After a few delays and set backs, the first article in our Securing Your Mac series is good to go. Kicking things off we’re going to look at Apple’s FileVault which has been included in Mac OS X since Panther (10.3). FileVault is important for a couple reasons — one for encrypting your startup disk and two for keeping prying eyes out from the data in your Mac if it’s lost, stolen, or confiscated. According to Apple’s website, FileVault uses XTS-AES 128 encryption that happens to be recommended by the NIST. That being said the encryption algorithm used is definitely top notch, so you’re in pretty good hands.
To get started, you’ll want to head over to the System Preferences application on your Mac, select the “Security & Privacy” icon, click on the FileVault tab, then select the “Turn On FileVault” button. Because FileVault encrypts your entire disk, you can setup a recover option if you forget your login password. The available options are to store your FileVault key in iCloud, send it Apple, or write it down and no one else would have it.
For the best security, I suggest going with writing down your recovery key. Your iCloud Keychain could be hacked or someone may be able to guess your security questions when sending your FileVault key off to Apple. After choosing a recovery key option, you’ll be prompted to restart your computer and login with your password. Upon logging in, this is when the real fun begins. Your Mac will begin to encrypt its startup disk, so be sure to leave it plugged into a power source as it could take a while.
Performance Issues and Concerns
A common concern amongst users switching to FileVault is if it will cause performance issues. From personal experience, I’ve been using FileVault for a little over two months now and I barely seen any performance hits. Granted having a Macbook Pro Retina with an SSD could be why, so for those who are using older Macs with a traditional hard drive, you may notice some slowness but it won’t be a ton.
As with any encryption software a general concern are backdoors that allow anyone access to your computer as long as they know the right steps to access the backdoor. Currently there’s no known backdoors to FileVault, however, an extra step is to destroy FileVault keys while in standby mode. To do so, copy and paste the code below into Terminal (found under /Applications/Utilities).
pmset -a destroyfvkeyonstandby 1
Even though this will cause wake times to be a bit longer, it’s an extra layer of security. To reverse the above action, simple paste the code below into Terminal.
pmset -a destroyfvkeyonstandby 0
All in all, using and configuring FileVault is fairly easy and it’s definitely a first good step in securing your Mac. If you want to give it a trail run for a few weeks, you can always disable FileVault and your files will not be removed. Be sure to stay tuned for more articles on Securing Your Mac later this month.