Lesson 3: Layers of Defense - Jamf 170 Course

Jamf 170 Course
Solution
Application
Content Type
Training Content
Utilities & Services
ft:locale
en-US

Goal

Understand the malware prevention and remediation built into macOS, iOS, and iPadOS. Learn how Jamf Pro and Jamf Protect enhance that built-in security.

Video

Key points

  • Software that has been notarized is confirmed by Apple not to contain known malicious code.

  • Software that has been signed allows devices to check that the contents of an app have not been modified.

  • Software downloaded from the App Store has been verified by Apple to be free of any known malware.

    • Developers can choose to sign and notarize their software without listing it in the App Store.

  • Gatekeeper blocks malware by only allowing software from identified developers to be opened.

    • By default, if an app has not been signed and notarized, Gatekeeper will not allow the app to open.

    • Savvy users may choose to bypass Gatekeeper, allowing unsigned or non-notarized software to be opened.

  • Jamf Pro can enforce Gatekeeper settings on enrolled computers with a configuration profile.

  • All apps from the App Store for macOS, iOS, or iPadOS are isolated with App Sandbox to restrict access to system resources, user data, and data stored by other apps.

    • Apps can leverage extensions to securely interact with other apps.

    • Some extension functionality can be restricted with Jamf Pro.

  • System Integrity Protection (SIP) prevents users or other software from modifying system files. SIP protects files in several directories, including:

    • /System

    • /usr

    • /bin

    • /sbin

    • /var

  • SIP also prevents any pre-installed macOS applications from being modified.

  • Jamf Pro and Jamf Protect report on the status of SIP.

  • XProtect is built-in malware remediation for macOS.

    • XProtect automatically detects and blocks execution of known malware based on the latest known malware signatures.

  • Jamf Protect includes additional malware remediation with threat prevention.

    • Threat prevention blocks processes that have a matching entry in the Jamf Protect threat database and quarantines the associated file.

Review

To view answers, click arrow next to each question.

  1. How does Gatekeeper defend against malware?
    Gatekeeper prevents apps from opening if they have not been signed and notarized to prove that they do not contain malware.
  2. How does XProtect defend against malware?
    XProtect automatically detects and blocks malware execution based on the latest known malware signatures.
  3. How does threat prevention with Jamf Protect help prevent malware infection?
    Processes that match any known malware in the Jamf Protect threat database are blocked and associated files are quarantined.

Practice

  1. View the current Gatekeeper settings on a test computer by navigating to System Settings > Privacy & Security > Security.

  2. Enforce Gatekeeper settings with Jamf Pro on a test computer.

    1. Navigate to Computers > Configuration Profiles.

    2. Click New.

    3. In the General payload, enter a profile name in the Name field.

    4. Navigate to Security and Privacy > General.

    5. Under Gatekeeper, select Mac App Store and identified developers.

    6. For the Temporarily overriding the Gatekeeper setting by control-clicking to install any app setting, select Restrict.

    7. Scope the configuration profile to a test computer and click Save.

    8. Reload the Privacy & Security pane in System Settings on the test computer to review how it has changed.

Resources

Jamf Pro Documentation

Jamf Protect Documentation

Apple Platform Deployment

Apple Platform Security

Apple