What is a second layer of security? Layered security on a Mac

MacUpdated

A second layer of security is a separate check or safeguard that still counts after the first one, usually your password, has been got past. Apple uses the phrase itself: it calls two-factor authentication "an additional layer of security" for your Apple Account, and says FileVault "provides an extra layer of security".

Quick answer

Layered security means several separate protections, so you don't rely on one. A Mac has its own: the login password or Touch ID, two-factor authentication on your Apple Account, FileVault encryption, and Find My with Activation Lock. Each depends on your passwords staying private. None of them shows who was at the Mac when someone used your password in person.

What does layered security mean?

It means not resting everything on a single protection. If one gives way, the next is still there. You'll also see the idea called defence in depth.

Apple's own Platform Security guide describes the Mac's malware defences this way, in three layers. The first is designed to stop malware launching even once. The second blocks it from running. The third removes malware that has already run.

The same thinking works for the Mac as a whole. Your password is one layer, and each setting below adds another.

What is the first layer on a Mac?

The login password, or Touch ID on a Mac that has it. The NCSC's advice for devices is to use a strong password or PIN to keep unauthorised people out, and better still fingerprint or face recognition. For passwords in general, it suggests combining three random words.

  1. To add a fingerprint, choose Apple menu > System Settings > Touch ID & Password, then click Add Fingerprint.
  2. To lock the Mac soon after you step away, choose Apple menu > System Settings > Lock Screen and set "Require password after screen saver begins or display is turned off" to a short time.

Apple says you still need your password when you start your Mac, every 48 hours, and after five incorrect fingerprint attempts. For quick ways to lock up, see how to lock your Mac screen.

How does two-factor authentication add a layer?

It asks for a second thing besides your password. Apple says two-factor authentication is designed to make sure you're the only one who can access your Apple Account, even if someone else knows your password. When you sign in on a new device or on the web, you need your password and a six-digit code shown on your trusted devices or sent to your trusted phone number. The NCSC says two-step verification helps keep criminals out of your accounts even if they know your passwords.

To turn it on, open System Settings, click your name, then Sign-In & Security, and turn on two-factor authentication.

It's a layer on your Apple Account. Apple describes the code being asked for at sign-in on a new device or the web, not when someone unlocks your Mac in front of it.

What does FileVault add?

Encryption. Apple says a Mac with Apple silicon or the T2 chip encrypts its data automatically, and FileVault adds an extra layer so others can't decrypt or access your data without your login password. Apple's Platform Security guide says that once FileVault is on, the user's credentials are required during startup.

Turn it on in Apple menu > System Settings > Privacy & Security, then scroll to FileVault. You'll choose to unlock the disk with your iCloud account if you forget your password, or a recovery key you keep somewhere safe.

What do Find My and Activation Lock add?

A layer for when the Mac is gone. Apple says Find My can show a lost Mac's approximate location, play a sound, lock it and erase it. On a Mac with Apple silicon or the T2 chip, with two-factor authentication on, Find My enables Activation Lock, which Apple says is designed to prevent others from using your Mac if it's lost or stolen. Apple says your Apple Account password or device passcode is required before anyone can turn off Find My.

To check it, choose Apple menu > System Settings, click your name, then iCloud, click See All (or Show More Apps), and turn on Find My Mac.

Which gap do these layers leave?

Someone who knows your password, or saw you type it, using the Mac in person. The login screen accepts the correct password from anyone. Two-factor authentication guards your Apple Account sign-in, not the Mac's lock screen. FileVault asks for your login credentials, which that person has. Find My and Activation Lock are for a Mac that's lost or taken.

Each of them relies on your password being yours alone. If you think someone has seen it, read what to do if someone watched you type your passcode.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security for exactly that gap. It's evidence and deterrence: a record of who unlocked it, and a window telling them so. It's an extra layer beside your Mac password and the macOS settings above.

  • It's out now for Mac, as a download from failshot.app, for macOS 14 or later. It's free to download, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.
  • While it's on, it takes photos of whoever unlocks your Mac, then, with Pro, records a 5-second video. Video can be switched off.
  • With the Mac's built-in camera, the green light comes on, and the guarded window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password. So a seen password isn't enough to switch it off in Failshot.

It's for your own Mac. iPhone, Android and Windows versions are coming soon.

More questions

Is two-factor authentication a second layer of security?

Yes, for your Apple Account. Apple calls it an additional layer of security that works even if someone else knows your password. It covers signing in to your account on a new device or the web, not unlocking your Mac in person.

What is an extra layer of security for a laptop?

Anything that still counts after your password. On a Mac, that includes Touch ID, FileVault, two-factor authentication on your Apple Account, and Find My with Activation Lock. An app that photographs whoever unlocks the laptop adds a record of who used it.

Does FileVault protect me if someone knows my password?

FileVault asks for your login credentials when the Mac starts up. Apple says it keeps others from accessing your data without your login password, so it relies on that password staying yours.

What does Failshot do when someone unlocks my Mac?

Failshot is the layer after your password. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed.

How many layers of security does a Mac need?

There's no official number. Turn on the layers macOS already has: a strong password or Touch ID, a short lock-screen delay, two-factor authentication, FileVault and Find My. Then consider what's left uncovered for you.

Sources