> Goal: secure the device, accounts, browser, network, communications, files,
> and notes while keeping the checklist practical and maintainable.
---
## 1. Operating System
Secure the operating system and reduce unnecessary attack surface.
### 1.1 General
* [ ] Choose a mainstream OS with active security updates.
* [ ] Avoid operating systems that cannot receive timely security updates.
* [ ] Keep the OS on a supported version.
* [ ] Enable automatic security updates where practical.
* [ ] Review security configuration after every major OS upgrade.
---
## 2. macOS
Apply macOS-specific privacy and security hardening.
### 2.1 Account & Login Security
* [ ] Disable automatic login.
* [ ] Remove unused user accounts.
* [ ] Use a Standard user account for daily work.
* [ ] Keep an Administrator account available only
when administrative privileges are required.
* [ ] Require authentication after inactivity.
* [ ] Disable password hints.
* [ ] Require an administrator password for sensitive system-setting changes.
* [ ] Configure the screen saver to start after a short period of inactivity.
* [ ] Require a password or Touch ID after the screen saver/sleep.
* [ ] Do not leave an unattended Mac unlocked.
### 2.2 Apple ID
* [ ] Decide whether an Apple ID is required for your workflow.
* [ ] Do not sign in to an Apple ID solely because macOS requests it.
* [ ] Verify that required services still work without Apple ID.
* [ ] If using iCloud, review exactly which data is synchronized to iCloud.
* [ ] Review iCloud privacy/security settings periodically.
### 2.3 FileVault
* [ ] Enable FileVault.
* [ ] Verify that FileVault is actually enabled.
* [ ] Create a FileVault recovery key
or use the supported iCloud recovery method.
* [ ] Store the recovery key somewhere separate from the Mac.
* [ ] Do not store the only copy of the recovery key on the encrypted Mac.
* [ ] Verify that the recovery key can be recovered when needed.
* [ ] Do not lose both the login credential and the recovery key.
> Apple currently documents FileVault recovery using either an iCloud account
> or a recovery key; on supported modern Macs,
> storage encryption is also hardware-backed,
> while enabling FileVault provides an additional protection layer.
### 2.4 Boot & System Integrity
* [ ] Keep Secure Boot enabled.
* [ ] Keep System Integrity Protection (SIP) enabled.
* [ ] Keep Gatekeeper enabled.
* [ ] Avoid disabling boot security protections
unless there is a specific technical requirement.
* [ ] Review any software that asks you to disable SIP, Gatekeeper,
or Secure Boot.
* [ ] Verify boot security after major system modifications.
### 2.5 Updates
* [ ] Enable automatic macOS updates.
* [ ] Enable automatic security/system-data updates.
* [ ] Keep third-party applications updated.
* [ ] Enable automatic App Store updates where practical.
* [ ] Update security-sensitive software promptly.
* [ ] Keep Pareto Security updated.
* [ ] Restart the Mac periodically so pending security changes can take effect.
* [ ] Avoid keeping the Mac running continuously for extended periods.
### 2.6 Firewall
* [ ] Enable the built-in macOS firewall.
* [ ] Verify that the firewall remains enabled.
* [ ] Enable Stealth Mode if appropriate for your environment.
* [ ] Install LuLu if you want outbound connection control.
* [ ] Review unexpected outbound connection prompts.
* [ ] Do not automatically allow every application that requests network access.
* [ ] Investigate unexpected outbound connections before allowing them.
### 2.7 Network Sharing
* [ ] Set AirDrop to Contacts Only unless broader access is required.
* [ ] Disable AirPlay Receiver unless needed.
* [ ] Disable File Sharing unless needed.
* [ ] Disable Internet Sharing unless needed.
* [ ] Disable Media Sharing unless needed.
* [ ] Disable Printer Sharing unless needed.
* [ ] Disable Remote Login unless needed.
* [ ] Disable Remote Management unless needed.
* [ ] Periodically review all enabled sharing services.
### 2.8 Camera & Microphone
* [ ] Review which applications have camera access.
* [ ] Review which applications have microphone access.
* [ ] Remove camera access from applications that do not need it.
* [ ] Remove microphone access from applications that do not need it.
* [ ] Install OverSight if you want additional camera/microphone monitoring.
* [ ] Investigate unexpected camera/microphone activity.
### 2.9 Malware Protection
* [ ] Keep Apple's built-in malware protections enabled.
* [ ] Keep XProtect/security data updates enabled.
* [ ] Install KnockKnock for periodic persistence/malware audits.
* [ ] Run a KnockKnock scan after installing suspicious software.
* [ ] Investigate unknown persistence mechanisms.
* [ ] Remove software you do not recognize or need.
### 2.10 System Inspection
* [ ] Install OnyX if you need additional macOS maintenance/inspection tools.
* [ ] Use OnyX to inspect/verify system configuration when troubleshooting.
* [ ] Do not use system-cleaning features blindly.
* [ ] Prefer understanding a cleanup action before running it.
### 2.11 Terminal
* [ ] Enable Secure Keyboard Entry in Terminal/iTerm when appropriate.
* [ ] Avoid entering highly sensitive credentials into untrusted terminal
sessions.
* [ ] Protect SSH private keys with passphrases
or hardware-backed authentication.
### 2.12 Wi-Fi
* [ ] Use WPA2 or WPA3 Wi-Fi.
* [ ] Avoid open/unencrypted Wi-Fi for sensitive activity.
* [ ] Verify the security mode of important networks.
* [ ] Forget unknown or unused Wi-Fi networks.
### 2.13 Backups
* [ ] Enable Time Machine.
* [ ] Encrypt the Time Machine backup.
* [ ] Verify that backups complete successfully.
* [ ] Keep at least one backup separate from the Mac.
* [ ] Periodically test restoring a file from backup.
### 2.14 Pareto Security
* [ ] Install Pareto Security.
* [ ] Run all available macOS security checks.
* [ ] Fix failed checks.
* [ ] Re-run the checks after making changes.
* [ ] Keep Pareto Security updated.
* [ ] Periodically review the entire Pareto report.
Pareto currently lists 32 macOS checks covering access control,
application updates, sharing/firewall, OS updates and system integrity.
---
## 3. Windows
Apply Windows-specific privacy and security hardening.
### 3.1 Account & Login
* [ ] Disable automatic login.
* [ ] Remove unused accounts.
* [ ] Use a standard user account for daily work where practical.
* [ ] Require authentication after sleep/screensaver.
* [ ] Configure automatic screen locking.
* [ ] Do not leave an unattended PC unlocked.
### 3.2 Antivirus
* [ ] Keep Microsoft Defender Antivirus enabled.
* [ ] Keep real-time protection enabled.
* [ ] Keep Defender definitions updated.
* [ ] Enable Tamper Protection where appropriate.
* [ ] Do not install unnecessary antivirus products.
### 3.3 Disk Encryption
* [ ] Enable BitLocker.
* [ ] Store the BitLocker recovery key securely.
* [ ] Keep a recovery-key copy separate from the computer.
* [ ] Verify that the recovery key is accessible.
### 3.4 Firewall
* [ ] Keep Microsoft Defender Firewall enabled.
* [ ] Verify firewall protection for the active network profile.
* [ ] Review unexpected inbound rules.
* [ ] Remove obsolete firewall rules.
### 3.5 Remote Access
* [ ] Disable Remote Desktop unless required.
* [ ] Disable unnecessary remote-management services.
* [ ] Review remote-access accounts and permissions.
### 3.6 Software
* [ ] Keep Windows updated.
* [ ] Keep installed applications updated.
* [ ] Do not use CCleaner unless there is a specific reason.
* [ ] Use BleachBit when you specifically need a disk/privacy cleanup tool.
* [ ] Use Bulk Crap Uninstaller to audit/remove unnecessary applications.
* [ ] Review installed software periodically.
### 3.7 Telemetry & Privacy
* [ ] Review Windows privacy settings.
* [ ] Review diagnostic-data settings.
* [ ] Use O&O ShutUp10++ only after understanding each setting.
* [ ] Avoid disabling security-related services merely for privacy.
* [ ] Re-check privacy settings after major Windows updates.
### 3.8 Pareto Security
* [ ] Install Pareto Security.
* [ ] Run all available Windows security checks.
* [ ] Fix failed checks.
* [ ] Re-run the checks after changes.
* [ ] Keep Pareto Security updated.
Pareto currently provides Windows checks covering antivirus, disk encryption,
firewall, remote login, password managers, updates and related configuration.
---
## 4. Linux
Apply Linux-specific privacy and security hardening.
### 4.1 Account & Login
* [ ] Disable automatic login.
* [ ] Require a password, PIN, or biometric to unlock the screen.
* [ ] Remove unused user accounts.
* [ ] Use least-privilege accounts for daily work.
### 4.2 Disk Encryption
* [ ] Enable full-disk encryption.
* [ ] Use LUKS where appropriate.
* [ ] Securely store recovery credentials/keys.
### 4.3 Firewall
* [ ] Enable a host firewall.
* [ ] Use UFW, firewalld, or nftables as appropriate.
* [ ] Review allowed inbound services.
* [ ] Remove obsolete firewall rules.
### 4.4 Sharing & Remote Access
* [ ] Disable file sharing unless needed.
* [ ] Disable printer sharing unless needed.
* [ ] Disable SSH when remote login is not required.
* [ ] Disable unnecessary network-discovery services.
* [ ] Review listening network services.
* [ ] Check listening ports periodically.
### 4.5 SSH
* [ ] Protect SSH private keys with passphrases.
* [ ] Use strong SSH key algorithms.
* [ ] Use strong key sizes.
* [ ] Disable password authentication where appropriate.
* [ ] Disable root SSH login where appropriate.
* [ ] Review `authorized_keys` periodically.
* [ ] Remove obsolete SSH keys.
### 4.6 Docker
* [ ] Run Docker in rootless mode where practical.
* [ ] Avoid running containers as root unnecessarily.
* [ ] Review exposed container ports.
* [ ] Remove unused containers/images.
* [ ] Keep Docker updated.
### 4.7 Updates
* [ ] Keep installed packages updated.
* [ ] Keep the kernel updated.
* [ ] Keep security-sensitive applications updated.
* [ ] Consider delaying package-manager releases for a short period
when supply-chain risk is relevant.
Pareto currently lists 15 Linux checks covering automatic login,
rootless Docker, screen unlocking, password managers, SSH keys, updates,
firewall/sharing, secure boot and LUKS encryption.
---
## 5. Passwords & Account Security
Protect account credentials and reduce the impact of password compromise.
### 5.1 Password Manager
* [ ] Choose one password manager.
* [ ] Consider Bitwarden.
* [ ] Consider 1Password.
* [ ] Consider KeePassXC for an offline/local workflow.
* [ ] Avoid password reuse.
* [ ] Generate a unique password for every important account.
* [ ] Use the password manager's password generator.
* [ ] Secure the master password carefully.
* [ ] Enable phishing-resistant authentication for the password manager
when available.
* [ ] Keep account recovery information secure.
### 5.2 Password Audit
* [ ] Check whether your email addresses appear in known breaches using Have I
Been Pwned.
* [ ] Replace passwords exposed in breaches.
* [ ] Replace reused passwords.
* [ ] Replace weak passwords.
* [ ] Review important accounts first.
### 5.3 Password Policy
* [ ] Use long, unique passwords/passphrases.
* [ ] Do not reuse the password-manager master password elsewhere.
* [ ] Do not share passwords through ordinary chat.
* [ ] Never store passwords in plaintext notes.
* [ ] Do not rely on password hints.
---
## 6. Multi-Factor Authentication
Strengthen account authentication beyond passwords.
### 6.1 Hardware Security Keys
* [ ] Get a hardware security key for important accounts.
* [ ] Consider YubiKey.
* [ ] Consider Nitrokey.
* [ ] Register the key with your password manager.
* [ ] Register the key with your email account.
* [ ] Register the key with other high-value accounts.
* [ ] Keep a backup hardware key in a separate secure location.
### 6.2 Passkeys
* [ ] Enable passkeys where supported.
* [ ] Prefer passkeys over passwords
when the service's implementation is trustworthy.
* [ ] Verify that you have a secure recovery method before replacing passwords.
### 6.3 Authenticator Apps
* [ ] Use a TOTP authenticator when hardware/passkeys are unavailable.
* [ ] Consider Aegis Authenticator.
* [ ] Consider Ente Auth.
* [ ] Consider TOTP support built into a trusted password manager.
* [ ] Back up TOTP recovery information securely.
### 6.4 SMS
* [ ] Avoid SMS as the primary second factor
when stronger options are available.
* [ ] Keep SMS as a recovery method only when necessary.
* [ ] Protect the underlying mobile account against SIM-swap attacks.
---
## 7. Browser
Use a privacy-conscious browser and minimize browser attack surface.
### 7.1 Browser Selection
* [ ] Choose a browser with a strong privacy/security model.
* [ ] Consider Firefox.
* [ ] Consider Mullvad Browser.
* [ ] Consider LibreWolf.
* [ ] Consider Brave if its default behavior
and additional features are acceptable.
* [ ] Consider ungoogled-chromium
if you specifically need Chromium compatibility.
* [ ] Keep the browser updated.
### 7.2 Firefox Hardening
* [ ] Configure Firefox privacy/security settings deliberately.
* [ ] Review Enhanced Tracking Protection.
* [ ] Review site permissions.
* [ ] Review notification permissions.
* [ ] Review camera/microphone permissions.
* [ ] Review location permissions.
* [ ] Review clipboard permissions.
* [ ] Review extension permissions.
* [ ] Remove unnecessary extensions.
### 7.3 Browser Extensions
* [ ] Install uBlock Origin.
* [ ] Keep uBlock Origin updated.
* [ ] Use filter lists selectively.
* [ ] Understand what each additional filter list blocks.
* [ ] Avoid installing large numbers of overlapping privacy extensions.
* [ ] Regularly audit installed extensions.
### 7.4 Deprecated/Outdated Extensions
* [ ] Do NOT use uMatrix as a new installation.
* [ ] Do NOT rely on Decentraleyes as a modern privacy control.
* [ ] Prefer actively maintained browser security/privacy tools.
uMatrix's repository has been archived since July 2021,
and Decentraleyes' original repository was archived in 2018;
therefore they should not remain in a modern baseline checklist
as recommended active tools.
---
## 8. DNS
Choose and verify a DNS configuration appropriate for your threat model.
### 8.1 Choose a DNS Provider
* [ ] Choose a DNS provider whose privacy policy you understand.
* [ ] Consider Cloudflare DNS.
* [ ] Consider Mullvad DNS.
* [ ] Consider AdGuard DNS.
### 8.2 Secure DNS
* [ ] Prefer encrypted DNS where appropriate.
* [ ] Use DNS-over-HTTPS or DNS-over-TLS when supported.
* [ ] Verify that your device is actually using the intended resolver.
* [ ] Check for DNS leaks if using a VPN.
* [ ] Do not assume that encrypted DNS makes all browsing anonymous.
---
## 9. Email
Protect email accounts, identities, and email aliases.
### 9.1 Provider
* [ ] Choose an email provider based on your threat model.
* [ ] Consider Proton Mail.
* [ ] Consider Tuta.
* [ ] Consider Disroot.
* [ ] Consider Autistici.
* [ ] Consider other privacy-focused providers after reviewing their policies.
### 9.2 Proton Mail
* [ ] If using Proton Mail, decide
whether the web/mobile app workflow is sufficient.
* [ ] If using a desktop email client, evaluate Proton Mail Bridge.
* [ ] Configure Proton Mail Bridge with a supported desktop client.
* [ ] Verify that the Bridge setup matches your threat model.
Correction to the original checklist:
Proton Mail does support desktop clients through Proton Mail Bridge.
Proton currently documents support for Thunderbird,
Apple Mail and Outlook on supported platforms.
### 9.3 Email Security
* [ ] Enable strong account authentication.
* [ ] Use a unique password.
* [ ] Enable a hardware key/passkey where supported.
* [ ] Review recovery email and phone settings.
* [ ] Review active sessions periodically.
* [ ] Remove obsolete sessions/devices.
### 9.4 Email Aliases
* [ ] Use an email alias service for registrations and low-trust services.
* [ ] Consider SimpleLogin.
* [ ] Consider Addy.io/AnonAddy.
* [ ] Use a different alias for important services where practical.
* [ ] Disable/delete compromised aliases instead of exposing the primary
mailbox.
### 9.5 Existing Email
* [ ] Decide whether existing addresses should remain public.
* [ ] Forward or migrate important accounts where appropriate.
* [ ] Use Mailvelope/PGP only when the recipients
and workflow actually support it.
* [ ] Do not assume PGP solves metadata/privacy problems.
---
## 10. Communication
Use secure communication tools and review linked devices.
### 10.1 Messaging
* [ ] Use Signal for sensitive private communication.
* [ ] Enable registration lock/PIN protection where appropriate.
* [ ] Review linked devices periodically.
* [ ] Remove devices you no longer recognize.
* [ ] Verify safety numbers for high-sensitivity conversations.
### 10.2 Other Messengers
* [ ] Evaluate Telegram according to the specific threat model before using it
for sensitive conversations.
* [ ] Do not assume that popularity equals strong privacy.
---
## 11. File Sharing
Share files with appropriate access controls, encryption, and retention.
### 11.1 Choose a Platform
* [ ] Evaluate Nextcloud.
* [ ] Evaluate Send.
* [ ] Evaluate other file-sharing services based on retention,
encryption and access controls.
* [ ] Prefer authenticated sharing for sensitive files.
* [ ] Use expiring links where available.
* [ ] Remove shared links when they are no longer required.
### 11.2 Sensitive Files
* [ ] Encrypt highly sensitive files before uploading when appropriate.
* [ ] Avoid public links for confidential information.
* [ ] Verify who has access to shared files.
* [ ] Review old shared links periodically.
---
## 12. Note Taking
Choose a note-taking system appropriate for sensitive information.
### 12.1 Choose a Private Notes Platform
* [ ] Evaluate Standard Notes.
* [ ] Evaluate Notesnook.
* [ ] Review the encryption model before migrating sensitive notes.
* [ ] Verify account-recovery options.
* [ ] Verify export functionality.
* [ ] Keep an independent backup of critical information.
---
## 13. Network & VPN
Secure the local network
and use a VPN appropriately to reduce network-level exposure
and protect traffic on untrusted networks.
### 13.1 Local Network
* [ ] Use WPA2 or WPA3.
* [ ] Use a strong Wi-Fi password.
* [ ] Change the router administrator password from the default.
* [ ] Keep router firmware updated.
* [ ] Disable unnecessary router services.
* [ ] Disable WPS when not required.
* [ ] Review devices connected to the network.
* [ ] Remove unknown devices.
### 13.2 VPN
* [ ] Choose a VPN provider based on your threat model.
* [ ] Review the provider's logging policy.
* [ ] Review the provider's jurisdiction.
* [ ] Review independent audits where available.
* [ ] Enable a kill switch where appropriate.
* [ ] Verify DNS behavior while connected.
* [ ] Understand that a VPN shifts trust from your ISP/network to the VPN
provider.
* [ ] Do not treat a VPN as complete anonymity.
---
## 14. Physical Security
* [ ] Enable automatic screen locking.
* [ ] Do not leave the computer unattended while unlocked.
* [ ] Keep the laptop physically secure.
* [ ] Avoid leaving sensitive devices unattended in public.
* [ ] Use a privacy screen in high-risk environments when appropriate.
* [ ] Keep backup/recovery keys separate from the device.
* [ ] Consider hardware security keys for high-value accounts.
---
## 15. Security Maintenance
Perform recurring checks to keep the security baseline current.
### Weekly / Regularly
* [ ] Install pending OS security updates.
* [ ] Install pending browser updates.
* [ ] Install pending application updates.
* [ ] Review password-manager security alerts.
* [ ] Review important account login activity.
* [ ] Check for unknown devices/sessions.
### Monthly
* [ ] Run a Pareto Security scan.
* [ ] Review enabled firewall rules.
* [ ] Review sharing services.
* [ ] Review browser extensions.
* [ ] Review installed applications.
* [ ] Review password-reuse/breach warnings.
* [ ] Review recovery methods for critical accounts.
* [ ] Review connected devices.
* [ ] Verify backups.
### After Major Changes
* [ ] Re-run the OS security checklist.
* [ ] Re-run Pareto Security.
* [ ] Re-check firewall configuration.
* [ ] Re-check sharing services.
* [ ] Re-check FileVault/BitLocker status.
* [ ] Re-check account permissions.
* [ ] Re-check browser extensions.
* [ ] Re-check VPN/DNS configuration.
* [ ] Verify backups.
---
## 16. Reference Material
* [ ] Read NIST SP 800-63B.
* [ ] Review official Apple security documentation.
* [ ] Review official Microsoft security documentation.
* [ ] Review Mozilla Firefox privacy/security documentation.
* [ ] Review your password manager's security documentation.
* [ ] Review your VPN provider's privacy policy and audit reports.
* [ ] Review Pareto Security's current checks periodically.
---
## 17. Final Baseline
Use this section as the minimum set of controls to verify.
### Minimum Security Baseline
* [ ] Full-disk encryption enabled.
* [ ] Automatic login disabled.
* [ ] Screen lock enabled.
* [ ] OS fully updated.
* [ ] Browser fully updated.
* [ ] Password manager installed.
* [ ] Unique passwords used.
* [ ] Strong MFA/passkey enabled on critical accounts.
* [ ] Hardware security key configured for critical accounts where possible.
* [ ] Host firewall enabled.
* [ ] Unnecessary sharing services disabled.
* [ ] Remote login disabled unless required.
* [ ] Secure boot/system integrity protections enabled.
* [ ] Malware protection enabled.
* [ ] Encrypted backups enabled.
* [ ] DNS configuration reviewed.
* [ ] VPN configuration reviewed if a VPN is part of the threat model.
* [ ] Pareto Security reports no unresolved critical configuration issues.