Unit 01 · 1 h 32 min
How a Mac protects itself
Meet the layers Apple builds into every Mac, check each one from Terminal and see why patching still matters.
macOS Security
Defend Macs the way attackers actually reach them: fake installers, paste-into-Terminal lures, stolen sessions and trusted apps gone bad.
- Time
- 14 h 26 min
- Lessons
- 45
- Machine
- In your browser
What you earn
RootCertificatemacOS Security, certificate of completion AppleACSPApple Certified Support Professional
Prepares you for Apple Certified Support Professional. Root is not affiliated with these issuers.
You will be able to
- Explain SIP, the sealed system volume, secure boot and the sandbox
- Judge any app by its signature, notarization and quarantine trail
- Audit privacy permissions and persistence on one Mac or a fleet
- Investigate infostealers with the unified log and build a timeline
- Harden Macs and enforce the baseline with MDM and declarations
Units and lessons
Unit 02 · 1 h 38 min
Apps, signatures and Gatekeeper
Check who signed an app, whether Apple notarized it and where it came from, on a designer's Mac that has three suspects.
Unit 03 · 1 h 32 min
Privacy permissions (TCC)
Audit which apps can see the screen, control the Mac or read protected folders, on one Mac and across the fleet.
- 1How macOS asks for permission18 min · virtual lab
- 2The powerful grants: screen, Accessibility, Full Disk Access20 min · virtual lab
- 3Auditing grants across the fleet18 min · virtual lab
- 4Case file: the fake password prompt20 min · virtual lab
- 5Resetting grants and managing them with MDM16 min · virtual lab
Unit 04 · 1 h 32 min
Persistence: what starts on its own
Hunt the LaunchAgents, daemons, login items and profiles that make malware survive a restart, on Maya's Mac.
Unit 05 · 1 h 22 min
Infostealers and fake installers
Understand the biggest threat to Macs today, investigate two infections and decide what to rotate first.
Unit 06 · 1 h 38 min
The unified log and investigation
Query the unified log, read install history and build a minute-by-minute timeline of an infection.
Unit 07 · 1 h 34 min
Hardening a Mac
Audit and fix a Mac against the baseline: encryption, firewall, sharing, updates, accounts and theft protection.
Unit 08 · 1 h 54 min
Managing a fleet
Use MDM, profiles, declarations and EDR to keep 30 Macs on the baseline and catch what slips through.
- 1MDM and enrollment16 min · virtual lab
- 2Configuration profiles and declarations18 min · virtual lab
- 3Compliance across 30 Macs22 min · virtual lab
- 4What an EDR sees on macOS20 min · virtual lab
- 5Case file: a trusted app turns20 min · virtual lab
- 6Case file: the editor extension that updated itself18 min · virtual lab
Unit 09 · 1 h 44 min
Capstone: the interview that was not
Investigate a developer's Mac compromised through a fake job interview, from the first email to the report.
Nine units around one design studio's Mac fleet, built on real incidents. Every lab runs in your browser on evidence from simulated Macs.