HighOS hardeningBLWK-MAC-001

FileVault disk encryption is off

What this means

The startup disk isn't encrypted. Anyone who gets hold of this Mac — lost bag, repair shop, theft — can read every file on it, including SSH keys, browser sessions and cloud credentials, without knowing your password.

How to fix it

Turn it on in System Settings → Privacy & Security → FileVault (or sudo fdesetup enable). Keep the recovery key in your password manager, not on the Mac.

Check it yourself

Run a scan and look for BLWK-MAC-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads macos_security and reports this check when:

filevault_on_known == true and filevault_on == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1005
• MITRE ATT&CK T1552.001

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001