Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User...
Transcript of Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User...
![Page 2: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/2.jpg)
Chris MillerAsst. Director Technology Services Eanes ISD
@EdTechChris EdTechChris.com
Shout out to my Apple SE:
![Page 3: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/3.jpg)
How can macOS keep our teachers and our kids safer?
![Page 4: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/4.jpg)
Security is a ProcessIt’s about the journey
Privacy & Usability v. Security
Shifting Paradigms
![Page 5: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/5.jpg)
Traditional ApproachWide open, standard OS architecture
Extensive “add-on” solutions for security
Increase security by disabling functionality
![Page 6: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/6.jpg)
Modern Security ApproachDesigned for mobility
Security built in, not bolted on
Optimal user experience
![Page 7: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/7.jpg)
System Security
Data Security
App Security
![Page 8: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/8.jpg)
System Security
![Page 9: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/9.jpg)
System Security
Integrated hardware and software
Services off by default
Access permissions
System integrity protection
X Protect
Data Path Randomization
![Page 10: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/10.jpg)
User Types
Admin UsersOS X macOS
![Page 11: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/11.jpg)
User Types
Admin Users Standard Users
![Page 12: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/12.jpg)
Software UpdatesOne of the most important practices for security on any OS
Updates are provided for all supported devices for free
Organizations can prompt a device to download and install updates through MDM*
Supports multiple generations
3
![Page 13: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/13.jpg)
System Integrity Protection
Includes protection for these parts of the system:
• /System• /usr• /bin• /sbin• Apps that are pre-installed with
OS X
![Page 14: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/14.jpg)
X Protect
• Virus & Malware Detection
• File Quarantine Aware
• Checks content against a plist of known vulnerabilities
![Page 15: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/15.jpg)
Mobile Device Management
Secure device configuration
Configuration profiles can be locked, signed and encrypted
XML based configuration profiles covering security and network policies
![Page 16: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/16.jpg)
Configuration Profiles
![Page 17: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/17.jpg)
Device Enrollment Program
![Page 18: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/18.jpg)
MDM Server
How Device Enrollment Works
Apple School Manager
DEP Customer Account
Purchased from Apple
K-12
Purchased from Reseller
(higher ed only)
![Page 19: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/19.jpg)
EFI Firmware Password
![Page 20: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/20.jpg)
Asset ProtectionNow being integrated into MDM
MDM + DEP + EFI = better asset protection
iOS allows some GPS location - will we see this with macOS?
![Page 21: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/21.jpg)
JAMF Pro MDM
![Page 22: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/22.jpg)
Data Security
![Page 23: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/23.jpg)
Keychain
Database for passwords, certificates, and encryption keys
Safe, Encrypted
Recover Lost Passwords
![Page 24: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/24.jpg)
Passwords
![Page 25: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/25.jpg)
1231231234567890000000abc1231234adobe1macromediaazertyiloveyouaaaaaa654321
1231231234567890000000abc1231234adobe1macromediaazertyiloveyouaaaaaa654321
![Page 26: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/26.jpg)
• Go to HaveIBeenPwned.com
• Check to see if any of your user names or emails have been compromised.
![Page 27: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/27.jpg)
![Page 28: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/28.jpg)
2 Factor Authentication
![Page 29: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/29.jpg)
Filevault
Encrypted Disk Image
Pre-boot authenticationEFI Firmware based
Policy management through MDM
Recovery key management
![Page 30: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/30.jpg)
Managed Apple IDs
![Page 31: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/31.jpg)
iCloud Backup
Secure transport to iCloud
Files backed up in their original, encrypted state
Backups taken when connected to power and on Wi-Fi
Device settings, app data, Photos, iMessage conversations, Desktop, Documents & more
![Page 32: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/32.jpg)
Application Security
![Page 33: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/33.jpg)
Cryptography
![Page 34: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/34.jpg)
Certificates
Cryptographic Validation (FIPS 140-2)
Common Criteria Certification (ISO 15408)
Commercial Solutions for Classified (CSfC)
Security Configuration Guides
![Page 35: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/35.jpg)
Privacy
Data Randomization
Obscured, Random Unique Identifiers
API’s designed to protect user identity
![Page 36: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/36.jpg)
App Security
Identity of developers verified for the apps available through App Store
Code signing
Keychain architecture
Runtime security
![Page 37: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/37.jpg)
Gatekeeper
Security feature that helps prevent users from installing malicious apps.
![Page 38: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/38.jpg)
Code Signing
Mandatory application signing*
Ensures app integrity and authenticity
Verified during app launch and runtime
![Page 39: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/39.jpg)
Just Do 3 Things
• Update your junk
• Good password management
• Listen to your Mac (a.k.a. don’t do anything stupid.)
![Page 40: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/40.jpg)
MacAdmins Slack
![Page 41: Safe Mac, Happy Mac - ISTE Standards · 2017-06-27 · X Protect Data Path Randomization. User Types Admin Users OS X macOS. User Types ... iCloud Backup Secure transport to iCloud](https://reader034.fdocuments.net/reader034/viewer/2022050311/5f72bc2b9f28342d393cc5cc/html5/thumbnails/41.jpg)
We’ve Finished!!!!