Unit 1: How a Mac protects itself · Lesson 1 of 5 · 18 min
The layers of a Mac
Take stock of a baseline company Mac: its chip, its macOS version and the protections that are on by default.
mission
- You are
- You are the new IT security lead at Lumen Studio, a 70 person design and app studio that runs entirely on Macs.
- Situation
- Before you can spot a broken Mac you need to know what a healthy one looks like. Sam from IT lends you lumen-mbp-02, built to the studio baseline.
- Goal
- Record the version, hardware and default protections of a known good Mac.
- Hand in
- A short baseline card: macOS version, chip, SIP, sealed system volume, Activation Lock.
A Mac as a building with sealed floors
Read the version
Every investigation starts with the exact macOS version, because patches and features depend on it.
sw_vers
ProductName: macOS
ProductVersion: 27.0
BuildVersion: 26A428
you should see macOS 27.0, the Golden Gate release that shipped on 14 September 2026.
defender tip Golden Gate runs only on Apple silicon. Intel Macs stay on Tahoe 26.x and receive security updates only.
Read the hardware
The chip decides which protections exist. Apple silicon brings secure boot, the Secure Enclave and per-file encryption keys.
system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: MacBook Pro
Chip: Apple M4 Pro
Total Number of Cores: 12 (8 performance and 4 efficiency)
Memory: 24 GB
System Firmware Version: 20457.1.29
OS Loader Version: 20457.1.29
Serial Number (system): K4L9QX2M7T
Provisioning UDID: 00008132-000A1C2E3F40801E
Activation Lock Status: Enabled
you should see An Apple M4 Pro, its firmware version and Activation Lock status.
Check the two system guards
SIP keeps even root away from system files. The authenticated root check confirms the system volume seal is enforced.
csrutil status System Integrity Protection status: enabled. csrutil authenticated-root status Authenticated Root status: enabled
you should see Both enabled. On a company Mac anything else is a finding.
What a defender takes away
- 1macOS stacks hardware, boot, system and app protections; attackers usually go around them, not through.
- 2Record version and chip first, every time.
- 3SIP and the sealed volume should never be off on a production Mac.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.