Book Review: Foundations of Mac OS X Leopard Security

Foundations of Mac OS X Leopard Security
Charles S. Edge, Jr., William Barker, and Zack Smith
455 pages. Apress, 2008. $40

Buy from Amazon.com | Amazon UK | Amazon FR

Computer security is an issue that everyone needs to be aware of. Not limited to simply viruses and malware, security involves making sure that other users can’t access your files (in a shared environment), ensuring that your Internet-enabled applications don’t give away any secret information or open up security holes, and battening down the hatches on your local network. Long considered to be more secure than Windows, Mac OS X has seen a number of security threats in recent years. (Mac security vendor Intego runs a Mac Security Blog where they track threats and vulnerabilities both large and small.) While the Mac remains inherently more secure than Windows, Mac users tend to be complacent about security issues, ignoring some basic threats and good practices.This book examines Mac OS X security issues at all levels of the operating system. Starting by looking at basic security settings, those which can be controlled by System Preferences, it spends a fair amount of time discussing user accounts, and how to work with Parental Controls. (I cover these aspects of Mac OS X in more detail in my ebook Take Control of Users and Accounts in Leopard.)

Moving in to look at malware, securing web browsers and e-mail, and keeping a network secure, the authors again cover the basics. A large section entitled Sharing looks at file sharing, web site security, remote connectivity and server security. The final section, Workplace Security, is an amorphous collection of information about security auditing, backups and forensics.

While this book covers a lot of ground, I’m a bit confused by it. First, the title claims to cover Leopard, but a number of sections also discuss Mac OS X 10.4, Tiger. If one is security conscious, it makes sense to update to the latest version of the operating system, rather than work with one that’s three years old. While the book discusses several third-party security tools (which, in Mac OS X, are essential, as the operating system doesn’t provide everything), they neglect many such tools. They never mention Intego, one of the leading vendor of security software for Mac, whose VirusBarrier software was called the “gold standard” in a recent Macworld review. (They choose, rather, to laud Norton Antivirus, which is widely blamed for slowing down Macs and has been so for many years.) They don’t mention any third-party antispam software, which is a serious lacuna, since Apple’s Mail cannot be trained. And in the section on backups, they only mention Retrospect, which is far from being the most user friendly of the dozens of backup programs available for Mac, and SuperDuper, a program that has had its share of problems under Leopard.

For the book seems geared toward a specific audience: IT administrators who need to learn about Macs. While it doesn’t say so expressly, (the book’s web page says: “A wide audience of users, power users, and administrators who wish to make sure their Mac platform is secure.” this approach means the book is much broader than deep. Even the order of chapters leaves something to be desired. How can they stick backups in the next-to-last chapter (under “Workplace Security”), when having up-to-date backups is the cornerstone of any security strategy? They discuss running a web site from a Mac, which is something that few Mac users actually do, and spend a whole chapter discussing how to keep it secure.

This book does contain a lot of information, but it’s not presented in a very user-friendly manner. I don’t think most of my readers – unless they are system admins – will find it useful. While it covers the built-in security elements of Mac OS X, there’s too much material for those who want to learn the basics of security without getting bogged down in details. And there’s probably not enough for those who want the whole nine yards. To be fair, it’s very hard to attain balance in this sort of book. I’ve had the experience trying to write books on Mac OS X for audiences at different levels, and no one is ever really satisfied. Nevertheless, with the few books that exist about Mac OS X security, this is a welcome addition. If you’re an admin, and you’re not familiar with the Macs you need to manage, you’ll do well to get this book and read it from cover to cover. If you’re a home user, though, there’s probably too much for you.