I was recently chatting with someone about what it was like in the early days of Apple’s second act with the iPod, and I mentioned that Mac users had the ultimate flex against PC users: no viruses and no malware. This was when PC users could get a virus from simply breathing in the wrong direction. The general argument from the mainstream at the time was that once Macs became popular, they’d be filled with viruses as well. The Mac became popular (especially at work), and the mass virus attacks never arrived. So that begs the question of 2024: Do you need malware protection on macOS at work?

About Apple @ Work: Bradley Chambers managed an enterprise IT network from 2009 to 2021. Through his experience deploying and managing firewalls, switches, a mobile device management system, enterprise grade Wi-Fi, 1000s of Macs, and 1000s of iPads, Bradley will highlight ways in which Apple IT managers deploy Apple devices, build networks to support them, train users, stories from the trenches of IT management, and ways Apple could improve its products for IT departments.

What is Apple doing about malware?

Apple is leaving you to fly alone with malware as they handle a lot of things behind the scenes on macOS to prevent malware breaches. Apple has a threat intelligence protocol to identify and neutralize malware threats. Apple’s malware defense framework is constructed around three primary tiers:

1. Prevention of Malware Launch or Execution: Utilizes the App Store, Gatekeeper, and Notarization to prevent malware from initiating.
2. Interruption of Malware Operations on User Systems: Uses Gatekeeper, Notarization, and XProtect to halt malware in its tracks.
3. Mitigation of Executed Malware: Utilizes XProtect for the remediation of malware post-execution.

The initial defense line aims to stop malware distribution and prevent activation through the App Store, Gatekeeper, and Notarization. The subsequent defense layer ensures rapid identification and interruption of malware on any Mac system, utilizing XProtect, Gatekeeper, and Notarization to stop the spread and address the infection. XProtect is designated for the remediation of malware that has managed to execute, ensuring the system’s integrity.

There are additional safeguards, especially on Macs with Apple silicon, to minimize the impact of any malware that might execute. macOS also includes features to protect user data from malware and maintain the operating system’s integrity.

Notarization Explained

Notarization serves as Apple’s malware scanning service. Developers distributing macOS apps outside the App Store must submit their apps for a malware scan. If no malware is detected, a Notarization ticket is issued, which developers attach to their app, allowing Gatekeeper to verify and launch the app even without an internet connection.

Apple can revoke Notarization for apps identified as malicious, ensuring Gatekeeper is updated with the latest information to block such apps promptly. This system allows for rapid response to new threats, covering previously and not previously notarized apps.

XProtect Details

XProtect, macOS’s built-in antivirus, uses YARA signatures for malware detection and removal. Apple continuously updates these signatures behind the scenes, independent of system updates, to protect Macs against malware. XProtect actively blocks known malware and alerts users, offering the option to discard the malicious software.

XProtect’s signature-based detection is broad, capable of identifying variants of known malware. It scans apps at launch, after changes, and upon signature updates. XProtect also includes mechanisms for malware remediation, delivering updates from Apple to remove infections without requiring a system reboot.

Automatic XProtect Security Updates

Apple automatically updates XProtect based on the latest threat intelligence, with macOS checking for updates daily. Notarization updates occur even more frequently through CloudKit sync.

Apple’s Malware Discovery Response

Upon discovering new malware, Apple takes several steps, including revoking Developer ID certificates, issuing Notarization revocation tickets, and developing and releasing XProtect signatures. These actions are applied retroactively and to new detections, ensuring rapid and comprehensive protection for Mac users against emerging threats.

Is XProtect enough?

Apple’s XProtect is a key part of the company’s commitment to user security, operating seamlessly in the background without user intervention nor slowing down the device. I XProtect is a powerful tool in the macOS security arsenal, providing a level of protection that many users have come to rely on without even realizing it.

However, when it comes to enterprise IT and the security world, the requirements for security often extend beyond the capabilities of XProtect. While XProtect forms a solid foundation for threat detection and removal, businesses today face various sophisticated threats that demand a more comprehensive security strategy and deployment. This is where Apple’s Endpoint Security frameworks come into play, enabling security companies to develop Endpoint Detection and Response (EDR) tools that enhance and extend the foundational security provided by XProtect, and do it in a way that doesn’t impact the end-user experience (the key part!)

EDR tools designed with Apple’s frameworks offer advanced features that are particularly crucial for enterprises, including some of the following

• Monitoring of all files and applications
• Process management capabilities
• Real-time file scanning and quarantine capabilities
• Customizable alerts and notifications for IT
• Enforcement of custom allow/block list
• Additional security controls and Data Loss Protection or sensitive company data, including measures to secure USB ports and other external connection points.

TL;DR: while Macs are inherently secure and XProtect provides a strong layer of protection, the dynamic and complex threat landscape faced by enterprises IT teams today requires additional tools. These tools ensure compliance with industry regulations and internal policies and provide the enhanced logging, reporting, and policy management capabilities needed to customize security practices to each organization’s unique needs.

For businesses, leveraging EDR solutions that integrate with Apple’s Endpoint Security framework is a key part of protecting the user experience while staying secure.

Wrap up

While XProtect is a key part of the macOS’s security story, the specialized needs of enterprises in managing and mitigating risks in today’s cybersecurity environment make a strong case for adopting additional, more sophisticated EDR tools. These tools complement XProtect’s built-in capabilities, providing businesses with the comprehensive security posture necessary to stay secure in 2024.

Apple @ Work is brought to you by Kolide by 1Password, the device trust solution that ensures that if a device isn’t secure, it can’t access your apps. Close the Zero Trust access gap for Okta. Learn more or watch the demo.