Endpoints

Last updated: Oct 13, 2026

Device management

In order to protect our clients' data, we administer our devices with a Mobile Device Management (MDM) tool.

This tool enables the following:

Comprehensive visibility into device compliance, security configuration, overall fleet risk, and device logs
Enforcing full-disk encryption across endpoint devices to protect data at rest and manage security compliance
Blocking unauthorized users or automated tools from restarting a device into its Recovery Operating System (Recovery Mode)
Applying hardening configurations through Blueprints, which bundle pre-configured security settings and Library Items
Restricting removable media and enforcing the security restrictions described on this page
Detecting and blocking malware and malicious activity with endpoint detection and response (EDR)
Identifying vulnerable software on our devices with vulnerability management
Swift investigation of issues and automation of remediation workflows
Disabling Bluetooth Sharing to prevent files from being shared through Bluetooth
Disabling the Bonjour advertising service, which stops the device from advertising its services on the local network
Enabling Secure Keyboard Entry, which prevents other applications from capturing what is typed in the terminal
Enabling System Integrity Protection (SIP), which protects critical system files and processes from modification, even by administrators
Enforcing a custom policy banner that displays the organization's access notification before login
Ensuring that date and time are set automatically to keep the clock synchronized, which ensures accurate timestamps in logs
Setting a retention period for install.log to keep the software installation log for a defined period
Showing all filename extensions in Finder, which helps users identify file types and avoid disguised malicious files
Showing the location icon in Control Center when system services request location

Additionally, the MDM automatically collects data from our IT assets, such as:

Devices: General inventory of managed devices, including hardware details, OS version, and enrollment status
Activation Lock: Whether Activation Lock is enabled on each device
Application Firewall: Status and configuration of the built-in firewall
Apps: Applications installed on each device and their versions
Certificates: Certificates installed on each device
Desktop & Screensaver: Screen lock and screensaver settings
FileVault: Disk encryption status
Gatekeeper & XProtect: Status of macOS built-in protections against untrusted software and malware
Installed Profiles: Configuration profiles applied to each device
Kernel Extensions: Kernel extensions loaded on each device
Launch Agents & Daemons: Background items configured to start automatically
Local Users: Local user accounts present on each device
Startup Settings: Startup security configuration
System Extensions: System extensions installed on each device
Transparency Database: Permissions granted to apps to access protected resources, such as the camera, microphone, or files

Each user account is associated with a device, and access to these is also monitored and controlled (see the article about device enrollment).

The Blueprint is set up following our criteria.

Mobile devices assigned to users requiring a phone are managed via our MDM solution. Okta enforces an authentication policy granting access exclusively to MDM-managed devices. Additionally, mobile devices follow specific security configurations defined within the MDM Blueprint.

Endpoint detection and response (EDR)

Our managed devices run the EDR capabilities of our MDM tool. EDR monitors endpoint activity using behavioral detection, blocks malware and other malicious activity, and supports the investigation and remediation of detections. Detections are handled through our incident management process.

Malicious website and content filtering is handled separately through our web filtering controls.

Vulnerability management

The vulnerability management capability of our MDM tool identifies known vulnerabilities in the operating system and the applications installed on our managed devices. Findings are prioritized by severity, and remediation is carried out by updating or removing the affected software.

Self-Service

The Self-Service function allows users to access the enterprise app store, install apps, update software, and maintain their own device without a help desk ticket. All Self-Service-hosted applications are analyzed and approved/denied by our IT Manager and CTO. This applies to any additional application request employees send.

Device policy

We use a single MDM Blueprint for all Fluid Attacks devices, including laptops and iPhones, covering both administrators and regular users. This Blueprint includes the different policies required to manage and secure these devices.

Authorization

We control how devices can be accessed only by their intended users and how permissions over those devices are managed. We comply with the following criteria:

Laptops' passwords and data are visible only to their users. The use of KeyChain is mandatory for all users for security purposes; to protect passwords saved in KeyChain, it automatically locks when the computer is locked or suspended.
Automatic login is disabled to prevent data leaks; a password is required for system configuration and to access data.
Access to the device is only possible through Okta Passport: users without an active account cannot log in. In addition, the local password is synchronized with the Okta password.
Okta's password requirements are described in our password policy.

Requirements:

Updates

Apps from the App Store and Auto Apps are updated as soon as a new version is released, without IT having to run anything manually. Likewise, OS updates are managed automatically. Vulnerability management helps us identify outdated or vulnerable software on our devices so it can be updated or removed.

Users

We control how login is made on devices and create local accounts improving security:

The guest account is disabled on all devices. Users without an active account cannot log in.
The login window prompts a user for their credentials, verifies their authorization level, and then allows or denies the user access to the system.
The presence of the Guest home folder can cause automated audits to fail when looking for compliant settings within all User folders as well. Rather than ignoring the folders' continued existence, it is best removed.

Requirements:

Preferences

We control what the user can accomplish with manual configurations on the devices, restricting access to unnecessary system configurations to devices depending on their use for the different roles.

Requirements:

Networking

We control how we handle insecure protocols and services, which can compromise the data stored on the devices:

HTTP Apache server and NFSD is part of the operating system and can be easily turned on to share files and provide remote connectivity to an end-user computer. Web sharing should only be done through hardened web servers and appropriate cloud services.

Requirements:

Auditing

We handle logs and monitor our devices for auditing purposes as follows:

The audit system writes important operational and security information that can be both useful for an attacker and a place for an attacker to attempt to obfuscate unwanted changes that were recorded. As part of defense-in-depth, the /etc/security/audit_control configuration and the files in /var/audit should be owned only by root with group wheel with read-only rights and no other access allowed. ACLs should not be used for these files.
The socketfilter firewall is what is used when the firewall is turned on in the Security PreferencePane. In order to appropriately monitor what access is allowed and denied logging must be enabled.

Requirements:

Removable devices

All removable devices are limited and controlled, including external disks, disk images, DVD-RAM, USB storage devices, and removable disc media, such as CDs, CD-ROMs, DVDs, and recordable discs.

The status of the control can be mountable and not mountable. Our current policy is completely restrictive, none of these devices can be mounted.

Requirements:

Fluid Attacks staff access and agree to the Endpoint Secure Management Policy through Vanta.

Endpoints

Device management

Endpoint detection and response (EDR)

Vulnerability management

Self-Service

Device policy

Authorization

Updates

Users

Preferences

Networking

Auditing

Removable devices

References

Requirements

Other secure authorization measures

On this page