Security Basics

When people talk about "computer security" they're really talking about three different topics: (1) keeping your computer safe, meaning preventing other people from gaining access to it (either over a network or in person); (2) keeping your data safe, meaning preventing others from accessing or using your data and personal information; and (3) keeping your computer virus-free. These three topics can actually be mutually exclusive. For example, you can allow someone to access your computer, but still keep them from accessing your private data. You can also do a great job of preventing others from accessing your computer and your data, but still be vulnerable to viruses. Because of this I'm going to divide this chapter into sections based on these three aspects of system security.

However, before I do that I want to talk about some more general pointers for keeping your computer safe and sound. Below are some guidelines that will increase the security of your system significantly. If you read nothing else in this chapter, read these.

Remember that accounts are your friend. User accounts are the backbone of OS X's system security. Having a single account that anyone can access—many people use such a setup because they find accounts to be confusing, intimidating, or just a hassle—means that everyone has access to everyone else's data. If nothing else, set up an admin-level account of your own, and create another non-admin account for your family or coworkers.

Limit administrator access to those who truly need it. Administrative access is a dangerous tool in the wrong hands, even if those hands aren't purposely malicious. Limit admin-level accounts to only those people who need it regularly. For example, my computer has two admin-level accounts: my own, and the emergency/troubleshooting account I recommended in Chapter 1. Every other account is a normal user. If someone needs to do something that requires an administrator, they can let me know. (In addition to limiting admin access, this also means that I'm aware of all admin access and actions.)

View the login window as "Name and password," hide the restart and shut down buttons, and disable password hints. If your Mac(s) are in a public location, these three options from Accounts preferences are vital. It's better to use the "Name and password" option rather than "List of users" for the login window because listing all users makes it much easier for someone to hack into a computer—they only have to guess one piece of information (a password) instead of two (both the name of a user and that user's password). The "Hide the Restart and Shut Down buttons" option prevents people from restarting your Mac and possibly using one of the startup options (single-user mode, boot off of CD, etc.) to gain access. Finally, although password hints are helpful for legitimate users, they also make it easier for malicious users to gain access to your Mac or other users' accounts.

Use good passwords. Your account password is the key to your computer. Just as some keys can be copied and some can't, some passwords are easy to figure out and some aren't. If you don't want someone to access your account, don't use a password that's easy to figure out (e.g., your birthday, your significant other's name, your pet's name, your anniversary, your child's name, your favorite sports team, etc.). The best passwords are random combinations of numerals and lower- and uppercase letters. Unfortunately, the best passwords are also the hardest to remember. One trick is to think of a book or song title; take the first letter of each word, add a few numerals, change the case of a few letters, and you have a password that's not too hard to remember, but is still difficult for someone else to figure out. For example, take the song "(I Can't Get No) Satisfaction," add in the year the Chicago Bears won the Super Bowl, alter the case, and you get iC19gN86s. It looks pretty random, but you can reconstruct it quite easily if you forget it. (This advice goes for online passwords, as well—don't use a weak password to access your bank account via your bank's website!). Another good suggestion is to use different levels of passwords for different types of accounts. For "throwaway" accounts—registrations on web sites that don't have any real security concerns—use something easy to remember. For things that are important, such as your email account or online banking sites, use more secure passwords, like those described here. (In addition, especially for sensitive accounts such as online banking sites, be sure to read the next item on changing your password frequently.)

Change your password periodically. Even the best password can be compromised. Someone might see you type your password, or you might connect to your computer or a website over a non-secured connection (meaning someone could "eavesdrop" on your network connection and get your password). To ensure security, you should change your password on a regular basis. In fact, many network administrators force users to change their password on a monthly basis.

Only enable services that you regularly use. In Chapter 10, I explained how to enable various Sharing services and Remote Login. Although these are great features, the more of them you have enabled, the less protected your computer is from a network or Internet hacker. You should only enable those services that you actually need and use. In fact, if you only use a service infrequently (for example, to allow someone to access files on your computer), it's safer to just enable that Sharing service when it is needed, and then disable it after you're through.

Tip 

I didn't cover the Remote Apple Events setting of Sharing preferences in this book. Apple Events are a way for applications to communicate with each other, and are used extensively between applications on your own computer. However, it's also possible for networked computers to use Apple Events to control applications on other computers. This can be quite helpful in some situations, but it also poses a significant risk if an application or person uses Apple Events maliciously. Suffice it to say if you need Remote Apple Events enabled, you'll generally know it; if not, keep it disabled.

Keep the root account disabled. As discussed in Chapter 1, there is little reason to have the root account enabled; you can generally do anything you need to do via the sudo command in Terminal or by launching specific applications as root using a utility like Pseudo or Snard. But apart from the "don't need" argument, there is a compelling "should not" argument: since the root account is so powerful, if someone should figure out a way to log in to your computer as root, your entire system, and any data anywhere on your hard drive, is compromised.

Warning 

If you really want to enable the root account, make sure you use a good password for that account!

If you connect remotely using an admin account, make sure you connect securely. When you connect to your computer remotely over a secure connection, all traffic between you and your computer is encrypted, meaning it's encoded so that the data is useless to anyone who intercepts it. If you use a non-secure connection, it's possible for your account name and password to be compromised, and for someone else to later log in to your computer using them. Although any such breach is a bad thing, it's much worse if the compromised account is admin-level. As I explained in Chapters 10 and 11, connection methods like SSH, SFTP, SMB, and File Sharing are encrypted; FTP and Personal Web Sharing are not.

Secure your physical location. This one may sound obvious, but you'd be surprised how many people do everything they can to secure their computer from remote access, yet they walk away from it—logged into their account—in an environment where anyone can sit down and have full access. Although this isn't as much of an issue in a single-user home environment, it can be a major issue in an office setting, or even in a home where parents and kids are using the same computer. (I'll talk more about local security later in the chapter.)

Encrypt your wireless connections If you have an AirPort Base Station or other wireless router, be sure to use WEP encryption (an option in the setup dialog or screen). This will encrypt the signal between the router/Base Station and your computer so that anyone who might intercept it can't easily see the data being transmitted.

Don't open files, launch applications, or even mount disk images unless you know where they came from (and are expecting them). Unfortunately, most computer viruses are spread via files or applications, opened by the user because they look innocuous. Fortunately, viruses are rare on the Mac platform, and most Windows viruses can't do anything to your Mac. Still, it's better to be safe than sorry. In addition, Mac disk images can be configured to run an application or script when mounted, so a malicious user could distribute harmful code this way. So be careful when mounting disk images if you aren't sure where they came from.