One of the commonly touted advantages to using a Mac is that it's more secure and less prone to malware than a PC running Windows. It's easy to see where this attitude comes from: The prevalence of viruses and network attacks against Windows machines is greater by several orders of magnitude.
In fact, a recent Trojan horse virus hidden in a pirated copy of iWork '09 that circulated on peer-to-peer file-sharing sites was big news because it was the first Macintosh virus to be widely circulated on the Internet (though there have been a handful of proof-of-concept malware iterations over the past few years). But the much lower rate of malware and network attacks isn't proof that the Mac is immune to such things.
[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. | And discover the key Mac and Apple tech trends for business users. Subscribe to InfoWorld's Mac technology newsletter. ]
Indeed, there has been an ongoing debate over the years as to whether Mac users truly have more-secure machines or simply enjoy "security through obscurity" because they represent a relatively modest fraction of all computer users. While this debate will continue -- and there are valid arguments on both sides -- this article isn't about that debate; it's about a pair of simple questions: "How safe is your Mac?" and "How can you make it safer?"
The truth is that Apple does provide a pretty safe platform. The company leverages a number of advanced technologies to keep users and their data safe from harm. For a detailed list, see this Apple white paper (download PDF). But no system is perfect, and there are a number of security holes -- many of them easily closed -- that are common on Mac OS X systems. Here are 15 ways to fix the most frequently exploited security risks and protect your Mac.
Note: Unless we specifically say a tip applies only to Leopard, it should work with most recent versions of OS X, though the actual steps involved might vary somewhat.
Disable automatic opening of 'safe' downloads in Safari
Probably one of the biggest Mac holes is in Apple's Safari Web browser, which downloads files that you click on or that are embedded in a Web page. That presents a problem because, by default, Safari is designed to open "safe" files as soon as they've been downloaded. Unfortunately, the definition of "safe" includes package-installer and disk image files, which can contain malware. If the malware files are embedded in a Web site, they could be downloaded and opened automatically.
Apple has done a good job of combating the potential damage in Mac OS X Leopard, which automatically detects disk images and applications that have been downloaded from the Internet via Apple's applications (Safari, Mail and iChat). However, to be truly safe, one of the best and easiest things you can do is disable the automatic opening of such files in the Safari preferences.
From the Safari menu in the menu bar, select Preferences, click the General tab, and uncheck "Open 'safe' files after downloading." From now on, you'll need to manually open downloaded files by double-clicking them in your Downloads folder or in Safari's list of downloaded items.
Make sure not to click the "Do not show" option in the warning dialogs that Leopard displays when you open downloaded files; that way, you'll always be warned the first time each downloaded item is opened. (Note: This tagged file feature was introduced in Leopard and doesn't apply to earlier versions of Mac OS X.)
A similar security feature in Leopard is support for code signing, which places a digital signature in application files; your Mac checks them at launch to be sure that they haven't changed and alerts you if they have. Although many third-party applications don't yet support this, it is a powerful feature, and you should pay attention to any such warning. As with the tagging of downloaded files, do not click the "Do not show option" if you do see one of these alerts.
Install antivirus software
The limited number of viruses that target Mac OS X often leads Mac users into a false sense of security. Although there are few Mac viruses out there now, that doesn't mean there will never be a virulent form of malware that threatens the Mac. And the lackadaisical approach of assuming that Macs can't be infected by a virus increases the chances of widespread infection and damage when (not if) such a virus is developed and released into the wild of the Internet.
Besides, even if it doesn't affect you directly, you might receive and inadvertently pass on a Windows-specific virus. The most common of these are macro viruses found inside Office documents -- some of which have a limited ability to affect machines with a version of Office for Mac that has macro support enabled.
Finally, if you are running Windows -- either in a dual-boot configuration with Apple's Boot Camp or under a virtualization tool such as Parallels Desktop -- your Mac is just as susceptible to viruses as any PC. In fact, if you have a Windows operating system on your Mac, you should really consider virus protection for both Mac OS X and Windows.
When it comes to antivirus programs for the Mac, a good open-source option is the Unix-based ClamAV (which works with Mac OS X but is command-line based) and its Mac graphical user interface port ClamXav.
If you want a more full-featured commercial offering that provides constantly running protection, check out Intego Systems' VirusBarrier ($70 for one device; $200 for up to five devices), Sophos Anti-Virus SBE (variable pricing depending on number of users and years of service, beginning around $45 for a single license or $190 for five users), Norton AntiVirus from Symantec ($50 for one user) or McAfee's VirusScan ($37 per device for up to 25 devices).
Don't allow remote guest access or enable Leopard's guest account
Macs have always supported guest access for file sharing, in which a remote user can connect to a Mac without providing a username, password or other identifying information. The idea of allowing remote access to your Mac has always been fraught with potential for security compromises. It should never be allowed because it presents a grave security threat that could prevent you from easily tracking the source of a breach.
In Leopard, Apple extended guest access to the local level: Users can log in and use a Mac with a guest account that requires no username or password. The idea of a guest account is a convenient one. If you have friends or family visiting, you can let them use your Mac without allowing them access to your user account or files. When they log out as a guest, their home folder and any files they created are automatically deleted.
There are, however, some system directories, such as the Unix /tmp directory, that the guest account can write data to that may or may not be deleted at logout (or forced restart). The guest also has access to any installed applications, which could be used to perform malicious actions from your computer. If you must use the guest account, limit its access using Parental Controls.
You can turn off both the guest account and remote guest access in the Accounts pane of System Preferences in Leopard. Select Guest Account on the left, then uncheck both "Allow guests to log into this computer" and "Allow guests to connect to shared folders."
If you'd rather keep the guest account but limit its access to files and apps, keep "Allow guests to log into this computer" checked and click the Open Parental Controls button for options.
Use secure passwords
User passwords are one of the foundations of security. If you use a password that is simple or easy to guess, you're just asking for someone to break into your computer or user account.
Mac OS X includes a password assistant that automatically generates random passwords according a specified level of complexity; it also checks the complexity of passwords that you create. Make use of this feature whenever you need to generate a password -- for Web sites or other services as well as for your Mac OS X user account.
To get to the password assistant, go to the Accounts pane in System Preferences, select a user account, click the Change Password option, and then click the button with a key icon next to the New Password field.
Even the most complex password can be cracked, however, so remember to change your password frequently. If you don't trust yourself to remember, try setting a monthly reminder in iCal.
Disable automatic login
As part of the Setup Assistant that runs when you install Mac OS X or start up a new Mac, Mac OS X enables automatic log-in for the first user account that you create -- which means you can log in without providing a username and password whenever you start up.
While automatic log-in is convenient, particularly if you're the only user of your Mac, it also means that anyone who has physical access to your Mac can simply restart it to gain full access to your account and your files. This is a particularly significant risk for Mac laptop users.
You can disable automatic log-in in the Accounts pane of System Preferences by clicking the Login Options button at the bottom of the user accounts list on the left. The automatic log-in option appears at the top of the area on the right; select Disabled from its pop-up menu.
Don't display usernames or password hints at login
By default, Mac OS X's log-in window displays a list of all users on a Mac (or all users who can access a Mac in a network). This makes it easier for anyone who has physical access to a Mac to gain access to it, since they need only guess a password. Disabling the display of users adds another layer of security because it requires that a malicious user know the username associated with an account.
Another simple act to help secure an account is to disable password hints (which Mac OS X will normally display to help you remember your password after three failed log-in attempts). This significantly undermines the security of using a password and should always be disabled.
Both of these options can be configured in the same Accounts pane where you disabled automatic log-in. To disable password hints, simply uncheck the box next to "Show password hints." To choose not to display usernames in the log-in window, select the "Name and password" radio button next to "Display log-in window as," which means users will have to type both a username and its password to log in.
Set a firmware password
The biggest security risks occur if your Mac is stolen or physically compromised. Even if thieves can't log into your account, they can gain access to the data on your Mac using one of the many special start-up modes built into all Macs, such as booting from an install DVD and resetting your password, using Target Disk Mode to make your Mac act as an external hard drive, or booting into the Unix-style Single User Mode.
You can, however, place a firmware password on your Mac. This password is written into the firmware chips on the Mac's motherboard using either the Open Firmware standard on PowerPC Macs or Extensible Firmware Interface (EFI) on Intel Macs. Regardless of platform, the free tool from Apple for implementing a firmware password is called the Open Firmware Password Utility. Apple provides complete steps for setting a firmware password on its support site.
If you or anyone else tries to use a special start-up mode, the user will be required to enter the firmware password. This can significantly secure personal, business or educational Macs against tampering. However, be warned that if you forget a firmware password, there is no way to reset or remove it.
Use the Security pane options in System Preferences
The Security pane in System Preferences offers Mac users a number of simple but powerful options for securing their systems -- requiring a password for waking from sleep or a screensaver, disabling automatic log-in (and thus requiring authentication at start-up), requiring an admin account username and password to modify settings in System Preferences, automatically logging out after a period of inactivity, and disabling the use of Apple's infrared remotes with the computer or pairing the computer to only one specific remote.
Each of these can go a long way to securing access to your data if someone has physical access to your Mac. This is particularly important if you have a Mac laptop or are working with a Mac that offers any form of public access.
The option to use secure virtual memory is also located here. When secure virtual memory is enabled, the swap file that a Mac uses to store running data if it begins to run short of RAM will be encrypted. This drastically reduces the chance that if a Mac is physically compromised, any data for active applications or processes will be retrievable. This is important because virtual memory may contain sensitive information that can be used to compromise a Mac even if data on a drive is secure.
Disable unused network interfaces
If you look in the Network pane of System Preferences, you'll notice that most Macs include multiple network interfaces, such as Ethernet, AirPort/802.11, FireWire and Bluetooth. In theory, any active network interface could be used to access your Mac in a remote attack -- particularly wireless technologies, which don't require a physical connection to a network.