Companies like Apple, which are at this point is as much a leading tech company as it is a pop-cultural icon, are so a part of our daily lives that many people just assume they are inherently safe to use. Millions of people bank, manage their business, purchase, and exchange intimate personal information using Apple products every day. With so many high profile cybersecurity breaches and attacks over the last several years (some involving Apple itself), how does the company’s cybersecurity stack up?
Apple’s Cybersecurity Team
Apple is widely recognized in the industry and by numerous leading tech publications as having some of the most robust cybersecurity infrastructure in the world and employing top talent to create and manage it. Apple’s current director of security architecture is Ivan Krstić, who in 2007 was selected by the MIT Technology Review as one of the world’s top 35 innovators under the age of 35, and by eWeek as one of the top three most influential people in modern cybersecurity.
While the battle for cybersecurity is a constant game of cat and mouse, Apple users can feel confident that the company managed to recruit such top talent, especially given the glaring cybersecurity talent shortage around the world.
Hardware Security
All Apple hardware has its security functionality designed into silicon, including the most vital component: the system enclave processor. This is a component of all modern iOS, iPadOS, tvOS, watchOS and Mac desktops and laptops with Apple’s T2 Security Chip.
Additionally, all modern hardware with this T2 chip also feature a dedicated AES hardware engine which powers the devices’ speed-line encryption when files are read or written. This process enables the Data Protection and FileVault to make sure user files are protected without giving away any long-lived encryption keys to a device’s CPU or OS.
App Security
App security is another important security feature to take into consideration because of how much personal information we grant our apps access to. Apple goes to great lengths to ensure that there are multiple layers of app protection to guard against malware and other malicious programs.
iPhone, iPad and iPod touch only use App Store compatible apps, all of which are sandboxed, to ensure a high degree of control over app design and release. Mac users, however, can download other apps from the internet. In order to ensure they are safe to use, Apple has a process of notarization in place. Only notarized apps which have received Apple’s seal of approval will launch.
Encryption and Data Protection
Apple has security features in place to protect user data even if other areas of the security infrastructure have been compromised. What’s more, OS kernels make sure access controls are enforced to prohibit unauthorized data access. This includes sandboxing apps–which places limits on the data any given app can access–and highly enforced Data Vaults.
That said, Apple has come under fire over the last couple of years for taking a soft, and even a hypocritical stand on data privacy, allowing Facebook to essentially get away with massive intrusions into user privacy. Good cybersecurity infrastructure and best practices should really be accompanied by a philosophy of uncompromising data sovereignty.
Conclusion
Apple, while very much a player in the big tech, big data economy, which thrives off the collection and operationalization of user data, is widely respected across the board for its robust cybersecurity infrastructure. It employs top talent, exerts a high degree of influence on application quality control and has solid security features designed into the hardware itself.