Unit 1: How a Mac protects itself · Lesson 3 of 5 · 16 min
Secure boot and the boot policy
Follow the chain of checks from the Boot ROM to the sealed system and learn which settings an attacker would need to change.
mission
- You are
- You are the IT security lead at Lumen Studio.
- Situation
- Your insurer asks how you know a Mac boots only genuine macOS. You want a one page answer backed by what the Mac itself reports.
- Goal
- Explain the boot chain and read the firmware details that prove which boot code ran.
- Hand in
- One paragraph for the insurer and the firmware version of the baseline Mac.
Secure boot as a relay of sealed envelopes
Read the firmware versions
Firmware is updated with macOS. Mismatched or old firmware on a current macOS is a sign something is off.
system_profiler SPHardwareDataType | grep -E 'Firmware|Loader'
System Firmware Version: 20457.1.29
OS Loader Version: 20457.1.29
you should see Both System Firmware and OS Loader report the same version.
Know where the policy lives
Boot security is set per volume in Startup Security Utility, inside Recovery. Lowering it requires an administrator's password and physical access to Recovery, and it is reported to MDM.
you should see Full Security is the default and the right setting for company Macs.
defender tip Ask your MDM for the boot security mode of every Mac. Reduced Security on a Mac that does not need kernel extensions is a finding.
Full and Reduced Security
Startup Security Utility Reduced Security Allow user management of kernel extensions
Older or third-party kernel extensions can load. Needed rarely, by specific hardware.
Startup Security Utility Full Security Only the current signed OS
Only the current, Apple-signed macOS can start.
What a defender takes away
- 1Each boot stage verifies the next, starting from code in the chip.
- 2Boot policy can only be lowered from Recovery, by an admin.
- 3Ask MDM for boot policy across the fleet, not one Mac at a time.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.