Security and auditing are critical aspects of any computing environment, including macOS. These processes ensure that systems are protected from unauthorized access and that any actions taken on the system are logged for future review. This article will guide you through the steps to implement security measures and auditing on macOS, using built-in tools and commands. The adjustments made to align this topic with the macOS environment include using Terminal commands and macOS-specific tools.

Examples:

1. Enabling FileVault for Disk Encryption

   FileVault is a built-in encryption program for macOS that uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk.

   • Enable FileVault via System Preferences:

     1. Open System Preferences.
     2. Click on "Security & Privacy".
     3. Go to the "FileVault" tab.
     4. Click on the lock icon and enter your admin password.
     5. Click "Turn On FileVault".

   • Enable FileVault via Terminal:

     sudo fdesetup enable

2. Setting Up Firewall

   The macOS firewall can help prevent unauthorized applications, programs, and services from accepting incoming connections.

   • Enable Firewall via System Preferences:

     1. Open System Preferences.
     2. Click on "Security & Privacy".
     3. Go to the "Firewall" tab.
     4. Click on the lock icon and enter your admin password.
     5. Click "Turn On Firewall".

   • Enable Firewall via Terminal:

     sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

3. Configuring Auditing with auditd

   macOS includes the auditd daemon, which provides a comprehensive audit trail of system activity.

   • Enable and Configure auditd:

     1. Open Terminal.
     2. Edit the audit configuration file:

        sudo nano /etc/security/audit_control

     3. Add or modify the following lines to set the audit flags:

        dir:/var/audit
        flags:lo,ad

   • Start the auditd Service:

     sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist

4. Reviewing Audit Logs

   • View Audit Logs:

     sudo praudit /var/audit/current

   • Search Specific Events:

     sudo ausearch -m USER_LOGIN