ISG recommends that faculty and staff use FileVault if they use laptops containing data with a risk of Level 2 or 3 (especially frequent travelers). FileVault 2 requires OS X Lion or later, and OS X Recovery installed on your startup drive. It uses full disk, XTS-AES 128 encryption to help keep your data secure. What restrictions are there when traveling out of the country with an encrypted laptop?Ī.FileVault 2 is an integral security feature for Macs that allows you to encrypt the contents of your entire drive.How do I use FileVault 2 to encrypt my laptop?.The bonus? Because the T2 chip has already encrypted the drive, there’s no overhead and no delay: FileVault is immediately enabled. I recommend enabling FileVault on T2-equipped Macs for the greatest security and peace of mind. Until that password is entered, the disk’s contents remain encrypted just as if it were at rest. Instead of loading macOS directly, the Recovery partition boots in a special mode that requires entry of the password of any account allowed to use FileVault. Turn on FileVault, however, and a T2-equipped Mac engages in the same boot behavior as one that handles disk encryption in software. A malicious party might be able to subvert macOS or use hardware methods to access data from the mounted and running drive.

While the encryption is locked to a hardware key managed by the Secure Enclave in the T2 chip, decryption kicks in as soon as the Mac boots to a login screen. However, without enabling FileVault, a Mac merely has to be booted for the full-disk encryption to start working, even if it doesn’t automatically log into an account. (As a result, by the way, T2-equipped Macs that receive an Erase This Device command via Find My Device become nearly instantly “erased,” just like a Mac with no T2 chip and FileVault enabled: erasing the encryption key renders the drive’s contents permanently irretrievable.) That’s an improvement over pre-T2 Macs, where the non-FileVault-protected contents would be fully readable. With FileVault off on a T2-bearing Mac, if a ne’er-do-well extracted the drive from a Mac, the contents remain inaccessible.

File vault mac