Apple Makes Subtle Changes in Security Claims

The spread of the Flashback trojan to over 600,000 Mac computers was a serious blow to Apple’s rather arrogant image of immunity to viruses and security holes; the computer giant is taking steps to make its users aware of security save face.

On the “Why You’ll Love Mac” section of their website, they have tweaked their phrasing to exclude the longstanding and outlandish claims that virii and security threats are nonexistent  on the Mac platform, instead noting that security features are built in and easy to manage. No longer does the gut-wrenching phrase “It doesn’t get viruses” have an empirical basis to naively supersede the theoretical fact that no computer system is free of threats, and so the tagline has been stripped away, replaced with a more modest “It’s built to be safe.”

While it is true that the Unix-like operating system inherently has much stronger protection from malicious software than some other operating systems, by design,  which is beefed up by some of the tools installed on the platform out of the box.  Perhaps the number of affected machines wouldn’t have been so high if Mac users didn’t operate under the notion that security is an irrelevant term in the Apple world. “Safeguard your data. By doing nothing” was exchanged with “Safety. Built right in,” followed by descriptions of the (honestly) highly effective mechanisms provided for security.

Okay, so Apple is shifting their marketing messages, but what steps are being taken to actually beef up security? Educating users and making them aware of issues and resolutions is the big battle in security. While Apple-made products such as Safari, iTunes, Mail, and iChat are within their grasp to protect and patch, downstream applications which users independently install and depend on are not.

Sandboxing and scanning downloads in Safari for executable code are a good measure, but not comprehensive. Perhaps staying on top of downstream security issues and putting out fixes to known threats (such as the one in the Java run-time environment that enabled Flashback and had been addressed by Oracle months before Apple put the update into their Java package) would help. Lastly, it may be time for Apple to start thinking about a more typical antivirus solution, with file scanning, monitoring for suspicious program activity, and regular updates of virus signatures and definitions.