Viruses are not the problem, you are. We separate fact from myth to expose the genuine security risks threatening Mac users everywhere.

When it comes to protecting your Mac from the dangers lurking in cyberspace, it’s sometimes difficult to know whose advice to follow. If Apple had its way, you’d take it on faith that your Mac is the most secure computing platform around. But if you scan the software shelves at an Apple Store, or even Best Buy, you’ll see lots of Mac security titles—from antivirus to Internet security to personal firewalls. You might assume that if the software exists, there must be some dire threats you didn’t know existed. As you might guess, though, the truth falls somewhere in between “There’s nothing to worry about” and “They’re out to get you.” To uncover the truth, we talked to a cadre of security experts with experience protecting Macs and Windows machines. Because as much as we’d like to live life without exposing ourselves to the W-word, it is the most common operating system in the world—at least for now—and like it or not, you’re exchanging info with Windows users all the time, which means that if you care about the integrity of your data—and your Mac—securing both should be a concern. Computer security’s not fun or sexy, but it’s one of life’s necessities. And it’s not a major undertaking to safeguard your Mac—as long as you know what the real threats are.

Harris Weisman is the information security officer for a regional bank. He oversees data and network security for the entire organization, including customers’ bank accounts and transaction information.

Weisman polices a network of 400 or 500 computers dominated by machines running Microsoft Windows. At home, however, the Certified Information Systems Security professional responsible for securing data worth millions of dollars has a different computer: a Macbook Pro. “I am tired of having to deal with all the Windows issues that keep popping up,” says Weisman. “I get enough of this at the bank and don’t want to deal with it at home.” Aside from the operating system, he has also been a longtime fan of Apple’s industrial design.

Enthusiastic Mac users have been boasting that the Mac OS X is more secure than Windows for over a decade. They rely on personal experiences and those of their friends, as well as anecdotes and marketing messages to come to this conclusion. Most Mac users considering the question don’t share Weisman’s experience as a security professional.

“I think out of the box, Mac OS X is more secure, and you can increase the security with other applications,” says Weisman. “And—joy of joys—it’s still usable. Couple that with small market share for the Mac, and you have a good combination…If you really lock down Windows, you can make it secure, but then you essentially get a useless box.”

Though Apple has been selling more Macs lately—it sold 2.5 million machines in the third quarter of this year, according to the company’s earnings call on July 21—Weisman doesn’t see the growing Mac user base as a problem. “I still think Mac OS X is better,” he says. “Apple is more willing to issue updates than Microsoft is, at least for now.”

Who's The Enemy?
Mac OS X’s Unix underpinnings and the lack of viruses on the platform relative to those that affect Windows lead many Mac users to believe that they are immune just because they use a Mac. The notion of catching a computer virus seems foreign to many Mac users, while Windows users have been dealing with the threat for over 
a decade.

However, any discussion of computer security that limits itself to viruses is shortsighted. The real threat to Mac users—right now—is not virulent code. It’s the security holes in applications or the operating system, known and unknown, that attackers could try to exploit. True, such exploits are not technically viruses, but that doesn’t make them good for you or your Mac.

The truth about Mac security—if this “truth” actually has anything to do with the Mac at all—is that the biggest security hole in computing today is usually located between the chair and the keyboard. That’s what you’ll hear if you ask Mike Romo, Macintosh project manager for Symantec, which develops and publishes security software, including the well-known Norton Utilities suite. Romo cites user complacency as the No. 1 threat on the Mac.

“I am not going to jump up and down and rant that everyone needs to run antivirus—that would be idiotic,” says Romo. “But that being said, in mid-June we had four threats come out in six days, including a keylogger.”

Keyloggers record keystrokes. A legitimate use for a keylogger would be for a computer owner to record his computer’s keystrokes, perhaps to see how it is being used. When the computer owner is unaware that a keylogger is installed (as was the case with the AppleScript.THT Trojan Horse discovered in mid-June), that’s called malware or spyware, and odds are, a malicious person is trying to use it to capture passwords and gain access to sensitive data.

“Now I can’t say there is no real spyware for the Mac,” says Romo. “That’s a big deal, I think. We also saw the first dual-platform threat that masqueraded as a video codec on porn sites—things are changing, you know?”