Apple devices have seen higher adoption within business and enterprise, especially during and after the pandemic. Now, more than 55% of businesses are permitting or adapting Mac for business use. Additionally as of 2022 an estimated 23% of enterprise endpoints are macOS devices with signs that Mac adoption will continue to see additional growth. This means that security teams must put significant effort into contemplating how they will enable data protection for Macs. But what exactly are the options for enabling data security on Macs and how do they work?

What the cybersecurity ecosystem on Mac endpoints looks like

There are a number of different types of cybersecurity solutions that companies can leverage to secure Mac devices. Although the options are not a numerous as those for Microsoft Windows machines, there are still many to choose from:

• Mobile Device Management (MDM). These are platforms that allow security teams to have device control through hardware and software configurations on target devices. This is mostly for the purpose of provisioning new on-device applications, locking down stolen devices, or in some cases providing advanced threat protection (ATP) or data loss prevention software (DLP) and insider risk management (IRM) to address data exfiltration and insider threats.
• Antimalware & Advanced Threat Protection. Although there are some MDM solutions that provide some antivirus and antimalware functionality, a lot of organizations turn to dedicated solutions to ensure the utmost level of protection for their macOS devices. Even though Mac devices experience less overall malware than Windows devices, it’s still important to maintain up-to-date anti-malware definitions.
• Endpoint DLP. Endpoint DLP solutions play a role in protecting sensitive data on a device. Dedicated DLP solutions allow you to have greater visibility into the types of sensitive information employees store on devices with data classification. You can then remediate data leakage risk with DLP policies.

Data security & DLP on macOS

Although there are undoubtedly more data loss prevention solutions for windows operating systems, the macOS ecosystem still enjoys DLP support. It’s important to know, though, that only some of these options are built from the ground up to support macOS, while others weren’t and thus lack parity in terms of their overall feature set.

Consider, for example, while Microsoft Purview has macOS support, features like detecting content pasted into a restricted domain from the browser are not possible on Mac devices.

Choosing endpoint DLP for Mac

When choosing between endpoint DLP options on Mac, you need to choose solutions that provide comprehensive functionality and that don’t introduce latency via their on-device agent. One key differentiator in this regard is the manner in which the solution integrates with the operating system.

Historically, many endpoint solutions for both Windows and macOS required kernel-level integration, but both the Mac and Windows ecosystems provide API frameworks that allow applications to monitor file system activity without kernel access. Not every solution takes advantage of this, however, still relying on kernel access and non-sanctioned OS architecture methods which can introduce additional latency and security risks and limit the number of features offered by the service.

{{ promo }}

Must-have features for macOS DLP

Typically the most comprehensive macOS DLP solutions have the following distinguishing features:

• Modern OS Architectural implementation. As indicated above, the solution should be implemented supporting Apple’s currently recommended developer methods. Applications that don’t can be very difficult to configure, on top of introducing complexity and security risk. This is the core reason why Cyberhaven is considered easy to deploy and a high-accuracy data security platform.
• Visibility into file events. Traditional DLP and data protection tools rely on tagging, regex, or data classification to determine on a device sensitive data is located or if it's moved elsewhere. Unfortunately, such methods are prone to false positives and false negatives. Just because an employee downloaded and opened a file with employee names and phone numbers doesn’t mean that they’re leaking sensitive information. Luckily being on the device endpoint enables an application to potentially monitor file events. Cyberhaven, for example, is an endpoint solution that monitors every file event to determine how employees are using specific types of data. Combined with data classification, Cyberhaven can know where a file originated from, who the original authorized users of the file are, and whether the current user accessing the file belongs to a group that has a need-to-know basis for the information in the file. This ability to track file events, which we call data lineage, provides essential context about end-user behavior in real-time.
• Visibility into browser-based events. Browser-based events represent a gap that many endpoint security solutions face. Once data goes “over the wire” so to speak, either over an encrypted communications tool or to a website with https, many solutions simply lose track of the data. This makes monitoring and preventing egress of data to unauthorized domains or cloud services much harder. Security teams get around this by having a second tool, usually a CASB, in place, but this approach has limitations as well. Since CASBs can only block activity on a domain to domain basis, often employees get around this by creating personal accounts on sanctioned domains. For example, most CASBs fail to distinguish egress to a corporate Google Drive account versus egress to a personal Google Drive account, as all activity is taking place on a valid google.com subdomain. Cyberhaven specifically integrates at the browser in order to ensure we understand data egress and ingress as its happening on the device. This ensures that egress events to SaaS apps can be prohibited in real-time for data whose lineage and contents imply they shouldn’t be shared.
• Real-time remediation to prevent data breaches. A number of DLP solutions are alert-based in that they only discover and report on incidents that violate policies, and there are very few ways to automate remediation actions. Cyberhaven, however, lets you create just-in-time notifications for users who violate policies, educating them during the course of their work and allowing you to provide custom messaging to provide nudges to employees to shape their behavior over time.
• Offline policy enforcement. Many endpoint solutions, especially ones that rely on labeling take time to push policy updates to systems, and often cannot push changes or enforce policies when systems are offline. However, since Cyberhaven policies rely predominantly on data lineage which involves tracking file events at the OS level, the platform doesn’t have a limitation like this.

Future-Proofing Your macOS Data Security Strategy

The growing need for macOS specific data security solutions means that organizations need to be contentious about the unique strengths and weaknesses of the endpoint DLP offerings in the Mac ecosystem. Endpoint DLP solutions, when chosen carefully, equip organizations with invaluable features like modern OS architecture support, visibility into file and browser-based events, real-time remediation capabilities, and offline policy enforcement to limit data leaks and keep your organization secure.