iMac Pro Secure Boot

[Trebuin]

Posted Directly from Apple's Website:
https://support.apple.com/en-us/HT208330

About Secure Boot
Use Secure Boot to make sure that only a legitimate, trusted operating system loads on your iMac Pro at startup.


Available only on iMac Pro, Secure Boot offers three settings to make sure that your Mac always starts up from a legitimate, trusted Mac operating system or Microsoft Windows operating system: Full Security, Medium Security, and No Security.

Secure Boot settings are available in Startup Security Utility:

1. Turn on your iMac Pro, then press and hold Command (⌘)-R immediately after you see the Apple logo to start up from macOS Recovery.
2. When you see the macOS Utilities window, choose Utilities > Startup Security Utility from the menu bar.
3. When you're asked to authenticate, click Enter macOS Password, then choose an administrator account and enter its password.

Full Security
Full Security is the default Secure Boot setting, offering the highest level of security. This is a level of security previously available only on iOS devices.

During startup, your Mac verifies the integrity of the operating system (OS) on your startup disk to make sure that it's legitimate. If the OS is unknown or can't be verified as legitimate, your Mac connects to Apple to download the updated integrity information it needs to verify the OS. This information is unique to your Mac, and it ensures that your Mac starts up from an OS that is trusted by Apple.

If FileVault is enabled while your Mac is attempting to download updated integrity information, you're asked to enter a password to unlock the disk. Enter your administrator password, then click Unlock to complete the download.

If the OS doesn't pass verification:

• macOS: An alert informs you that a software update is required to use this startup disk. Click Update to open the macOS installer, which you can use to reinstall macOS on the startup disk. Or click Startup Disk and choose a different startup disk, which your Mac will also attempt to verify.
• Windows: An alert informs you that you need to install windows with Boot Camp Assistant.

If your Mac can't connect to the Internet, it displays an alert that an Internet connection is required.

• Check your Internet connection, such as by choosing an an active network from Wi-Fi status menu
  
  in the menu bar. Then click Try Again.
• Or click Startup Disk and choose a different startup disk.
• Or use Startup Security Utility to lower the security level to Medium Security.

Medium Security
During startup when Medium Security is turned on, your Mac verifies the OS on your startup disk only by making sure that it has been properly signed by Apple (macOS) or Microsoft (Windows). This doesn't require an Internet connection or updated integrity information from Apple, so it doesn't prevent your Mac from using an OS that is no longer trusted by Apple.

If the OS doesn't pass verification:

• macOS: An alert informs you that a software update is required to use this startup disk. Click Update to open the macOS installer, which you can use to reinstall macOS on the startup disk. This requires an Internet connection. Or click Startup Disk and choose a different startup disk, which your Mac will also attempt to verify.
• Windows: An alert informs you that you need to install windows with Boot Camp Assistant.

No Security
The No Security setting doesn't enforce any of the above security requirements for your startup disk.

 

[Bradleyone]

I don’t fully understand who and what is being protected.

It means there can be no force booting from an external drive that has been set up on another Mac?

This would certainly secure the primary drive against an attack from a rogue OS loaded with hacking tools.

Does this mean we are not trusting the primary drive’s encryption against a custom OS with brute force decryption tools?

However, nothing stops the rogue agent from physically removing the drive, mounting it elsewhere and proceeding with the hack, does it?

Or are we protecting against a case of infiltration where the Mac is set to spy on us without us being aware it has been compromised?

 

[crw]

I don’t fully understand who and what is being protected.

It means there can be no force booting from an external drive that has been set up on another Mac?

This would certainly secure the primary drive against an attack from a rogue OS loaded with hacking tools.

Does this mean we are not trusting the primary drive’s encryption against a custom OS with brute force decryption tools?

However, nothing stops the rogue agent from physically removing the drive, mounting it elsewhere and proceeding with the hack, does it?

Or are we protecting against a case of infiltration where the Mac is set to spy on us without us being aware it has been compromised?

This protects against multiple attack vectors and you hit on 2 of the biggest:
a) It prevents someone from tampering with the EFI firmware and slipping in some spyware. This is a biggie as modifying the firmware can be hidden even from the OS itself so you can get some really hard to find penetrations there.
b) It prevents an external boot device from being loaded by anybody with physical access to the machine. Right now, a hacker can just plug in a USB (or, even more effectively, Thunderbolt) boot device and reboot to take full control of the machine (such as by slipping in an EFI firmware hack). Also, hackers (or governments) have gotten very good at hiding boot devices in everyday items like dongles and keyboards so you could get compromised by plugging in almost any random device.

While I am sure this is not perfect it is definitely great addition to security.

 

[Bradleyone]

Thank you for the explanation! Fills in the blanks.

I hope Apple makes a microwave soon.

 

[Intell]

However, nothing stops the rogue agent from physically removing the drive, mounting it elsewhere and proceeding with the hack, does it?

If the iMac Pro's flash storage is removed and used in another iMac Pro, it'll have to be wiped and repaired with the other iMac Pro's logicboard by an Apple technician.

 

[CWallace]

However, nothing stops the rogue agent from physically removing the drive, mounting it elsewhere and proceeding with the hack, does it?

One of the functions of the T2 chip is to be the SSD controller and it automatically encrypts all data written to the SSDs with a decryption key tied to the T2 chip in that specific iMac Pro. So if they are removed, they cannot be read by another machine (including another iMac Pro).