Device security guidance

Apple’s Automated Device Enrolment (ADE) provides a streamlined way to ensure your devices are automatically configured with your enterprise settings, right out the box. Devices can ship directly from the supplier to the end user and be ready to go without the intervention of an IT team. This ensures all devices have controls applied before connecting to company resources. To set this up, follow these steps: 

• Firstly, decide what hardware to use:
  • In 2020 Apple started to change the processors they use. Pre-2020 are only ‘Intel’, after 2023 all are ‘Apple Silicon’, which have models that start with M (M1, M2, M3 etc)
    • If using Intel, ensure they have a T2 security chip, as these provide better key protection for full disk encryption, stronger secure boot and better resistance to physical attacks.
    • All Apple Silicon devices have built-in security features similar to the T2.
    • macOS devices typically receive software updates for around 6-7 years after first release. Updates are no longer provided once a device is vintage or obsolete. At this point, you should purchase newer devices.
• Purchase devices from an Apple Authorised sales channel.
• Select a Mobile Device Manager (MDM) to use for your deployment.
• Register with Apple Business Manager and add your device supplier to your account. 
• Add your MDM and assign it as the default for your device type in Apple Business Manager.
  • Now when you purchase devices from your Apple authorised sales channel, devices will automatically enroll in your MDM during their initial setup.

Once your deployment is in place, your MDM can be used to enforce security controls by applying configuration profiles to managed devices. Essential profiles include:

• Enable encryption and escrow Activation Lock keys to your MDM solution. This ensures that only MDM admins can unlock encrypted devices.
• Set the screen to lock after 10 mins of inactivity.
• Enforce Gatekeeper. This is essential for preventing the accidental installation of malicious software. It ensures that only trusted apps (signed by identified developers or from the App Store) can be opened. You can deploy it in two modes:
  • Soft enforcement, where users can bypass restrictions by right-clicking and manually approving the app.
  • Hard enforcement, which disables the bypass entirely. 
• While soft enforcement can ease the transition, the long-term goal should be to move towards hard enforcement to ensure consistent protection.
• Enable automatic software updates for the Operating System and applications.
• Configure startup security policies, based on device type.
• Enable password policy.
• Enable other restrictions required by organisational policy.

macOS comes with a built-in anti-malware feature called xProtect. When Apple is aware of a malware strain that affects its operating system, it releases updated signatures to all up-to-date Mac devices. This provides coverage against known threats.

Organisations can add to xProtect with the following:

• A built-in AV solution from the MDM provider.
  • Most MDMs provide a native solution for monitoring xProtect. These solutions can read xProtect events and report them back to the MDM, giving administrators visibility into malware detections across the device fleet. Some advanced MDMs go a step further by analysing additional system events to identify signs of unknown or emerging threats.
• A third party Endpoint Detection and Response (EDR) solution, which provides deeper threat protection and response capabilities.

For full protection and visibility, it’s best to use both. xProtect can sometimes stop known threats before an EDR solution engages, so having visibility into xProtect events complements the endpoint data insights provided by EDR tools.

macOS natively supports several Virtual Private Networks (VPN) protocols, including IKEv2, L2TP over IPSec and Cisco IPSec. However, it does not support always-on VPN configurations out the box.

To enable always-on functionality or support additional protocols like OpenVPN, third-party applications are required. 

Apple’s iCloud service, which users log into using an Apple identity account (Apple ID), integrates with the operating system and provides many extra features to users, such as file, photo and password sync. These features are primarily designed for consumers and could conflict with enterprise control objectives such as data storage and residency requirements. 

Therefore, in an enterprise environment we do not recommend allowing users to use personal iCloud accounts.

There are several options for placing controls on iCloud accounts in the enterprise: 

• Disable access to the iCloud system setting.
  • This prevents users from signing in to an iCloud platform account, and can be achieved by using a restrictions MDM profile.
• Restrict what Apple IDs can be used for. 
  • In order to comply with organisational polices on data storage, restriction profiles can also be used to disable iCloud syncing features such as Keychain (passwords and passkeys), Photos and file syncing.
• Deploy Managed Apple IDs
  • Apple allows organisations to manage any Apple IDs created with a corporate email address. These Managed Apple IDs, configured in Apple Business Manager, offer limited enterprise controls and visibility. However it is currently not possible to enforce exclusive use of Managed Apple IDs across devices.

• macOS Security, Apple
• Platform Deployment Guide, Apple
• Guidance provided by your MDM vendor