We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

The six biggest Mac security flaws

Why IT should be worried about Mac security

Generally Macs have been considered more secure than PCs using the Windows OS. However, it's not the case anymore. We've rounded up the six biggest security threats to Macs and looked at how they can be overcome

Third-party patch management software for Mac OS X is available (such as LANrev, Bigfix, and PatchLink), but only a few suites are designed for anything but Mac OS X, which makes it hard to have a unified suite for Windows and Mac patch management.

The danger here is in allowing individual users to manage their patches, which could lead to systems especially laptops carried by mobile users being far out of patch compliance and, thus, vulnerable to long-fixed security holes.

Solution

  • Install an intranet proxy for Apple's software updates.
  • Review Mac-oriented patch management; these suites also include options for distributing other software updates and corporate documents, as well as auditing settings and installed software. Check with your patch management vendors about plans to add Mac support if yours do not. Send reminders to Mac-using employees whenever critical patches appear to install the updates as soon as possible.
  • Schedule patch sessions for laptops that are primarily out of the office, as they are most vulnerable to proximity attacks via Wi-Fi or Bluetooth, as well as attacks from untrusted networks on which they are located.

Security flaw No. 2: Serious third-party security flaws are slow to be fixed

Most of Apple's most serious security updates, ones in which remote code execution or arbitrary code execution are possible, typically involve third-party software, often open source or free software components. (Notable exceptions are Safari and QuickTime, Apple-developed products that have had dozens of serious flaws, none of which have so far turned into attacks prior to being patched.)

While the project running the software often patches such vulnerabilities in hours or days, Apple often lags in releasing such updates. For example, Apple included version 2.2.6 of the Apache web server in Mac OS X 10.5 (Leopard) in October 2007. Apache was updated to 2.2.8 to fix several security flaws in January 2008, but Apple didn't ship an update until March 2008.

But other times, Apple is speedy. For example, an Apple researcher discovered a set of flaws in the Ruby language and environment, which were documented and patched June 20, 2008. In this case, Apple took only 10 days to release its security patch.

NEXT PAGE: The solution to slow to be fixed third party security flaws

  1. Why IT should be worried about Mac security
  2. Serious third-party security flaws are slow to be fixed
  3. The solution to slow to be fixed third party security flaws
  4. Why naïve use of Back to My Mac is a problem
  5. The solution to complacency over malware
  6. Why naïve use of Back to My Mac is a problem


IDG UK Sites

Windows 9 release date, price, features: Videos leak as Microsoft sets 30 September unveiling

IDG UK Sites

Why local multiplayer gaming is rapidly vanishing: we look at the demise of split-screen and LAN...

IDG UK Sites

IBC 2014 news: video post, CG and VFX news from Adobe, Blackmagic, Eyeon and more

IDG UK Sites

Retina MacBook Air release date rumours and specs: Gold 12in Retina MacBook Air almost 1cm thinner...