Built on an open source UNIX-based foundation, Mac OS X is a highly secure computing platform — right out of the box. It integrates the latest in security standards: such as PPTP and L2TP/IPSec for Virtual Private Networking; SSL/TLS encryption for secure transport of SMTP, POP and IMAP mail; and Wired Equivalent Privacy (WEP) data encryption for wireless security. For strong authentication, Mac OS X uses MIT’s Kerberos KDC and supports digital certificates, smart cards and biometrics-based authentication technologies, such as thumbprint readers.
In addition to these robust, standards-based technologies, Apple offers convenient end-user features. Keychain makes it easy for users to generate secure passwords — and to encrypt and store them securely. FileVault and encrypted disk images help users safeguard the confidentiality of their information, and a personal firewall protects their systems from unauthorized network traffic.
Also available are innovative third-party technologies that leverage capabilities built into Mac OS X and Mac OS X Server. These state-of-the-art security tools — in combination with proactive, vigilant practices — support all aspects of system, data and networking security required by today’s organizations.
Four steps to implementing an intrusion protection strategy
User Authentication
Passwords are the main gate into your network. They can provide an easy way for intruders to get in, or — with a little bit of care — they can be the easiest way to keep people out. Best practices for user authentication include:
Workgroup Manager in Mac OS X Server makes it easy to establish conservative password policies and administer them across the Mac systems in your organization. For example, you can assign user authentication methods, prevent passwords that contain the user’s name or require passwords that combine numbers and letters.- Kerberos authentication is integrated into Apple’s Open Directory architecture. This robust directory-based authentication mechanism enables single sign-on to all authorized network resources, while never transmitting user passwords over the network.
