The NSA's Guide to Securing Your Mac

Image via Complex Original

Open up Safari and then select "Preferences..." from the  "Safari" menu. In the General tab, make sure that "Open safe files after downloading" is no longer selected or turned on. Effectively, this keeps programs or files from starting up as soon as they're downloaded onto your computer. It's a key measure if you want to avoid tripping into a virus because you accidentally clicked on a malicious icon or link. 

By setting up a firmware password, you'll prevent other people from making changes to your system. If you have a PowerPC-based system, hold down ⌘-Option-O-F when your computer is turning on. When the computer prompts you to do so, type in "password" to set up a password. Note: a capital "U" cannot be used in this password, but that's the only restriction. After that, set up a security level by entering the command: setenv security-mode securitymode. Replace "securitymode" with the phrase "command" and this will cause your system to prompt you for a password every time you boot up the system. 

For Intel-powered systems, use the Firmware Password Utility on the Leopard Install DVD. The function is found inside a hidden folder called "/Applications/Utilities" and is accessible via the Go drop-down menu's "Go to Folder" option. From there, you'll be able to enter a password. 

Should you desire to have your iSight camera removed, then taking it to an Apple technician is the only way to properly have it taken out. Placing duct tape over the camera is also an option, albeit clunkier. In the same vein, if you don't want your internal microphone turned on, then you should click on Sound in the System Preferences window, and then select Input. After doing so, put your microphone volume levels all the way down to zero. With these off, no one has eyes or ears on your system. 

If you decide to have Bluetooth removed from you system, you're best bet is to take it to an Apple technician. However, if you'd like to just disable it via software settings, go to /System/Library/Extensions and then remove the files named "IOBluetoothFamily.kext" and "IOBluetoothHIDDriver.kext."

Similarly, if you'd like to have AirPort functionality removed from your Mac, you should have the AirPort card taken out of the computer. However, if you stay in /System/Library/Extensions and remove the "IO80211Family.kext" file, you'll also disable AirPort settings from your software.

Your Mac comes with two firewalls designed to give you optimal protection. Use them both. The ipfw firewall is complicated, but can be enabled by following the instructions listed on FreeBSD. Thankfully, your Applications firewall is much more straightforward. Go to the General tab inside System Preferences and select Firewall. Then, click on "Allow only essential services" before clicking on the Advanced button. In this section, enable the "Firewall Logging" and "Stealth Mode" features. With the Applications firewall now up, limitations and protections have been placed on what programs can receive incoming connections. 

Make sure that automatic logins and guest accounts are disabled. Keeping them on or available leaves your computer in a constant state of vulnerability. In order to turn off automatic logins, go to System Preferences, and then the Accounts icon. While there, select Login Options, and disable "Automatic login." Then set your login window to "Name and password" to ensure that your accounts are protected. Go back to the Accounts page. Select Guest Accounts, and then uncheck the box that says, "Allow Guest to log into this computer." Now the only people who can get into your computer are yourself and the people who have password-protected accounts on the computer.  

If you're connected to the Internet, go into System Preferences, and then select the Software Update icon. From there, check to make sure that the "Check For Updates" function is enabled, and is set to "Daily." You want your system to be updated as frequently as possible so that you have the most secure version of your software. If you aren't connected to the Internet, you can grab the updates from www.apple.com/support/downloads. Just make sure that you're doing so on a regular basis.

Instead of running everything through a single account, set up an alternate, password-protected account to serve as your hub for daily activities. Make sure that you aren't logging into your admin profile to perform random or casual tasks. Go into System Preferences, and then click on Accounts to set up a new profile. Only use your Admin profile to perform system administration tasks.

Setuid and setgid programs are files or programs which typically operate under the owner's command—and that usually isn't you. In order to find these files, enter the following commands into your Mac: "find / -perm -04000 -ls" and "find / -perm -02000 -ls." Do not include the quotation marks.

When you're able to view these files, disable their setgid or setuid parts with the "chmod ug-s programname" command, replacing "programname" with the program or file you would like to alter. For a full list of the programs you should alter, click here and look under the section labelled "Disable Setuid and Setgid Binaries."