4 ms·

The basic stuff really. Keep your software up-to-date (older versions of OS X get less love from Apple as fixing vulnerabilities goes). Turn on OS X's FileVau

The basic stuff really. Keep your software up-to-date (older versions of OS X get less love from Apple as fixing vulnerabilities goes). Turn on OS X's FileVault and firewall, install LittleSnitch [1]. Turn on 'Ask for password on wake'. Create a user account to work in, don't use your Admin account for everything. Don't install Java Runtime, Adobe Flash Player, Adobe Acrobat Reader, Microsoft Office, MSN/AIM Messenger, or Microsoft Windows (Bootcamp, VM, or otherwise). Disable Flash plugin in Chrome. Only install signed apps. Run good AV on your incoming mail server. For testing on Windows, use a separate box or host it remotely. [1] http://www.obdev.at/products/littlesnitch/index.html http://www.obdev.at/products/littlesnitch/index.html

bigiain 14y ago
" … or Microsoft Windows (Bootcamp, VM, or otherwise)" I'm curious, do you think there's any attacks that can break out of those visualization environments and threaten the host MacOSX machine? I quite often use "throwaway" Windows VM clones for IE testing - usually (but not religiously) starting from scratch with a new fresh clone (but occasionally leaving one running for maybe a few days at a time). I'm never _too_ worried about hardening my Windows VMs, since I (at least intend to) throw them away after using them. I never bother disabling Flash/Java/Acrobat in them either, since I generally only visit sites I'm developing (and, as above, I throw them away anyway).
- 46Bit 14y ago
  If that VM is isolated, you're fairly safe. Most people in practice run VMs on a Mac with various Sharing options enabled where files can be dropped to/from your Mac filesystem if the VM is breached. Given that a lot of people don't run AV or Firewalls on their VMs they're a very easy target.
diziet 14y ago
An outgoing firewall is a hassle to keep track of, though -- with all the plethora of system calls and background processes that constantly request data the management must take a lot of time away.
- Samuel_Michon 14y ago
  Yes, before you've settled on a set of permanent rules, it takes some tending to. In my experience, that's just the first couple of days. Also, it can be an educational experience, if you let it. If it's not clear what the process does that's requesting Internet access, I look it up; as a result I now know far more about the OS than I did before I started using LittleSnitch.

bigiain 14y ago

" … or Microsoft Windows (Bootcamp, VM, or otherwise)" I'm curious, do you think there's any attacks that can break out of those visualization environments and threaten the host MacOSX machine? I quite often use "throwaway" Windows VM clones for IE testing - usually (but not religiously) starting from scratch with a new fresh clone (but occasionally leaving one running for maybe a few days at a time). I'm never _too_ worried about hardening my Windows VMs, since I (at least intend to) throw them away after using them. I never bother disabling Flash/Java/Acrobat in them either, since I generally only visit sites I'm developing (and, as above, I throw them away anyway).

46Bit 14y ago
If that VM is isolated, you're fairly safe. Most people in practice run VMs on a Mac with various Sharing options enabled where files can be dropped to/from your Mac filesystem if the VM is breached. Given that a lot of people don't run AV or Firewalls on their VMs they're a very easy target.

diziet 14y ago

An outgoing firewall is a hassle to keep track of, though -- with all the plethora of system calls and background processes that constantly request data the management must take a lot of time away.

Samuel_Michon 14y ago
Yes, before you've settled on a set of permanent rules, it takes some tending to. In my experience, that's just the first couple of days. Also, it can be an educational experience, if you let it. If it's not clear what the process does that's requesting Internet access, I look it up; as a result I now know far more about the OS than I did before I started using LittleSnitch.