BY SPIRION
February 22, 2023
Driven by employee demand and a wider array of enterprise-level applications for Apple Macs, enterprise adoption has soared. Apple Macs now make up 23% of endpoints in enterprises. But as Mac popularity has soared, threat actors are increasingly targeting these endpoints. This emerging threat makes it critical that security leaders include macOS protection in the overall security posture of their organization.
Mac endpoints contain information that is just as critical as that of any other operating system if not, more so. Its use is particularly prominent among business executives, marketing, HR teams, sales, higher ed, and other employees who handle sensitive information like customer, prospect, student and patient personal information (PII), job applications, financials, intellectual property, and other confidential information that needs to be protected.
Despite the growing security threat posed by macOS endpoints, they are often excluded from organizations’ security reason. Common reasons include:
Belief that endpoints don’t need to be protected
Most data security strategies focus on protecting data in motion, for instance, as it’s moving around the network, or data in use, which protects data as its being saved or edited. Since networks generally run on Windows or Linux operating systems, it is assumed that MacOS protection is therefore not needed. This problem with this assumption is that it misses data at rest that is stored on local file servers or endpoints like employee laptops.
While best practices dictate that data generated and saved by employees will traverse to or from the Cloud or be backed up to enterprise storage, such as OneDrive, real users don’t necessarily work this way. Particularly, for today’s post-COVID-19 workforce where 36% of employees are working remotely at least part of the week. They are copying, saving, storing, creating, and manipulating sensitive data every day. As the lines between work life and personal life become increasingly blurred, 69% of employees say they use their work laptop for personal use, including loaning it to other family members.
As well, some of the most necessary and sensitive data is what’s commonly referred to as “data at rest.” It is often tucked away in various storage systems and infrequently accessed and it’s a very attractive target to malicious hackers. When digital data is at rest in a particular storage setting, cyber attackers assume—often correctly—that the data isn’t moving because it’s meant to be accessed or moved as infrequently as possible, as is the case with valuable sensitive data. Data at rest may also be unknown to the company and therefore lacking the normal security safeguards.
Because data at rest is often an organization’s highest-value data, its exposure can be devastating. Not only can it lead to crippling losses for your business, customers, employees, and other entities with whom you company interacts, but a breach or misuse of such information could also damage your company’s reputation for years and expose it to civil and regulatory liability.
Perception that Mac endpoints are inherently secure
Macs are traditionally considered less vulnerable to threats because macOS is a closed system. Apple exclusively offers the hardware and operating system, which can’t be used on other devices. While this certainly strengthens its security posture, the fact is that every operating system is at risk. There are various ransomware variants/families specifically targeting macOS, such as MacRansom, ThiefQuest, and XCSSET malware. Out of these, ThiefQuest is a ransomware that, in the disguise of encrypted data, is also performing data exfiltration. Further, with the evolution of ransomware into “human-operated malware,” any operating system can be used to launch an initial attack on a network, and this malware can be later used to move laterally, exfiltrate data, etc.
As well, organizations often depend on employees to perform their own MacOS security updates. Security protections are only effective if they are kept current and thus, only as strong as your most negligent employee.
Considered to be of less interest to threat actors
Historically, Macs have been seen to represent a lower threat profile because of less interest from threat actors, but as macOS adoption in enterprises continues to grow, so too grows the number of possible targets for cyber attacks, making MacOS more attractive to hackers. In addition, Windows malwares are being reengineered for macOS, while other cross-platform malwares such Java-based, human-operated malware and script-based attacks using Python, enable hackers to attack Mac systems more effectively and efficiently.
Lack of compatibility with legacy data protection tools
Often, macOS endpoints aren’t managed centrally with other endpoints due to lack of compatibility in legacy management tools, which often results in them being undermanaged in a separate, isolated tool.
Spirion uniquely offers sensitive data discovery and remediation across all your OS – including MacOS
Spirion’s Sensitive Data Platform is a data privacy solution that excels in securing sensitive data at rest via automated data discovery, classification, and remediation. Our discovery tool searches locations such as PDFs, images, cloud repositories, databases, and even employee laptops for sensitive data. No matter where your data ends up — whether it’s in the cloud or on-premise, unstructured or structured, or in macOS, Windows, or Red Hat Enterprise Linux (RHEL) — Spirion can find it. It’s easy to set up automated classification, so once data is found, it’s instantly and accurately classified. Organizations can also create workflows with specific trigger events or actions to streamline remediation.
Spirion recognizes the crucial importance to organizations to find sensitive data in their burgeoning MacOS environments. As an always-innovating company, Apple continues to create new versions of the software. Spirion is committed to keeping your systems safe and secure with new updates as new versions are released. Spirion recognizes the crucial importance to organizations to find sensitive data in their burgeoning MacOS environments. Spirion now supports the following versions: Catalina (Intel), Big Sur (Intel, M1, M2), Monterey (Intel, M1, and M2), and Ventura (Intel, M1, and M2).
In the case of endpoint security, the one principle that is especially pivotal is that your security is only as strong as your weakest endpoint. Don’t let your macOS endpoint be that weakest link or an easy entrance point for actors looking to attack other systems.
To see our platform in action, you can watch a free demo here.
