
• Access Keys: Try opening Keychain Access—it should prompt for a password.
• Updates: System Settings → Software Update. All toggles should be enabled.

Comprehensive check via Terminal:

# FileVault
sudo fdesetup status

# Firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

# SIP
csrutil status

# Gatekeeper
spctl --status

Potential Issues

FileVault Fails to Enable

• Insufficient free space: Encryption requires 10-20% free space. Free up disk space.
• Recovery not configured: Ensure "iCloud Recovery" is enabled in System Settings → Apple ID → iCloud, or a local recovery key has been created.

Firewall Blocks a Needed Application

• Open System Settings → Network → Firewall → Options and add the application to the "Allow incoming connections" list.
• Temporarily disable the Firewall for diagnosis: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off (not recommended for permanent use).

SIP Fails to Enable or Disables After an Update

• Ensure you are in Recovery Mode (press Command+R at startup).
• Some utilities (e.g., for installing unofficial drivers) may disable SIP. Check if such tools are in use.
• If the problem persists, reset the NVRAM: shut down your Mac, turn it on, and immediately press Option+Command+P+R for 20 seconds.

Gatekeeper Allows a Malicious Application

• While Gatekeeper checks signatures, some malware may be signed. Additionally, use an antivirus for macOS (e.g., Malwarebytes) and do not completely disable Gatekeeper.
• Regularly review the list of installed applications in the "Applications" folder and remove unnecessary ones.

Forgot the Keychain Password

• Unfortunately, the keychain password cannot be recovered. You will need to reset the default keychain: in Keychain Access, go to the Edit menu → Reset Keychain "login". This will delete all saved passwords and certificates. It is recommended to use a password manager to store critically important data.

Automatic Updates Not Working

• Ensure your Mac is connected to the internet and not in power-saving mode (plugged into power).
• Check the update history: sudo softwareupdate --history.
• If updates are stuck, restart your Mac and try again. As a last resort, install updates manually from the Apple website.