Securing virtual machines on Apple Silicon

Using virtual machines (VMs) on Apple silicon Macs can enhance privacy by isolating data from the host system. However, the security of these VMs has limitations, particularly before the introduction of Sequoia. Sequoia VMs can utilize Apple ID services and support full-strength FileVault encryption, which is a significant improvement over previous macOS versions that lacked integration with the Secure Enclave for key protection. This means that older VMs are more vulnerable to brute-force attacks if accessed by an attacker.

To enable Apple ID support in Sequoia VMs, users must create a new VM from scratch, as upgrades from earlier macOS versions do not suffice due to necessary structural changes. The process requires both the host and guest to run macOS Sequoia developer beta 3 or later. For optimal security, users are advised to store VMs on the internal SSD with FileVault enabled, while excluding them from Time Machine backups to manage storage efficiently.

When configuring a VM, it is recommended to sign in with an Apple ID, enable FileVault, and use a unique admin account with a strong password. Additionally, users should disable unnecessary iCloud access and network file sharing to further protect the VM's contents. Overall, while VMs can provide a level of privacy, the implementation of Sequoia enhances their security significantly, making them a more viable option for private computing on Apple silicon.