macOS asks before an app can use your camera, microphone, location, files or screen. Most of the work here is reviewing what you've already allowed and turning on a few protections.
1Review permissions
Open System Settings > Privacy & Security. Go through Location Services, Camera, Microphone, Screen & System Audio Recording, Full Disk Access, Accessibility and Files & Folders. Turn off anything you don't recognise or no longer use. Also check System Settings > General > Login Items & Extensions.
# reset an app's camera permission so it asks again (bundle ID optional)
tccutil reset Camera com.example.app2Turn on the firewall
Go to System Settings > Network > Firewall and turn it on. Under Options you can block all incoming connections or turn on stealth mode, so the Mac doesn't answer probes.
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on3Lockdown Mode
Lockdown Mode is an extreme, optional protection for people who may be targeted by sophisticated attacks. It blocks most message attachments, some web technologies and incoming FaceTime from unknown callers, among other things. Most people don't need it. To turn it on, go to System Settings > Privacy & Security, scroll to Lockdown Mode, click Turn On, then restart.
4Check the built-in protections
fdesetup status # FileVault
spctl --status # Gatekeeper
csrutil status # System Integrity Protection5Good habits
Install updates promptly.
Use a standard account for day-to-day use if you share the Mac.
Use the Passwords app and passkeys (see that tutorial).
Be wary of apps that ask for Accessibility or Full Disk Access without a clear reason.