Is Mac Security Software Necessary?

Verizon on Monday introduced a security suite for Internet service customers who use Apple's Mac OS X. The company claims that it is the first major US ISP to offer its customers Mac security software.

It's a move that appears to recognize Apple's growing share of the PC market, but is it meaningful as more than a point of differentiation between Verizon and other Internet service providers? Is security software necessary for the Mac?

Apple has been touting the improved security features in its recent Snow Leopard operating system update, which suggests there's something to be worried about. But at the same time, the company's TV commercials suggest that Mac users have little to fear from malware.

And that view is easy to find online. As Mac user Bruce Etnyre observes in a post on Apple's discussion forum, "Most of the experienced users here do not recommend using antivirus software on Macs because there are no known viruses that affect it."

That's not quite accurate: There is malware that can affect the Mac. But it's not widely circulated.

To be clear, there are plenty of holes in both Apple's and Microsoft's software, as anyone who counts security patches will tell you.

The reason that security is more of a problem for Windows users than for Mac users is that the majority of malware authors are trying to find ways to exploit the holes in Windows, which can be found on about 90% of the computers out there.

Nonetheless, a quick scan of Apple's online forum confirms that some Mac users do encounter malware, like DNS changing Trojans. At the same time, security issues can be complicated and don't necessarily always involve operating system exploits.

For example, U.K.-based Colin McCleery posted in August on the Apple forum about being the victim of online fraud that he believed could only have been possible if someone had penetrated his router firewall, his OS X firewall, and installed keylogging software.

Reached in September via e-mail, McCleery said that his bank had reimbursed him and that his bank was of the opinion that the fraud was not conducted through a hole in Mac OS X. He declined to elaborate, citing the bank's ongoing investigation but suggested poor security at an online financial site he used could have been the source of his security problem.

"Since the incident I have installed Norton Internet Security and 'tweaked' my OS X and router firewalls to limit external access to my network as far as is reasonable," he said. "Norton failed to find any malware on any of my machines, so I am now fairly confident that the fraud was not down to lax security on my part. But the incident was a timely reminder that constant vigilance is necessary. Be careful, but not paranoid."

Security vendors have been trying to convince Mac users to be afraid for years. For example, in a blog post last week, Graham Cluley, senior technology consultant for Sophos noted that a Russian Web site was offering $0.43 to its affiliates for each Mac they could infect with malware.

"The growing evidence of financially-motivated criminals looking at Apple Macs as well as Windows as a market for their activities, is not good news," he said. "Especially as so many Mac users currently have no anti-malware protection in place at all."

While consumers may still be able to go without Mac security software, businesses can't afford to be so cavalier. Regardless of whether the risks are significant, businesses often have to implement security for Macs as a matter of legal compliance.

Bill Heese, IT manager for consumer beauty and personal products company Conair Corporation, manages about 250 Macs at various locations around the world. In a phone interview, he explained that he had been with the company for about 12 years and that company had no antivirus software for its Macs when he started.

Conair subsequently used Virex, but Heese said the software lacked automated management and updating features. So several years ago, the company switched to using Sophos's security software for Macs and Windows machines.

Heese doesn't see a lot of Mac malware. "The Windows machines get whacked far more frequently," he said, citing machines located in Asia in particular. However, he expects Mac security problems to increase.

"With regard to virus production in the Mac, for years and years and years, Apple has only had 4% or 6% percent of the PC market," he said. "Because the Mac has such a small market share, the Mac has been able to avoid most of the malware."

But Hesse sees the growing popularity of the iPhone, which runs a version of Mac OS X, as a sign that the security-through-obscurity enjoyed by Mac users is coming to an end. "It's my feeling that if you're hiding behind that small percentage, it's going to go away," he said.

In the end, focusing on operating system security may obscure the larger security picture. Plenty of vulnerabilities affect online applications across multiple platforms, like recent Adobe Flash and Reader flaws, and both Mac and Windows users may fall victim to social engineering attacks. Security on the Mac can be managed by diligent individuals without special software, but anyone responsible for Macs in the workplace might see value in taking additional steps.

InformationWeek Analytics has published an analysis of the current state of identity management. Download the report here (registration required).