A community-maintained hardening guide that walks macOS users through threat modeling, FileVault, pf firewalls, and privacy controls for defending authorized personal and corporate Macs.

Unlike the typical single-purpose utility that lands in this column, drduh/macOS-Security-and-Privacy-Guide is a long-lived community reference — around 22,500 stars on GitHub, MIT-licensed, with Shell as its dominant language for the snippets it embeds — that has become something of a canonical text for defensive macOS work. It is written for experienced users who want the security practices commonly used by organizations, but the author is careful to note it is also approachable for novices with an interest in privacy. For penetration testers and red teamers, its real value is as a mirror: it is an accurate picture of what a well-hardened target Mac looks like, which is exactly the baseline you need before assessing anything.

The guide opens with a discipline most security literature skips: explicit threat model construction. It walks through defining Assets, Adversaries, Capabilities, and Mitigations, and insists that every mitigation must counter some specific adversarial capability to justify its usability cost. That framing — stop adding defenses when residual risk is acceptable, revisit when devices, data, travel, or adversaries change — is textbook OWASP threat modeling applied to a personal endpoint, and it keeps the rest of the document from degenerating into a checklist of paranoid toggles with no rationale.

The example threat model table is worth reading closely because it ranks adversaries from a Roommate through a Thief, a generic Criminal, a data-hungry Corporation, and finally a Nation State/APT. Each row pairs motivation with realistic capability and a proportionate mitigation, from biometric locks and privacy screens up to diceware credentials, secure-element hardware, full shutdowns to clear credentials from memory, and canary tokens for tripwire alerts. This is a useful pedagogical device: it makes explicit that the defenses appropriate against commodity malware are not the defenses appropriate against targeted surveillance.

On hardware, the guide is unambiguous that Apple silicon is the preferred platform, citing Secure Enclave-based key protection and stronger boot security options, and warning that some Intel Macs — particularly certain T2-era models — carry hardware vulnerabilities that no macOS update can fully remediate. It also advises against non-Apple hardware running macOS and against systems that cannot run the latest release, since Apple does not backport patches to legacy versions. Small operational details matter here too: Apple accessories receive firmware updates through macOS and support current Bluetooth security features like BLE Privacy with rotating device addresses, which third-party accessories may lack — a subtle tracking vector most users never consider.

The table of contents reads like a full-lifecycle hardening runbook: Installing macOS, First boot, Admin and user accounts, Firmware, FileVault, Lockdown Mode, Firewall, Services, Homebrew, DNS, Certificate authorities, Privoxy, Browser, Tor, VPN, PGP/GPG, Email, Messengers, Malware, System Integrity Protection, Metadata and artifacts, Authentication, Backup, Wi-Fi, SSH, Physical access, and an extensive Monitoring section. The ordering is deliberate — the guide assumes you can still control the installation process, which is why system activation, Apple Account creation, and even the question of whether to use the App Store at all are treated as security decisions rather than conveniences.

The Basics section distills the essentials: apply updates through System Settings or the softwareupdate CLI — helpfully noting neither requires an Apple Account — subscribe to Apple's security-announce mailing list, enable FileVault for full-disk encryption, use a password manager, and maintain encrypted, regularly verified backups. The emphasis on actually restoring from backups on a scheduled basis, and on encrypting Time Machine media or choosing an end-to-end encrypted backup service before data leaves the device, reflects a data-availability mindset that pure hardening guides often forget.

Network defense gets granular coverage. The Firewall chapter spans the application-layer firewall — including Stealth mode, enforcement for Signed apps, how to Reload firewall and Get state, and AirDrop implications — third-party firewall options, and the underlying packet filter with an Example pf config, Firewall commands, and techniques to Block networks. DNS hygiene is treated as its own attack surface, with sections on DNS profiles, the /etc/hosts file, DNSCrypt, and Dnsmasq, plus adjacent privacy tooling like Privoxy, Tor, and VPN selection. For defenders, this chapter doubles as a map of the telemetry worth watching on managed Macs: unexpected pf rule changes or new DNS profiles are high-signal events.

The Malware section situates Apple's layered execution controls — App Sandbox, Hardened Runtime, Gatekeeper, and System Integrity Protection — within a sane software-sourcing policy, repeating the OWASP-adjacent advice to install software only from sources the developer identifies as official. App Store applications are generally required to use App Sandbox and Hardened Runtime, which constrains blast radius even when a reviewed app turns hostile. The Monitoring chapter closes the loop for blue-team readers, covering unified Logs, DTrace, Processes, the Endpoint Security framework, Install History, and network observation with Wireshark — effectively the detection counterpart to every hardening step above.

For organization-managed fleets, the guide sensibly defers to the macOS Security Compliance Project maintained by NIST rather than duplicating enterprise baseline work, and it is honest about its own limitations with a blunt as-is disclaimer reminding readers they are solely responsible for consequences. That humility, combined with heavy citation of primary Apple support and Platform Security documentation rather than folklore, is what separates this guide from the sea of copy-pasted macOS hardening gists. Every recommendation is anchored either to an Apple-published mechanism or a clearly reasoned trade-off.

Where this fits in an authorized workflow: as a pre-engagement checklist for consultants who carry client data on Macs, as a build spec for a clean analysis VM or forensics workstation, and as an attack-surface inventory for anyone doing authorized macOS assessments — if a control in this guide is absent on a target you are licensed to test, that absence is a finding. As a pure defensive artifact with no offensive capability, it carries no operational risk; the only caution is the usual one for community-maintained docs, which is that specific toggle locations drift between macOS releases, so verify each step against current Apple documentation before applying it fleet-wide. Clone it with git clone https://github.com/drduh/macOS-Security-and-Privacy-Guide and keep it in your assessment library.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.