We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,713 News Articles

The six biggest Mac security flaws

Why IT should be worried about Mac security

Generally Macs have been considered more secure than PCs using the Windows OS. However, it's not the case anymore. We've rounded up the six biggest security threats to Macs and looked at how they can be overcome

Third-party patch management software for Mac OS X is available (such as LANrev, Bigfix, and PatchLink), but only a few suites are designed for anything but Mac OS X, which makes it hard to have a unified suite for Windows and Mac patch management.

The danger here is in allowing individual users to manage their patches, which could lead to systems especially laptops carried by mobile users being far out of patch compliance and, thus, vulnerable to long-fixed security holes.

Solution

  • Install an intranet proxy for Apple's software updates.
  • Review Mac-oriented patch management; these suites also include options for distributing other software updates and corporate documents, as well as auditing settings and installed software. Check with your patch management vendors about plans to add Mac support if yours do not. Send reminders to Mac-using employees whenever critical patches appear to install the updates as soon as possible.
  • Schedule patch sessions for laptops that are primarily out of the office, as they are most vulnerable to proximity attacks via Wi-Fi or Bluetooth, as well as attacks from untrusted networks on which they are located.

Security flaw No. 2: Serious third-party security flaws are slow to be fixed

Most of Apple's most serious security updates, ones in which remote code execution or arbitrary code execution are possible, typically involve third-party software, often open source or free software components. (Notable exceptions are Safari and QuickTime, Apple-developed products that have had dozens of serious flaws, none of which have so far turned into attacks prior to being patched.)

While the project running the software often patches such vulnerabilities in hours or days, Apple often lags in releasing such updates. For example, Apple included version 2.2.6 of the Apache web server in Mac OS X 10.5 (Leopard) in October 2007. Apache was updated to 2.2.8 to fix several security flaws in January 2008, but Apple didn't ship an update until March 2008.

But other times, Apple is speedy. For example, an Apple researcher discovered a set of flaws in the Ruby language and environment, which were documented and patched June 20, 2008. In this case, Apple took only 10 days to release its security patch.

NEXT PAGE: The solution to slow to be fixed third party security flaws

  1. Why IT should be worried about Mac security
  2. Serious third-party security flaws are slow to be fixed
  3. The solution to slow to be fixed third party security flaws
  4. Why naïve use of Back to My Mac is a problem
  5. The solution to complacency over malware
  6. Why naïve use of Back to My Mac is a problem


IDG UK Sites

LG G Watch review: Android Wear smartwatch is the best around, so far

IDG UK Sites

How to join Apple's OS X Beta Seed Program: Get OS X Yosemite on your Mac before public release

IDG UK Sites

Why the BBC iPlayer outage was caused by a DDoS attack: Topsy and Tim isn't *that* popular

IDG UK Sites

See Glasgow 2014 in UHD as history is made