Security and Spam Mac/PC Compatibility: QuickStart Guide for Business 2 Security and Spam QuickStart Guide for Business The Basics The need to protect against hackers and other threats is a fact of life. Mac OS X features a number of built-in technologies to help you fend off attacks and keep unwanted email out of your employees’ inboxes. User benefit: When users are protected from spam and other computer security threats, they can do their jobs without wasting time deleting spam messages or calling IT to fix a computer that has a virus. Business benefit: Proper computer security—including spam protection—can potentially save huge amounts of money by minimizing lost work time and emergency IT costs. It also keeps outsiders from stealing confidential business information. Standards and Buzzwords Here are some common terms associated with security and spam. AES 128-bit and 256 encryption. Advanced Encryption Standard—cryptography technology recommended by the U.S. government to secure sensitive documents. AES-256, the stronger of the two, is used in Mac OS X features such as FileVault (for protecting home directories) and Disk Utility (for creating encrypted disk images). Firewall. Hardware and/or software that monitors attempts to communicate with your computer over a network, and blocks dangerous traffic. Mac OS X comes with a built-in firewall that can be configured through the Security pane of System Preferences. Keychain. Software in Mac OS X that holds “keys” (passwords and other personal information) you need to access protected network services, decode encrypted disk images, and so on. When you log in to Mac OS X, the system opens your Keychain, so you don’t have to remember user names and passwords. Only users who know the login name and password for a specific Mac user account can access that account’s Keychain. 3 Phishing. Method of obtaining confidential information with fraudulent email messages. The messages appear to come from legitimate senders (such as financial institutions), but they are from cybercriminals. Commonly, the messages have links that lead to a website designed to look like a legitimate company. When you enter a credit card number or other personal information, that information is captured by the person or group that sent the fraudulent message. Port. Numerical identifier that allows a computer’s networking software to route incoming or outgoing traffic to the correct service. For example, your computer connects to one port at your ISP’s mail server address when you send email, and a different port is used at your computer’s address when you receive email. Spam. Unsolicited email. Spam can clutter inboxes, contain inappropriate text or graphics, and propagate viruses and other malicious computer programs. Fighting spam should be a multipronged effort, including choosing an Internet service provider with robust anti-spam technologies and taking advantage of spam-filtering tools in applications such as Mail. SSL/TLS. Secure Sockets Layer and Transport Layer Security. These protocols provide a secure, encrypted channel between two computers communicating over the Internet. For example, an HTTPS connection uses SSL or TLS to encrypt traffic between your computer and an online banking website. Mac OS X fully supports SSL and TLS. Spyware. Computer program that tracks a user’s activities (such as websites visited or keystrokes typed) and sends that information to another site. Spyware can be used to obtain passwords and other confidential information. Mac OS X helps block spyware by requiring user interaction before installing a program. Trojan horse. Computer program that pretends to be innocuous (such as a game) but in reality has another purpose. For example, a Trojan horse program may trick users into installing software that enables hackers to control their computers. The UNIX foundation of Mac OS X works with Apple-developed security features to provide robust protection against Trojan horses and other malicious code. VPN. Virtual private network. A VPN lets you establish a secure connection to a remote computer, for example, to access a corporate file server from home over a dial-up or broadband (cable/DSL) connection. The Network pane in System Preferences included with Mac OS X enables you to connect to both L2TP and PPTP VPNs. WEP/WPA. Wired Equivalent Privacy and Wi-Fi Protected Access. WEP and WPA are two methods of protecting wireless communications from eavesdropping. Apple’s AirPort wireless networking technology supports both protocols. You can find more explanations of networking and security terms in the Mac OS X Server Glossary (available at www.apple.com/server/documentation) and the Mac OS X Security Tech Brief (linked from www.apple.com/macosx/features/security). How the Mac Does It Every Mac is very secure right out of the box, but can be made even more secure. Leopard is an Open Brand UNIX 03 Registered Product, and has been designed to protect your personal data and online activities. In addition, many security features built into Mac OS X are on by default. They are unobtrusive and easy to use, so you don’t have to be an expert to protect your Mac. Apple responds quickly to computer threats, providing timely software updates that are easy to install and manage. Of course, it’s always a good idea to use all available resources to protect your Mac and important information you keep on it. Both commercial and open source antivirus programs are available for Mac OS X. You also may install another level of mail-filtering software to supplement filtering provided by the Mail application. Make sure your ISP offers robust protection against viruses and spam. 4 Out-Of-The-Box Security By default, all native services— personal file sharing, remote login, etc.—are turned off. You control which ports and services to activate. If you need to open any ports, the built-in personal firewall can protect your computer from unauthorized access by monitoring all incoming network traffic. When you enable the personal firewall in Mac OS X, all inbound connections are denied except those you explicitly permit. There’s even a stealth mode, meaning your Mac won’t even acknowledge its existence to people scanning for computers to attack. Mac OS X is designed to protect you from deceptive software applications. People attempting to break into computers sometimes disguise a malicious program as a picture, movie, or other seemingly non-executable file. You might download such files from the web or get them by mail or chat. When a Mac detects that you are downloading a file that may contain a computer program you are not aware of (such as one inside a JPEG file), it will alert you and ask for your permission to proceed. One of the greatest security strengths of Mac OS X is that it is an Open Brand UNIX 03 Registered Product, conforming to SUSv3 and POSIX 1003.1 specifications. At its core is Darwin, the open source, fully conformant UNIX operating system—built on Mach 3.0 and FreeBSD 5. Because Darwin is an open source project, computer programmers and security experts all over the world continually look for ways to make it stronger and safer. Apple is an active participant in the Darwin project, and incorporates the best suggestions from the Darwin community into Mac OS X updates and new releases. Apple also works with a number of security organizations, including CERT/CC, FIRST, the FreeBSD security team, and the Department of Homeland Security in the United States. Security Updates And Tools One of the most important measures to keep any computer safe is to install operating system updates as soon as available. By default, Mac OS X checks for updates weekly. For peace of mind, you can set it to download security updates automatically. Apple digitally signs updates, so you can be sure they come from a trusted source. Security tools also are built into other Mac applications. Safari features an option called Private Browsing that allows you to surf the web without caching information about where you visit or personal information you enter; it’s as if you were never there. And Mail offers powerful protection against spammers, with outstanding accuracy in identifying spam, and versatile filters that you can customize according to your needs. You can even shield all the information in your home folder from prying eyes. FileVault, a built-in feature of Mac OS X, uses the latest government encryption standard, AES-128, to safeguard your work. FileVault encrypts and decrypts files on the fly, so it doesn’t interfere with your work. Protecting your home folder is especially important when you use a portable Mac system away from home or office. Speaking of your home folder, if you share a Mac with other users, the UNIX-based multiuser features of Mac OS X offer robust protection against other people seeing your data. Each user can have a unique user name, password, Keychain, and home directory. For added control, an administrator can designate actions each user can perform. Leopard is also protected in other ways. Sometimes hackers try to hijack an application to run malicious code. Sandboxing, built into Mac OS X Leopard, helps ensure that applications do only what they’re intended to by restricting files they can access, whether they can talk to the network, and whether they can be used to launch other applications. Helper applications in Leopard — including software that enables Bonjour and the Spotlight indexer — are sandboxed to guard against attackers. 5 Private Browsing Private Browsing is a helpful feature when you need to use a shared computer, such as one in a library, Internet café, or office. When you turn on Private Browsing from the Safari menu: • Web pages are not added to your History file.