Make use of encryption options

Mac OS X offers a number of options for encrypting your data to prevent access to it if your Mac is lost or stolen. I've already touched on a couple of these, but the biggest example is FileVault, which can also be activated and managed from the Security pane in System Preferences.

FileVault converts your entire home folder into an encrypted disk image. The image is mounted and accessible only when you are logged in. At all other times, it is unreadable. FileVault uses industry-standard encryption, and if you use Time Machine, any backups of your home folder's contents are equally encrypted.

Note: FileVault must be enabled by each user who wants to have an encrypted home directory. Each home directory will be encrypted as a separate disk image file.

FileVault supports the use of a master password as a safety net that can be used to reset user passwords and access encrypted home folders if users forget their passwords. If both a user password and a master password are lost or forgotten, however, there is no way to retrieve data from the encrypted home folder.

To enable FileVault, launch System Preferences, select the Security pane, and then select the FileVault tab. You can set or change a master password using the Change button next to the master password description. (You must be an administrative user of the computer to do this, and you must know the current master password if one is already set.)

Next, click the Turn On FileVault button. Enabling FileVault for the first time can take a significant amount of time because the entire contents of your home folder are copied into a newly created encrypted disk image. If you have tens or hundreds of gigabytes of data, this could take hours or even days (much like an initial Time Machine backup).

For this reason, it's easiest to set up FileVault when you first create a user account (and thus there is little data in the home folder). During this initial copy, you will also need to ensure that you have at least as much free space on your hard drive as the size of your home folder, since all the data will be copied. Once enabled, FileVault encrypts and decrypts items on the fly when you log in or log out, and it generally won't slow down performance significantly.

Disk Utility also lets you create encrypted disk images. Disk images look and act like virtual hard drives and can be created as blank images or copies of existing disks or folders. Mounting an encrypted disk image and accessing the contents requires a password. This makes encrypted disk images helpful if you want to secure only a portion of your files, if you need to securely store files outside your home folder, or if you need to securely share files by e-mail or other mechanisms.

To create an encrypted disk image, launch Disk Utility, and click the New Image button in the tool bar. You can select the size, name (which will be displayed as a disk/volume name when image is mounted), file name and location of the image file itself, and various other disk format options (which can typically be left as their default selections). To enable encryption, choose 128-bit or 256-bit AES encryption from the Encryption pop-up menu.

After you've made your selections, click the Create button. When Disk Utility creates the image, it will prompt you to enter and verify a password that will be required to open the disk image file. The password assistant is available in this prompt (in the form of a button with a key icon, just as when changing a user account password).

Disable unused network interfaces

If you look in the Network pane of System Preferences, you'll notice that most Macs include multiple network interfaces, such as Ethernet, AirPort/802.11, FireWire and Bluetooth. In theory, any active network interface could be used to access your Mac in a remote attack -- particularly wireless technologies, which don't require a physical connection to a network.

For this reason, it's a good idea to disable any interfaces you're not using to connect to a network or the Internet. To do so, launch System Preferences, and select the Network pane. Select each interface you want to disable, and for each one, select the button that looks like a gear at the bottom of the interface list, and choose Make Inactive from the pop-up menu.

This disables the interface, but doesn't delete it -- so you can easily change it back to Make Active to restore access to the interface.

Set a firmware password

The biggest security risks occur if your Mac is stolen or physically compromised. Even if thieves can't log into your account, they can gain access to the data on your Mac using one of the many special start-up modes built into all Macs, such as booting from an install DVD and resetting your password, using Target Disk Mode to make your Mac act as an external hard drive, or booting into the Unix-style Single User Mode.

You can, however, place a firmware password on your Mac. This password is written into the firmware chips on the Mac's motherboard using either the Open Firmware standard on PowerPC Macs or Extensible Firmware Interface (EFI) on Intel Macs. Regardless of platform, the free tool from Apple for implementing a firmware password is called the Open Firmware Password Utility. Apple provides complete steps for setting a firmware password on its support site.

If you or anyone else tries to use a special start-up mode, the user will be required to enter the firmware password. This can significantly secure personal, business or educational Macs against tampering. However, be warned that if you forget a firmware password, there is no way to reset or remove it

Don't display usernames or password hints at log-in

By default, Mac OS X's log

-in window displays a list of all users on a Mac (or all users who can access a Mac in a network). This makes it easier for anyone who has physical access to a Mac to gain access to it, since they need only guess a password. Disabling the display of users adds another layer of security because it requires that a malicious user know the username associated with an account.

Another simple act to help secure an account is to disable password hints (which Mac OS X will normally display to help you remember your password after three failed log-in attempts). This significantly undermines the security of using a password and should always be disabled.

Both of these options can be configured in the same Accounts pane where you disabled automatic log-in. To disable password hints, simply uncheck the box next to "Show password hints." To choose not to display usernames in the log-in window, select the "Name and password" radio button next to "Display log-in window as," which means users will have to type both a username and its password to log in.

Disable automatic log-in

As part of the Setup Assistant that runs when you install Mac OS X or start up a new Mac, Mac OS X enables automatic log-in for the first user account that you create -- which means you can log in without providing a username and password whenever you start up.

While automatic log-in is convenient, particularly if you're the only user of your Mac, it also means that anyone who has physical access to your Mac can simply restart it to gain full access to your account and your files. This is a particularly significant risk for Mac laptop users.

You can disable automatic log-in in the Accounts pane of System Preferences by clicking the Login Options button at the bottom of the user accounts list on the left. The automatic log-in option appears at the top of the area on the right; select Disabled from its pop-up menu.

Use secure passwords

User passwords are one of the foundations of security. If you use a password that is simple or easy to guess, you're just asking for someone to break into your computer or user account.

Mac OS X includes a password assistant that automatically generates random passwords according a specified level of complexity; it also checks the complexity of passwords that you create. Make use of this feature whenever you need to generate a password -- for Web sites or other services as well as for your Mac OS X user account.

To get to the password assistant, go to the Accounts pane in System Preferences, select a user account, click the Change Password option, and then click the button with a key icon next to the New Password field.

The password assistant can create secure passwords. Click to view larger image.

Even the most complex password can be cracked, however, so remember to change your password frequently. If you don't trust yourself to remember, try setting a monthly reminder in iCal.

Don't allow remote guest access or enable Leopard's guest account

Macs have always supported guest access for file sharing, in which a remote user can connect to a Mac without providing a username, password or other identifying information. The idea of allowing remote access to your Mac has always been fraught with potential for security compromises. It should never be allowed because it presents a grave security threat that could prevent you from easily tracking the source of a breach.

In Leopard, Apple extended guest access to the local level: Users can log in and use a Mac with a guest account that requires no username or password. The idea of a guest account is a convenient one. If you have friends or family visiting, you can let them use your Mac without allowing them access to your user account or files. When they log out as a guest, their home folder and any files they created are automatically deleted.

There are, however, some system directories, such as the Unix /tmp directory, that the guest account can write data to that may or may not be deleted at logout (or forced restart). The guest also has access to any installed applications, which could be used to perform malicious actions from your computer. If you must use the guest account, limit its access using Parental Controls.

Disable the guest account.

You can turn off both the guest account and remote guest access in the Accounts pane of System Preferences in Leopard. Select Guest Account on the left, then uncheck both "Allow guests to log into this computer" and "Allow guests to connect to shared folders."

If you'd rather keep the guest account but limit its access to files and apps, keep "Allow guests to log into this computer" checked and click the Open Parental Controls button for options.