Classify the authority on each device
Assign an endpoint owner and inventory the device, operating-system version, administrator status, encryption state and security tooling. More importantly, identify the authority available after login: cloud sessions, source-control tokens, password-manager access, wallet extensions and customer data. A machine without production files can still be production-critical if it can request or recover credentials for another service.
Separate everyday communication and external code evaluation from privileged operations. Use disposable or tightly scoped development environments for unfamiliar repositories, and avoid mounting the entire home directory or forwarding broad credentials into them. A container is useful isolation but should not automatically be treated as a complete boundary from the host, especially when it has privileged access or a mounted container-engine socket.
Establish and verify the baseline
Apple documents signed operating-system updates and background security updates. For a Mac fleet, verify that updates actually install, required restarts happen and the operating system remains supported. Keep browser, developer tools and document viewers in scope. A dashboard showing that an update was offered is weaker evidence than a device reporting the installed version after restart.
Use disk encryption, automatic screen locking and managed recovery material appropriate to the platform. Keep routine work in an unprivileged account where practical, and install software through an approved process. Our operating recommendation is to review high-risk permissions such as accessibility, screen recording and remote control whenever a new tool is introduced. These capabilities can expose sensitive work even when files are encrypted at rest.
Respond without destroying the useful evidence
Treat unexpected persistence, a suspicious remote-control session or a security alert on a privileged developer device as a potential credential incident. Contact the response owner using an independent channel, isolate the endpoint according to the investigation procedure and preserve the alert context. Avoid running random cleanup utilities or deleting files before the investigator decides what evidence is needed.
From a known-clean environment, assess sessions, SSH keys, access tokens and secrets reachable from the affected machine. Revoke authority as needed and inspect actions taken in connected systems. Rebuild from approved installation sources when compromise is confirmed; copying the complete old browser profile or development configuration back onto the device may also restore unwanted extensions, credentials or persistence.
Exercise the separation that matters
Create a harmless test repository that tries to read an explicitly designated test secret outside its workspace. Run it in the external-code environment and verify that access fails. Also test whether that environment can reach production networks or use the host’s credential helper. Do not use real secrets for this exercise or assume that a failed first attempt proves every escape path is closed.
Run a lost-laptop drill: locate recovery ownership, prove encrypted backup availability, revoke the device’s sessions and establish a replacement machine. Record how long the employee can work without restoring old unreviewed state. Review exceptions, stale tools and unnecessary administrative access regularly. The desired result is an endpoint baseline whose controls can be observed and a response that follows its actual authority.
Controls to take away
- Device impact follows the credentials it can use.
- Disk encryption does not protect a session on an already compromised device.
- Rebuilding the device and revoking its credentials are separate recovery steps.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Sources & further reading
The references below support this note. Adapt the procedures to your systems, access model and recovery requirements.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.