macOS-Security-and-Privacy-Guide VS macos_security

Hi friends, I followed this guide: https://github.com/drduh/macOS-Security-and-Privacy-Guide and some additional steps to protect my macbook from being accessed by unauthorized people. The key steps I did was a full disk encryption and a custom firmware password. This makes it extremely difficult to repurpose my macbook after for example a theft. The reason I want this is that I often study in university or sometimes work in public places, but I also work as a software developer with sensitive consumer data.

https://github.com/drduh/macOS-Security-and-Privacy-Guide/is...

turn on FileVault , turn on the firewall (built in). install Lulu firewall follow this guide and harden the system https://github.com/drduh/macOS-Security-and-Privacy-Guide

I'm looking for a guide to harden MacOS Ventura, preferably including little snitch/lulu blocklist suggestions for MacOS services. I'm aware of dr druh's guide (that currently doesn't seem to be updated for Ventura though) and isn't including a little snitch/lulu blocklist.

- macos, following https://github.com/drduh/macOS-Security-and-Privacy-Guide for hardening (I haven't compared this to other hardening guides, but doing something is better than nothing)

I remember seeing this, I have never followed it so I don't know what it's worth but it's seems quite comprehensive

For starters there's an entire NIST project for macOS Security Compliance - https://github.com/usnistgov/macos_security this will make your life a million times easier to meet a lot of the technical controls required for compliance. Nothing like this really exists for Windows or Linux(closest is Compliance As Code https://github.com/ComplianceAsCode/content)

https://github.com/usnistgov/macos_security - for macOS this would help.

I’d highly recommend checking out the usnistgov/macos_security on GitHub. You can generate a benchmark and then feed the output into extension attributes to trigger policies on.

Study about cybersecurity, or how to harden a macOS fleet against published security frameworks.

Weigh the pros and cons about having your end-users be standard users or admins on their Macs. If they are already admins (probably), consider the political blowback if you take away their admin rights and flexibility and autonomy they've become used to. Conversely, consider the security posture of your organization. If it has to adhere to some well-known guides (like 800-171 o 800-53r5), then you may not be able to allow end-users to be admins. Take a look at the macOS Security Compliance Project.

NIST Compliance Benchmarks: github.com/usnistgov/macos_security

Like OP, I'm trying to disable both bonjour and netbios. I'm using this script: https://github.com/usnistgov/macos_security/blob/main/includes/enablePF-mscp.sh