Built-in Security Features

Chapter 6 covered Gatekeeper, code signing, and notarization; Chapter 7 extended that trust chain into the Signed System Volume. This chapter completes the built-in security stack with three more pieces — one that runs quietly in the background after Gatekeeper's own job is done, one that protects data at rest, and one that genuinely revises an assumption this course has relied on since Chapter 1.

Gatekeeper, Revisited

Gatekeeper (Chapter 6) does its job once, at first launch: check the signature, check the notarization ticket, allow or block. Everything else in this chapter runs on a different schedule — continuously, or on demand — because a clean bill of health at install time doesn't mean a file stays trustworthy forever.

XProtect: Ongoing Malware-Signature Scanning

XProtect is macOS's own built-in, baseline malware scanner. It checks files — not just at first launch, but on an ongoing basis — against a list of known-malware signatures that Apple updates silently in the background, independently of full macOS system updates. This is a genuinely different job from notarization: notarization is a one-time automated check performed when a developer distributes an app; XProtect is a continuously updated, on-access safety net that keeps working long after that app is already sitting on disk.

Apple is explicit that XProtect is a baseline, not a full antivirus replacement — deliberately minimal, covering known threats rather than attempting the kind of broad behavioral detection a dedicated third-party security product aims for.

FileVault: Full-Disk Encryption

FileVault is macOS's full-disk encryption feature, encrypting the entire startup volume so its contents are unreadable without the correct credentials. This is the direct macOS counterpart to Windows 11 Fundamentals 9's own BitLocker material, and the parallel runs deeper than just "both encrypt the disk": FileVault on Apple Silicon Macs ties its encryption keys to the same Secure Enclave Chapter 3 introduced for Touch ID, exactly as BitLocker ties its own keys to the TPM chip. Two different vendors, two different chip names, the identical underlying pattern Chapter 3 already named — keep the actual key material in dedicated, isolated hardware rather than ordinary storage.

One genuine nuance worth knowing: on Apple Silicon Macs, the internal SSD is always encrypted at the hardware level via the Secure Enclave, regardless of whether FileVault itself has been turned on in System Settings. Turning FileVault "on" adds a separate, user-facing layer on top — requiring an actual password or recovery key to unlock at boot — rather than being the only thing standing between the data and encryption.

System Integrity Protection: A Genuinely Unique Root Restriction

Every Unix system this course has touched on so far — including macOS's own BSD heritage from Chapter 1, and the sudo-gated overrides in Chapters 5 and 6 — has relied on one assumption without stating it outright: root can do anything. System Integrity Protection (SIP), introduced in El Capitan (10.11, 2015), is macOS's deliberate departure from that assumption. SIP restricts even a fully root-privileged process from modifying protected system locations — /System, /bin, /sbin, and most of /usr (excluding /usr/local, which is exactly why Homebrew's own default install location from Chapter 5 was never affected by this) — no matter how that root access was obtained.

Windows 11 vs. macOS: The Security Stack, Side by Side

Where This Course Is Headed

Time Machine and macOS Recovery — leaning directly on this chapter's own SIP-disable procedure and Chapter 7's own APFS snapshot material — networking and sharing, everyday troubleshooting tools, and a capstone setting up and securing a complete new Mac end to end.

Hands-On Exercises