This story has been updated. It was originally published on April 13, 2017.
With high-profile data hacks regularly hitting the headlines, you might be wondering what you can do to keep your own data safe. The answer, as it turns out, is quite a lot. We’ve previously covered how to protect your Facebook, Google, and other accounts. Now it’s Apple’s turn.
If you’re an Apple fan, you probably have an iCloud account and several devices filled with your personal information. Here’s how to protect that data as securely as possible.
Apple security basics
You should be putting up strong barriers at every door into your Apple world. That means a long, unique password on your MacBook, a lengthy PIN on your iPhone, and a long, unique password for your iCloud account. Passwords should contain a mix of lowercase and uppercase letters, plus special characters and numbers, to make them as difficult to crack as possible. (And no, “Passw0rd!” isn’t good enough.) Don’t base your passwords on your address, birthday, or pet’s name—a savvy attacker might research this information in order to get past your defenses. Finally, avoid using the same password for both your Mac and iCloud. That way, even if one gets cracked, the other still has some protection.
One of your best defenses is using common sense. Hackers often trick people into revealing their login details, rather than running any sophisticated brute force attack. Be suspicious of links in emails and on social media that immediately ask you to log in with your Apple ID credentials.
When it comes to Apple device security, Apple is your best ally. The company continues to take security very seriously (though that’s not a reason to get complacent), so macOS, iOS, and iPadOS all encrypt data by default. This means nothing can be pulled from your iPhone, iPad, or MacBook without the right password or PIN code.
Add two-factor authentication
Apple accounts can be better protected with two-factor authentication (TFA). This feature is available for most major online accounts and means that entering your account will require an extra code beyond your username and password.
In the case of Apple’s two-factor authentication, attempting to log in will trigger a message to your phone number or a code to display on another device associated with your Apple ID. For example, if you’re setting up a new iPhone, you’ll see the code on your existing MacBook.
To turn on two-factor authentication on iOS or iPadOS, tap your name at the top of the first screen in Settings, then choose Password & Security to find the two-factor authentication option. On macOS, head to System Preferences from the Apple menu, then click Apple ID. Click Password & Security under your name, and turn on the feature from that screen.
[Related: How to choose safe passwords—and remember them too]
Once you’ve logged into a device with your Apple ID, password, and TFA code, that device will be marked as trusted, which means you won’t need to log in using TFA again. It’s therefore important that you do have passwords, PIN codes, and other types of protection on your computers and phones to prevent unauthorized access.
Manage Apple security in your web browser
To configure the different parts of your security setup, open your Apple ID account page in a web browser. Make sure your registered email addresses and your trusted phone numbers are up to date and secure, because you might need them if you should ever lose access to your account.
Under the Devices heading, you can see the iPhones, iPads, and computers associated with your account. Use this opportunity to remove any devices you no longer use or don’t recognize. It’s a good idea to check this list fairly regularly, just in case your account has been compromised or you’re signed in somewhere you shouldn’t be.
Any web browser on any computer will also let you access the iCloud suite of web apps and services. If you’re on a public computer or a machine you share with others, just be sure to sign out after you’ve finished. Some browsers may ask to remember your password. You can allow this on your personal computer, but make sure that something else will prevent a guest from accessing the browser. For example, set up a user account password for getting into the operating system.
Head to Settings on iCloud.com, and you can reach the same Apple ID account page we looked at earlier to get another overview of the devices linked with your Apple ID. At the foot of the page is an option to sign out of all browsers. Click this to make sure no one’s using iCloud with any other web browser except the one you have open.
Other security tips
The app stores that Apple has built into iOS, iPadOS, and macOS do a very good job of keeping you safe from dangerous software and viruses. On your phone or tablet, you shouldn’t have to install anything from outside the iOS App Store. On your computer, however, you may need to venture outside the walls of the macOS App Store every now and again. If you do, read user reviews and web write-ups to double-check on any program you install.
When it comes to security, you definitely want to hope for the best, but plan for the worst. So take the time now to consider what you’ll do if, despite all your precautions, your devices are compromised. We recommend turning on the Find My feature on your phone (tap your name in Settings to find it). This will let you locate and remotely wipe your iPhone or iPad from the web if it falls into the wrong hands.
Macs have the same option, accessible via Security & Privacy inside System Preferences. It will show you where your Mac computer is, as well as lock or erase it remotely. If you’ve simply lost your devices inside your home, this feature can also get them to play a sound.
Meanwhile, if you’ve gone all-in with your Apple products and got yourself an Apple Watch, you can use this as a secure way to unlock macOS, saving you the trouble of typing out a password each time. To set up the feature, head to your computer’s System Preferences, then click Security & Privacy and select the option to Allow your Apple Watch to unlock your Mac.
