Skip to content
Get packs

Guide · Open source

How to use the macOS Security and Privacy Guide: a checklist

Updated · written with AI from the project's own documentation and checked against our catalogue data

drduh's macOS-Security-and-Privacy-Guide is a long, community-written guide that lists techniques for improving the security and privacy of macOS on Apple silicon Macs. It is aimed at experienced users who want practices commonly used by organizations, though the README says novices interested in privacy and security can use it too. By the end of this tutorial you will know how the guide is organized, how to build a threat model before applying controls, and which areas to work through first.

macOS Security and Privacy Guidedrduh/macOS-Security-and-Privacy-Guide · ★ 22.6k · MIT

Quick start

  1. 1Read the scope. Confirm you have an Apple silicon Mac and that it is not organization-managed. If it is managed, use the NIST macOS Security Compliance Project instead.
  2. 2Build a threat model. List your assets and the adversaries you want to defend against, using the guide's Threat model section and example table.
  3. 3Cover the basics. Enable FileVault, keep software updated, and confirm your backups are encrypted and can be restored.
  4. 4Work through accounts and firmware. Follow the admin and user accounts, firmware and Lockdown Mode sections and apply what fits your model.
  5. 5Harden the firewall and network. Review the firewall, DNS, browser and VPN sections and apply the controls your threat model justifies.
  6. 6Check monitoring and miscellaneous items. Review the monitoring and Miscellaneous sections, then re-check your model when devices, data or adversaries change.

Read the guide and decide if it fits your Mac

The guide is read online at its homepage and is distributed as a repository on GitHub under the MIT licence. The README lists no prerequisites. It is written for Apple silicon Macs, so if you have an older Intel Mac the guide's scope does not cover it.

If your Mac is managed by an organization, the README points to the macOS Security Compliance Project from the U.S. National Institute of Standards and Technology instead of this guide.

  • Good fit: Mac owners who want a checklist of security and privacy settings to work through.
  • Good fit: people who want to build a threat model before choosing controls.
  • Not a fit: organization-managed Macs, or anyone who wants a one-click tool.

Start with the Basics and build a threat model

The Basics section lists general practices: keep the system and software up to date, enable FileVault, keep backups and verify them, and install software only from sources the developer identifies as official. Before changing settings, the guide asks you to create a threat model: what you want to protect, who might try to access it, and how.

The guide's example model is a table with Adversary, Motivation, Capabilities and Mitigation columns. It covers a roommate, a thief, a criminal, a corporation collecting data, and a nation state. Use it as a template for your own assets, ranked from most to least important.

  • List your assets, such as a laptop, credentials and browsing history.
  • For each adversary, note what they can and cannot realistically do.
  • Pick mitigations that counter a real capability, and stop when the remaining risk is acceptable.

Turn on FileVault and set up accounts

The guide lists FileVault as the way to encrypt internal storage. Its sections on admin and user accounts, firmware and first boot cover the setup that happens before you use the Mac day to day. Follow the guide's own sections on these topics and check each step against Apple's documentation linked from the guide.

Lockdown Mode and the firewall have their own sections, so you can decide whether each applies to your situation.

  • Enable FileVault to encrypt the internal drive.
  • Review the admin and user account caveats before you create accounts.
  • Read the firmware and Lockdown Mode sections and decide whether they match your threat model.

Configure the firewall, DNS and browser

The firewall section covers the application layer firewall, including stealth mode, signed apps, reloading the firewall and getting its state. It also describes third-party firewalls and a packet filter (pf) with an example configuration. DNS covers DNS profiles, the hosts file, DNSCrypt and Dnsmasq. Browser sections cover Firefox, Chrome and Safari.

The guide describes these as manual techniques. Make one change at a time and test that your everyday apps still work.

  • Read the application layer firewall section and its stealth mode subsection.
  • Choose a DNS approach from the DNS section, such as DNS profiles or DNSCrypt.
  • Apply browser settings for the browser you use most.

Review backups, monitoring and miscellaneous settings

The guide advises encrypting backups before copying them to external media or third-party cloud storage, and verifying them on a schedule. Its monitoring section covers logs, DTrace, processes, Endpoint Security, install history and network tools, with Wireshark listed for network inspection.

The Miscellaneous section covers items such as the screensaver, diagnostic data, Finder options and sudoers. Work through these last, once the higher-priority items are in place.

  • Encrypt backups before storing them off the Mac.
  • Schedule regular backup checks and a test restore.
  • Use the monitoring section to learn what to look at, then pick tools that suit you.
git clone https://github.com/drduh/macOS-Security-and-Privacy-Guide

What people use it for

  • Working through a personal MacBook with Apple silicon as a checklist of security and privacy settings.
  • Building a written threat model for a laptop used for work and personal browsing.
  • Learning which controls organizations commonly use before adopting them at home.
  • Comparing manual firewall and DNS options before choosing a tool.

Frequently asked questions

Is macOS-Security-and-Privacy-Guide free to use?

The repository is licensed under MIT, and the guide is read online at its homepage. The source does not list any price.

What do I need to use this guide?

The README lists no prerequisites. It targets Apple silicon Macs, and the guide is a set of manual techniques rather than an installed program.

Do I need to clone the repository to read it?

No. The guide is read online at its homepage. The README also gives a command to clone the repository with git clone https://github.com/drduh/macOS-Security-and-Privacy-Guide if you want a local copy.

Can I use this guide on an older Intel Mac?

The README frames the guide's scope around Apple silicon, so it does not provide guidance for older Intel Macs. Check the guide's current scope before relying on it for an Intel machine.

Is this guide a good alternative to a security tool?

No. It is a set of manual techniques and the guide states you are solely responsible for any consequences of following it. Comparable projects named in the source include the NIST macOS Security Compliance Project, Objective-See macOS tools and Lynis.

Should I use this on a work Mac?

If the Mac is organization-managed, the README points to the NIST macOS Security Compliance Project instead of this guide.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This guide suits Mac owners with Apple silicon machines who want a long, manual checklist and are willing to build a threat model first. It is less suitable if you want one-click protection, need guidance for an Intel Mac, or manage an organization's devices, where the NIST project is the pointer the README gives.

Install options & downloads