Harden macOS
Overview
Strengthen the actual exposure found on the Mac and verify each change. Preserve built-in protections, user access, recoverability, and organization management requirements.
Read references/macos-hardening-review.md for a risk-ordered review.
Workflow
- Establish context.
- Record exact macOS build/hardware, device ownership/management, users, role, exposed services, sensitive data, backups, and the threat being reduced.
- Apply supported updates.
- Verify OS, rapid/security data updates, browsers, extensions, apps, and package managers from authoritative channels.
- Preserve platform protections.
- Verify Gatekeeper/XProtect automatic protection, SIP, TCC/privacy access, code-signing expectations, and sandbox/container use where applicable.
- Keep this defensive posture review separate from developer prompt/request implementation; route ordinary app permission design to
macos-privacy-permissions-workflow.
- Protect data and recovery.
- Review FileVault/recovery ownership, screen lock, backup availability and restore testing, account separation, and secure disposal/export practices.
- Reduce exposed services and persistence.
- Review sharing, remote login/management, firewall policy, listeners, login/background items, profiles, system/network/browser extensions, and privileged helpers.
- Improve identity/browser behavior.
- Review MFA, password manager use, recovery methods, session/token hygiene, download sources, extensions, phishing-resistant habits, and administrator use.
- Add proportionate visibility.
- Define which alerts/logs or endpoint tooling are maintained, who reviews them, and how false positives are handled.
- Verify and document.
- Re-read changed settings, test access/recovery, record exceptions and owner, and avoid claiming perfect prevention.
Output
Return baseline, prioritized changes, applied/verified settings, deferred items and tradeoffs, recovery check, and residual risk.
1---2name: harden-macos3description: Review and improve macOS defensive posture. Use for updates, XProtect and Gatekeeper, FileVault, firewall, remote access, accounts, background items, privacy, backups, credentials, and monitoring after a security assessment or incident.4---56# Harden macOS78## Overview910Strengthen the actual exposure found on the Mac and verify each change. Preserve built-in protections, user access, recoverability, and organization management requirements.1112Read [references/macos-hardening-review.md](references/macos-hardening-review.md) for a risk-ordered review.1314## Workflow15161. Establish context.17 - Record exact macOS build/hardware, device ownership/management, users, role, exposed services, sensitive data, backups, and the threat being reduced.182. Apply supported updates.19 - Verify OS, rapid/security data updates, browsers, extensions, apps, and package managers from authoritative channels.203. Preserve platform protections.21 - Verify Gatekeeper/XProtect automatic protection, SIP, TCC/privacy access, code-signing expectations, and sandbox/container use where applicable.22 - Keep this defensive posture review separate from developer prompt/request implementation; route ordinary app permission design to `macos-privacy-permissions-workflow`.234. Protect data and recovery.24 - Review FileVault/recovery ownership, screen lock, backup availability and restore testing, account separation, and secure disposal/export practices.255. Reduce exposed services and persistence.26 - Review sharing, remote login/management, firewall policy, listeners, login/background items, profiles, system/network/browser extensions, and privileged helpers.276. Improve identity/browser behavior.28 - Review MFA, password manager use, recovery methods, session/token hygiene, download sources, extensions, phishing-resistant habits, and administrator use.297. Add proportionate visibility.30 - Define which alerts/logs or endpoint tooling are maintained, who reviews them, and how false positives are handled.318. Verify and document.32 - Re-read changed settings, test access/recovery, record exceptions and owner, and avoid claiming perfect prevention.3334## Output3536Return baseline, prioritized changes, applied/verified settings, deferred items and tradeoffs, recovery check, and residual risk.
gaelic-ghost