The Apple way of (in)security

Tight hardware control and strict application policies reduce risk. So why doesn't everybody take Apple's approach to security?

By Morey Haber, eEye Digital Security

April 12, 2010 — CSO —

When will Apple become a juicy target for hackers and cyber-crooks? Industry experts have predicted that as Apple's market share grows, so will the malware targeting its platforms.

To date, this has yet to happen, but why?

Is the Mac really that much more secure than the PC in terms of design or policy? Or is Apple's market share still below some sort of malware tipping point? After all, the PC has a much larger market share and is the platform of choice for most businesses. Thus, it's a far more enticing target for hackers. Right?

Also see Chad McDonald's Peeling Apples: Reconsidering Mac Security


Not necessarily. There are two key markets where Apple is a leader: MP3 players and smart phones. iPods rule the music world, and even as they've become internet-capable, hackers have ignored them. Contrast that to USB storage, printers and other peripherals that have posed serious security problems. (http://defensetech.org/2008/11/20/pentagon-slammed-by-cyber-attack/)

The same is true of the iPhone. Granted, the iPhone isn't the smart-phone leader in terms of market share (that would be BlackBerry in the U.S. and Symbian worldwide) (http://techcrunch.com/2010/02/23/smartphone-iphone-sales-2009-gartner/), but it's surely number one in terms of prestige.

Yet, the attacks are few and far between.

This doesn't mean Apple platforms don't have vulnerabilities. They do. Plenty of them. The March software update of the Leopard and Snow Leopard operating systems corrected a record-setting 92 vulnerabilities, a third of which were critical. Apple's software has just as many flaws as everyone else's.

Control Mitigates Risk

What's different about Apple's software is that it is very tightly controlled.

The Apple way of security is this: control the hardware, tightly control your own software, control where users get third-party software, control what type of software can be installed and then control what that software can do after installation. As a result, you have controlled malware.

You may have a load of vulnerabilities, but this process makes it difficult for hackers to exploit them.

Despite industry and investor pressures, Apple has never decoupled its software from its hardware. In fact, when Mac clone companies have emerged, Apple has gone on the offensive with lawsuits and PR attacks. (http://consumerist.com/2009/11/federal-judge-rules-against-scrappy-mac-clone-manufacturer-psystar.html)

With tight hardware control, Apple doesn't need to worry about a slew of hardware vulnerabilities, such as faulty drivers or communication ports accidentally left open by default.

Next, Apple strictly polices the software that runs on its devices. If you want your software on the iPhone, there's one way to do it: get pre-approved applications through the App Store.

RESOURCE CENTER