Hardware Security


FileVault Encryption for Mac Computers (macOS)

Mac computers include FileVault, a built-in encryption system that secures all data at rest using AES-XTS encryption.

How It Works

On Apple Silicon and T2 Macs:

Important: On older Macs (pre-T2), non-original internal storage, or external drives: Files created before enabling FileVault aren't encrypted and may be recoverable with forensic tools.

Internal Storage Security

FileVault Enabled

When FileVault is on, volumes remain encrypted even if the physical drive is removed. Without valid credentials or a recovery key, the data is inaccessible.

Encryption covers:

Key Management Apple Silicon and T2 Macs use a hierarchical key system that:

All key operations occur within the Secure Enclave—encryption keys never reach the CPU. Each APFS volume has a volume encryption key (VEK) that encrypts contents and metadata. The VEK is wrapped by a key encryption key (KEK), which is protected by both the user password and hardware UID.

FileVault Disabled

Even without FileVault, Apple Silicon and T2 Macs still encrypt volumes—but the VEK is protected only by the hardware UID. Enabling FileVault later is instant (data already encrypted) and adds an anti-replay mechanism to prevent the old hardware-only key from being used.

Secure Deletion

Deleting a volume triggers the Secure Enclave to securely erase its VEK, preventing future access. Additionally, all VEKs are wrapped with a media key. Erasing the media key (via MDM commands, for example) makes the volume cryptographically inaccessible.

External Storage

Removable drives don't use Secure Enclave capabilities—they're encrypted the same way as Intel Macs without T2 chips.

Securing Your Mobile Device

Most of us use our personal phones for work, and that's okay. But it creates real security questions: What happens if your phone is lost or stolen? Who can see your work data? What if your org needs to manage your device? There's no single right answer, and the right approach depends on your role, your organization, and the sensitivity of what you're working with.

If you work with confidential data like client records, legal documents, source information, immigration files, or donor details, the stakes are higher and some of these steps move from "good idea" to "essential."

1. Lock Your Device

A strong lock screen is your first line of defense if your phone is lost, stolen, or handed to someone else.

Higher-sensitivity roles: Consider disabling biometric unlock entirely and using a strong passcode only, particularly especially for border crossings or high-risk situations. Border agents can legally compel biometric unlock in ways they cannot compel a passcode.

2. Review App Permissions

Apps routinely request access to your location, contacts, camera, and microphone, often more than they need.

Work accounts specifically: Be thoughtful about which apps have access to your work email or calendar. A personal productivity app like Asana or Trello connected to your work Google account could expose more than you intend.

3. Keep a Boundary Between Work and Personal Data

When your personal phone is also your work phone, data can mix in ways that are hard to untangle. A few strategies help keep things separate:

4. Mobile Device Management (MDM)

MDM software allows an organization to remotely manage devices, enforcing security policies, pushing updates, and wiping a lost or stolen device. If your organization uses MDM (such as Jamf, Microsoft Intune, or Google Endpoint), they may ask to install a profile on your personal device.

What MDM can do on your device:

MDM profiles give your organization visibility into and control over the portions of your device covered by the profile. Before installing, ask your IT contact exactly what the profile can see and do.

If installing MDM on a personal device feels like too much of an intrusion, it's worth discussing with your organization whether they can provide a dedicated work device instead.

5. Keep Your Phone Updated

Software updates patch security vulnerabilities. An unpatched phone, even one with a good passcode, can be compromised through known holes in the device's software.