Macs Are Safer Than PCs

Let’s start this chapter by stirring up some controversy: Macs are safer than PCs. That’s right, I said it. However, I had to seriously resist the urge to put “air quotes” around the word safer. So, let me be a little more specific. Macs are “safer” than PCs…because most people who write malware are looking for the largest market, and that would be Windows. Despite the recent resurgence in popularity of Macintosh computers, they still make up only a small percentage of the computers on the Internet. According to NetMarketshare, Macs account for just under 9 percent of all desktop operating systems as of March 2018, while Windows holds about 89 percent. If you were going to try to design some sort of computer virus, which operating system would you focus on?¹

This is a form of what we call security through obscurity , which I mentioned in Chapter 2. Macs are more “secure” because they are more “obscure.” Security through obscurity means that you try to lie low and not draw attention. If they don’t see you, they won’t attack you. As a security practice, it’s horrible. It’s sorta like hiding the key to your house under your door mat. Sure, your house is technically locked, but if someone goes to the trouble of looking around for a key, then it may as well not be locked.

Modern operating systems have included lots of great security features over the last decade or so, and I think you’d be hard-pressed to argue that the latest Mac OS is significantly more secure than the latest Windows OS. However, there are a lot more PCs out there running very old versions of Windows than there are Macs running really old versions of Mac OS. Again, according to NetMarketshare, almost half of Windows PCs are still running Windows 7, which was released in 2009 and was cut off from support in 2015 (other than a few critical security patches). Despite a period where Microsoft offered free updates to Windows 10, that version of the OS is on less than 40 percent of all PCs after two years on the market.

In 2013, Apple shifted to a policy of free upgrades for its operating system, which is a huge plus for Mac users and their security (and removes any excuse for not upgrading). As of March 2018, more than half of Mac users are using the latest Mac OS despite being released only six months ago.

So, on some level, you’re marginally safer with a Mac than with a PC. But I’m not going to leave that to chance. Let’s talk about the things you can do to really make yourself safer, regardless of what operating system you’re running.

Nonadmin Accounts

One of the basic principles of security is the practice of least privilege . This is sorta like the “need to know” that we’re familiar with in our spy novels and movies (and of course, it’s a real thing in security agencies). Benjamin Franklin once said, “Three can keep a secret, if two of them are dead.” The idea here is that the fewer people who have access to the truly important stuff, the more likely it is that the important stuff will remain safe.

Let’s look at the castle analogy again. You might give everyone on your guard the keys to the front gate, but you would give the keys to the castle only to your special castle guard. Why? Because the guard at the front gate doesn’t need access to the castle. Likewise, the king might keep the keys to the gold vault on his person, not even trusting the castle guard with that level of access, because at the end of the day, the only person who really needs to access the coffers is the king. If every member of your castle guard had a copy of the castle and vault keys, then what happens when one of the guards is knocked over the head and his keys are stolen? All of a sudden, your most precious items are at risk. Guards don’t have any need to access the gold in the vault to do their job. They just need to protect it. So, guards don’t get that key.

Who has a key to your house? Probably everyone in your family. Maybe you will give a key to a house sitter or pet sitter while you’re away because for that limited period of time, they actually need to be able to get into your house. When you get back, you take back your keys. Who has keys to your safe deposit box, though? Probably just you. You would probably never lend that key to anyone else, at any time, because the only person who needs to get in there is you.

The principle of least privilege says that people should be allowed to access only those things they need to access to do the things they’re supposed to do, and no more. If necessary, you can grant temporary access and revoke it later.

You may already know that your computer allows you to set up multiple user accounts. You’ve probably never used it, but you probably know that it’s possible. What you may not know is that each of these user accounts can have different levels of privilege. That is, you can restrict the level of access—the power to make important changes—for each account. At first you might think that this feature is mainly for parental control, preventing kids from doing stuff they shouldn’t be doing. Actually, it’s for all users—even you! But wait... surely if you can trust anyone, you can trust yourself! Turns out you can’t. It’s not about trusting yourself, it’s about preventing malware that gains access to your account from acting on your behalf. If you accidentally click a bad link, download a virus, or hit a web site with a malicious Java app, then whatever you are allowed to do, the malware can also do.

Let me drive this home with some chilling statistics. According to a 2017 report by a company called Avecto, 80 percent of all Windows security vulnerabilities that were considered “critical” could have been prevented or significantly mitigated if the user had not had full administrator (admin) privileges. Furthermore, removing admin rights could have mitigated 95 percent of the critical vulnerabilities in Edge (the new Microsoft browser).

Great. Now I can’t even trust myself! Now what?

The solution to this problem is to always create at least two accounts on your computer: an admin account, which you use only when necessary, and a regular, nonadmin account for everyday use. When you first pull your shiny new computer out of the box, you’re going to need that admin account to install your software and tweak all your security settings. But after that, you need to create and use a more restrictive account for day-to-day stuff.

I would go further, however. I believe strongly that each person in the household should have their own account. It’s easy to set up, and there’s really no excuse for not doing this. It’s not about keeping secrets—everyone deserves their own space, their own settings and preferences, and some basic privacy. It lets everyone express their individuality and also compartmentalizes any risks. This will also allow you to use parental controls to restrict access for young children, without affecting your ability to…uh…do parent things. And if something goes horribly wrong with one of the user accounts, you can just delete it and create a new one without affecting anyone else or having to completely wipe and reinstall everything on your computer.

There are other interesting reasons to have multiple accounts. If you’re a hard-core gamer or have some other intense application that requires some system tweaks to be efficient, you can create a second account for this purpose. This other account will be stripped down and dedicated to the special task at hand.

If you regularly give presentations for work using your computer, you can log into a special account for when you’re presenting. You can have a special desktop picture, avoid sharing your cluttered desktop, and also avoid annoying pop-up notifications from all your personal accounts.

You can also set up a special guest account so that when someone just wants to check their mail or look something up on your computer, you don’t have to worry about giving them access to your personal stuff (including your password vault).

Microsoft has announced a new feature called “Controlled folder access” (available in Windows 10) whose purpose is to restrict access to your personal files to only a few authorized applications. You select the files as well as the approved applications . While this may seem odd, it’s really just another form of least privilege. If configured properly (and I’ll walk you through this later in the checklist for this chapter), this tool would prevent ransomware from encrypting your irreplaceable files and demanding money to unlock them.

I expect that we’ll see more and more features like this as time goes on from both Apple and Microsoft. As things get worse out there, the balance between security and convenience will necessarily move in the direction of security.

iCloud and Microsoft Accounts

Get ready for a big dose of “good news, bad news.” In the old days (like 2004), your computer was more likely to access the Internet via dial-up modem than always-on broadband. Around this same time, smartphones came on the scene, and suddenly people had not one but two devices that were always connected to the Internet. It was only a matter of time before people wanted their address book, web bookmarks, calendars, and to-do lists to be the kept in sync across their various devices.

Apple and Microsoft heard the call and launched services to meet this growing need. The current versions of these services are iCloud and OneDrive,² respectively. While these services offer limited Internet-based file storage and sharing, in this chapter I’m focusing on the data synchronization aspects. You can’t argue with the convenience factor here. When you update your vagabond sister’s home address for the umpteenth time or add little Johnnie’s complete Little League spring schedule to your PCs calendar, it’s really nice to have those changes automagically appear on your smartphone and your work computer. Oh, and you can probably also access all of this info from the Web by logging into your cloud account, even from a computer or device you don’t own. Finally, you can use these same services to share this information with the rest of your family. What’s not to like?

Well, that was the good news—arguably great news. It’s a killer feature. Here’s the bad news: you’re not just sharing that all that juicy information with all your devices and your family members, you’re also sharing it with Apple or Microsoft. Here’s the worse news: you’re probably sharing that information with many other companies, too. Apple and Microsoft will argue that this is a feature, not a bug—they’re giving you the opportunity to access this information from within other applications, saving you the trouble of having to manually transfer things like contacts and calendar events to some third party. But you need to stop and think about what all that data is revealing about you. Your address book probably contains more than friends and family. It may also contain embarrassing contact information—maybe your AA sponsor, herpes doctor, or mistress. And if you’re like most other people I know, you put lots of other info in your address book like Social Security numbers, PINs and passcodes, account numbers, and who knows what else.

That said, it’s almost impossible to avoid signing up for these services today. Both Apple and Microsoft have deeply embedded these services into their products to the point where many key features simply won’t function without them. Furthermore, you pretty much need to have one account for each person in your family, not just one shared account. These services are not just about synchronizing data across your devices, it’s about personalization of the experience on these devices for each individual. For example, it allows parents to control what each of their children can access—what’s right for your elementary school son is different than what’s right for your teenage daughter.

Of course, all of these hyper-personalized settings are a gold mine for marketers. If you dig around in the end user license agreements (EULAs) you “sign” by clicking that I Agree button, I’m sure you’ll find references to how you consent to sharing some of your information with “partners.” I guarantee you’ll find language about how Apple and Microsoft will hand over this information to law enforcement authorities “in accordance with the law,” too. That may or may not require a warrant, by the way.

This is the world we live in now. We’re offered enticing and often very valuable services, usually at no (monetary) cost—we just have to sign away our privacy. And this is increasingly becoming unavoidable as these services are tightly integrated with our computer and mobile operating systems. For most of this book, I try to avoid using these accounts. However, in Chapter 9, I’ll show you how to enhance the privacy settings for these accounts.

Built-in Security Features

Computers are meant to make our lives easier and richer by offering all sorts of valuable functions, taking over the drudgery of tedious tasks, helping us to organize our increasingly complex lives, and giving us powerful tools to create documents, presentations, greeting cards, images, and so on. In the early days, before the advent of the Internet, computers were wide open—they were ready and willing to accept instructions from other computers on the home or work network. Our operating systems and software applications were happy and naive, gladly offering their help to anyone who asked. Then came the Internet. It was like transporting Mary Ann from Gilligan’s Island to the Island of Dr. Moreau. The cheerful eagerness to help without question went from being an asset to a serious security liability.

Modern computers have lots of built-in security features, though until recent years, many features were not enabled by default. Security is frequently at odds with convenience, and both Microsoft and Apple want to avoid causing their customers undue grief. Thankfully, however, as computer security has become more important, computer and software makers are finally enabling these features right out of the box.

One of the most important features in modern home computer networks is the firewall . Firewalls keep out unsolicited connections from outside your network but allow you to initiate connections from inside your home to the broader Internet. They also allow you to set up specific rules that explicitly allow certain types of connections from outside your home. It’s sort of like a phone that can only call out by default but will let you give it a list of people who you allow to call you. (Why no one sells such a phone is beyond me. I’d buy it in a heartbeat.) You probably have multiple firewalls in your network. Your ISP’s modem might have a built-in firewall. If you have a Wi-Fi router, it almost surely has a firewall function, enabled by default. Finally, your operating system also has a built-in firewall. These firewalls do an excellent job of protecting your computer.

Another aspect of your Wi-Fi router that helps protect you is a feature called Network Address Translation (NAT). As we discussed earlier in the book, communication with the Internet is like mailing letters: the information you send is chopped up into a letter-sized payload, stuffed in an envelope called a packet, and shipped out with a destination and return address written on it. But to the outside world, every smart device on your home Wi-Fi network looks the same—that is, all the communications appear to come from the same address. This is because your router acts as a sort of local mail delivery system. Think of a large company. When you send a package to someone in that company, you probably just address it to the person at the general company address. You don’t know the specific building and/or mail slot within the company; you just trust the company’s internal delivery service to find them. This also means that the company can filter incoming packages. Your router performs a similar function. This means computers outside your home network have no direct way to contact an individual entity (computer, smartphone, or other Internet-connected device) within your home, even if there was no firewall in place. This is one form of security through obscurity that actually benefits you.

These features may sound nice on paper, but you’d be surprised how well they work—all by themselves—to thwart Internet attackers. Because unprotected computers are so vulnerable, hackers and other bad guys are constantly scanning the Internet for computers without these basic protections. Multiple studies³ have shown that unprotected computers (particularly older models without these modern, built-in protections) connected directly to the Internet are routinely and easily taken over. In fact, if you connect an older, unprotected Windows machine directly to the Internet, it will be subverted, on average, within ten minutes. Before this computer can even download the system updates that would probably protect it, it will be hacked⁴ by some automated bot. The firewall and NAT functions serve as an excellent first line of defense, and luckily these features are standard in home networks now.

So far we’ve talked only about features that are already in place and working for you right now, and these features tend to be enabled by default. But there are other built-in security features in modern operating systems that are just sitting there, waiting to be used.

Full hard drive encryption is a feature that’s been built into recent versions of Mac OS and Windows. While Apple’s drive encryption utility (FileVault) is available on all of its recent OS variants, Microsoft’s encryption utility (BitLocker) is available only on the Pro, Ultimate, and Enterprise versions of Windows. Encrypting your entire hard drive might seem like overkill, but it’s so easy to do; there’s just no reason not to do it. As a user, you won’t even notice it. The operating system takes care of decrypting all the files (and applications and even the OS itself) on the fly and in the background. What this means is that if someone were to have physical access to your hard drive, they would be unable to read any of the data, unless they were somehow able to guess your encryption password. While this may not be that important for desktop computers that stay inside your house, it can be important for laptops and other devices that you carry around with you—particularly if you travel to foreign countries⁵ with these devices. If your laptop were to be lost or stolen, you’ll be happy to know that your data is perfectly safe, even if they were to pry open the case and attempt to directly access the hard drive.

One last free feature deserves special mention: Apple’s Find My Device service, where Device is Mac, iPhone, or iPad. Offered with Apple’s iCloud service, this feature allows a person to track the location of all their devices and control them from afar. When you register your device with the Find My Device service, Apple uses the various wireless technologies (mainly Wi-Fi and cellular signals) on the device to help you communicate with the lost device, send remote control commands to it, and, as a last resort, remotely erase the data from the device. It’s truly a marvelous feature, and everyone with an Apple product should take advantage of it.

Let me demonstrate the usefulness of this feature with personal story. My family and I went to Los Angeles last year for a big family vacation, and part of our trip included Universal Studios. I normally carry my iPhone in my shirt pocket, and I do not normally ride theme park rides. However, on this day, we rode several—and at one point when I went to pull my iPhone out to take some pictures, I realized it was gone. It must have fallen out, but I had no idea where. This park is massive, and it could be anywhere. I alerted our tour guide, and she said she would put in a call to their lost-and-found department but that they probably wouldn’t be able to look for it until after the park closed at 10 p.m. We got home around 9 p.m., and I jumped on my laptop to check Find My iPhone on iCloud…and there it was, in the Jurassic Park ride building! As it hit 10 p.m., I was able to actually send signals to my iPhone to make alerting noises and post a message on the main screen with contact information. As I watched the map update, I finally saw it move! Someone had found it! It stopped moving at the building where the lost-and-found office was. I went first thing the next morning and retrieved it!

The Pros and Cons of Antivirus Software

When people think of computer security, they invariably think of antivirus (AV) software. That’s no accident. Companies that make this software spend lots of money marketing their wares and convincing you that you’d be foolish not to buy them. Most Windows PCs come preloaded with all sorts of trial software that claims to protect you from the big bad Internet—for just a small (ongoing, hard-to-quit) service fee! This is a perfect example of what we call FUD, which stands for “fear, uncertainty, and doubt.” Computer malware is a very real problem—don’t get me wrong—but in many cases today, the cure can be worse than the disease. Let me explain…

In simpler times, AV software was essential did a good job at finding malware on your computer. Generally speaking, the core function of AV software is to recognize known malware and automatically quarantine the offending software. Some AV software is smart enough to use heuristic algorithms to recognize malware that is similar to the stuff it already knows is bad or recognize suspicious behavior in general and flag it as potentially harmful. A popular new feature for a lot of AV software is to monitor your web traffic directly, trying to prevent you from going to malicious web sites or from downloading harmful software.

That all sounds good, but the devil (as always) is in the details. First, in the ever-connected world of the Internet, malicious software is produced so frequently and is modified so quickly that it’s really hard for AV software to keep a relevant list of known viruses. Also, the bad guys have moved to other techniques like phishing and fake or hacked web sites to get your information, attacking the true weakest link: you. AV software just isn’t as effective as it used to be.

But the problem is much worse than that. In many cases, the AV software itself is providing bugs for hackers to exploit. Not long ago, Symantec/Norton products were found to have horrendous security flaws⁶ (which it claims to have since fixed). Increasingly, AV products are offering to monitor your web traffic directly, but this means inserting themselves into all of your encrypted (HTTPS) communications, which has all sorts of ugly security and privacy implications.

So, I strongly believe you don’t need to pay for an antivirus service today. That is, I don’t personally believe that the benefits of the various for-pay services warrant their cost for most people. There are totally free alternatives from the operating system creators that do a good job (which I will be helping you install later in this chapter). Furthermore, if you just do the things I outline in this book, you will significantly reduce your risk. It’s like debating the value of buying a bulletproof vest. While walking around in a bulletproof vest is inarguably safer than walking around without one, it’s actually more important to just avoid war zones and disputed gang turf.

How to Properly Delete a File

Did you ever wonder what happens when you delete a file on your computer? On Windows and Mac OS, this is represented by dragging the file or folder to the trashcan icon. Most of you probably realize that the file isn’t actually deleted until you “empty the trash.” What you may not realize is that even then, the data associated with that file is not really gone. It’s still there on your hard drive. While your file system no longer shows it to you, the actual bits and bytes are still there, and special software can be used to recover that information.

This is sort of like the difference between throwing away a document and shredding it. Just because you threw your old legal will into the garbage and the trash collector took it away doesn’t mean that it can’t be salvaged and read. You can’t see it anymore, but it still exists in a landfill somewhere. It will slowly decay over time, but until then, someone could dig around and find it. This is why document shredders were invented. When your operating system “deletes” a file on your hard drive, all it really does is forget about it. It treats that part of the hard drive as if it were empty. When you want to save a new file, the operating system will put that file in the space on your hard drive that is marked as empty. Someday it will eventually overwrite part or all of your old “deleted” file, but until that day, the data is actually still there and capable of being read by special tools.

So, if you really want to delete a file from your computer, you need to digitally “shred” it. I’ll show you how to do this in the checklist for this chapter.

Summary

Checklist

This chapter covers some key things you can do on your computer to reduce your “attack surface” and practice the policy of “least privilege.” That is, you need to reduce unnecessary risks, turn off features you don’t need that might be exploited, and set up some reasonable boundaries on who can do what on your computer.