Document macOS on Fleet and retire the Jamf pages

### Endpoint Management

#### Jamf

[Jamf](https://www.jamf.com/) allows us to remotely manage all of our Macs to perform tasks such as pushing updates, encrypting devices, remotely locking and wiping laptops, etc. All new Macs purchased and shipped by GitLab vendors are automatically enrolled in Jamf. It may be necessary to manually enroll a laptop if it was self-procured. GitLab Corporate services should not be accessed from a Mac that is not enrolled in Jamf.

#### Fleet

[Fleet](https://fleetdm.com/) is an Open-Source remote management system that is required to be installed on all Dell devices in order to be able to access GitLab Corporate services. Similar to Jamf, it allows us to remotely manage enrolled laptops to ensure security compliance, and perform tasks such as remotely locking and wiping machines.

[Fleet](https://fleetdm.com/) is an Open-Source remote management system that is required on all Macs and Dell devices in order to be able to access GitLab Corporate services. It allows us to remotely manage enrolled laptops to ensure security compliance, and perform tasks such as pushing updates, encrypting devices, and remotely locking and wiping machines.

All new Macs purchased and shipped by GitLab vendors are automatically enrolled in Fleet. It may be necessary to [manually enroll](/handbook/eta/corporate-it/end-user-services/onboarding101/#manual-mac-setup) a Mac if it was self-procured. GitLab Corporate services should not be accessed from a Mac that is not enrolled in Fleet.

### Backblaze

## Overview

All laptops are required to have hard drive disk encryption enabled. Our Jamf polcies will automatically enable Disk Encyption

All laptops are required to have full disk encryption enabled.

All team members needed to provide proof of disk encryption in the new laptop order or onboarding issue.

## Configuration Steps

## Apple macOS

### Apple macOS

> **No Action Required:** We use [Fleet](/handbook/security/corporate/systems/macos/) to enable FileVault for you automatically and monitor for any laptops that are misconfigured. New Macs turn on FileVault during setup. Manually enrolled Macs prompt you to log out and back in to turn it on.

> **No Action Required:** We use [Jamf](/handbook/security/corporate/systems/jamf) to enable hard drive encryption for you automatically and monitor for any laptops that are misconfigured. You do not need to configure anything, however you are encouraged to verify that is enabled.

### Verify and provide proof of encryption

You need to enable FileVault to ensure that your laptop hard drive is encrypted.

1. From your Mac, choose Apple menu ** > System Settings**.

2. Click on the "Security & Privacy" icon.

3. Click on the "FileVault" tab.

4. Verify that FileVault is turned on and your drive is encrypted.

1. Choose **Apple menu** > **System Settings**.

2. Click **Privacy & Security**.

3. Scroll down to **FileVault** and verify that it is turned on.

4. Choose **Apple menu** > **About This Mac** to show your serial number.

5. If you need to provide proof of encryption, take a single screenshot with both windows side by side.

[Vendor Docs - Protect data on your Mac with FileVault](https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac)

### Linux

## Linux

You need to enable Disk Encryption when you first set up the OS. Enabling the feature later is not recommended as it can lead to instability.

## Proof of Encryption

To provide proof of Full Disk Encryption, please do the following depending on the system you are running.

### Apple macOS

Take a single screenshot with two windows side-by-side showing both the confirmation of enabled Full Disk Encryption as well as the info showing your serial number.

Both pieces of information can be found by:

1. In the Menu Bar click on  ** > System Settings**.

2. Click on the "Security & Privacy" icon.

3. Click on the "FileVault" tab.

4. Then in the Menu Bar click on  ** > About This Mac**.

5. Take a screenshot for both windows side by side

### Linux

Take a screenshot showing the output of `sudo dmsetup ls && sudo dmidecode -s system-serial-number && cat /etc/fstab`

To provide proof of encryption, take a screenshot showing the output of `sudo dmsetup ls && sudo dmidecode -s system-serial-number && cat /etc/fstab`.

For team members that are security conscious, you can purchase and expense 3rd party firewall software like [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html) or [LuLu](https://objective-see.org/products/lulu.html). These allow you to monitor and control outbound traffic on a per-application basis.

Be sure to allow Jamf and SentinelOne to communicate with their management consoles.

Be sure to allow Fleet, Munki, and your EDR agent (CrowdStrike or SentinelOne) to communicate with their management servers.

## Network Exceptions

You'll be required to read the [Internal Acceptable Use Policy](/handbook/people-group/acceptable-use-policy/) as part of the onboarding issue.

Please be aware that your computer is monitored by [Jamf](/handbook/security/corporate/systems/jamf) (MDM) and [SentinelOne](/handbook/security/corporate/systems/sentinelone) (EDR), **including any URLs that you visit**. This is only used for retroactive security investigations and we do not proactively monitor for you activity. In other words, it's not a "big brother" monitoring approach, it's for having as much forensic breadcrumb trail data as possible if your computer is breached. You can learn more about what data we can see in this [slide deck](https://docs.google.com/presentation/d/1C2ufNXF28l0KTd5PPTkq1TjUWeWPI44VfwYbsvOzkns/edit).

## Security Tools on Your Laptop

GitLab uses a variety of security tools to protect your laptop, control what can run on it, and proactively detect and remediate security threats. These tools collect information about your device, the software installed on it, and security events. Outside of Works Council countries, they also collect the URLs you visit. CorpSec uses this information to keep laptops secure and compliant, respond to threats, and investigate security incidents. It is not used to monitor your productivity or personal activity.

## Screen Saver and Password Lock

> **No Action Required:** This has been automatically configured by [Jamf](/handbook/security/corporate/systems/jamf), however verification is recommended.

> **No Action Required:** This has been automatically configured by [Fleet](/handbook/security/corporate/systems/macos/), however verification is recommended.

- Set up a screen saver with password lock on your laptop with a timeout of 15 minutes (or less).

- Require password after screen saver starts after 5 seconds (or less).