Common sense: It's inexpensive, invaluable, and in limited supply.

Just some random thoughts...

I think most users don't want to have to think about what they're doing
and how they're doing it, which is why Mac OS X is a big plus in general
terms. It's one reason why while developing security software
(especially for consumers) you have to find a delicate balance between
security and annoyance as well as security and functionality.

Thankfully in the business and enterprise arena that balanced is
(supposedly) managed by someone else who has more education and
(presumably) better sense.

And I think for Apple, when considering development plans that include
security features, they have to balance between engineering and
marketing as well as quality assurance. I can't comment on my experience
with testing Leopard pre-release, but from past experience in other
endeavors, some brilliant security features have to be left-out due to
usability and marketing issues (also quality assurance) as well as to
achieve that all important delivery deadline.

But still: Common sense rules. A little security education without
having to buy anything new can make a big difference. Some potential
things Apple could do towards this:

* If you don't want to complicate initial setup, then provide a security
wizard for post-installation. In addition to educating users, you can
walk them through all of the possible means and options for
strengthening security.
* Make sure that there is a Security PDF included with the operating
system or readily available online that discusses common sense practices
as well as discusses the security features of Mac OS X.
* Appoint a chief security officer. (It's something that's been
mentioned on this list before.) It would be great to have someone at the
top thinking about security full-time.

Anyone else have thoughts on promoting and educating common sense?

Security Response Researcher
Focus-Apple Moderator

Todd D. Woodward
Technical Support Engineer
NetBackup Support
Symantec Corporation
www.symantec.com
Springfield, Oregon

Office: 541-335-7441

[ reply ]