Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Apple OS X surges in enterprise with maturing security

John Cox | Jan. 27, 2014
'Consumerising' the OS strengthens enterprise security of Macs.

A recent tutorial at TechRepublic on integrating Macs into an enterprise Windows domain - assures readers that "Integrating Macs will initially be easier than you think!" The process of binding, or joining, a Mac to a domain is "virtually identical to joining a Windows PC to a domain, complete with checking domain credentials to verify the end user has the necessary rights to add the computer to the domain."

Many of the OS X changes have been done by Apple on its own. It's only relatively recently, according to these sources, that Apple has started to become more open about security, with vendors and researchers. "Apple has been quite proprietary in the past," says Nachreiner. The shift seems to have been spurred, again, from the iOS side. "They talked at Black Hat [a well-known series of security conferences] for the first time in 2012, describing their secure boot process for iOS," Nachreiner says.

Over the past couple of years, Apple has made a number of high profile hires of outside security experts. One is former Microsoft employee, and Vista hacker, Kristin Paget, hired in late 2012 for OS X security, not long after the Flashback malware, exploiting an unpatched  vulnerability in Java, infected a reported 600,000 Macs. It was a rude awakening for many users.  

Other hires in recent years, summarized in this BusinessInsider story, include: David Rice, in 2011, a cybersecurity expert and former NSA analyst (and author of the 2007 "Geekonomics"), as director of global security; Mwende Window Snyder, in 2010, formerly chief security officer at Mozilla; Kevin Blanchard, 2010, security engineer; Alan Ptak, in 2011, formerly with SANS Institute; and Matthew Murphy, 2007, software engineer who helped create security for the Mac App Store app review process.

ESSET's Cobb would like to see Apple's involvement with the larger security community broaden and deepen. "It's a question of can Apple maintain that walled garden defense adequately all by itself,'" he says. "We wouldn't be selling a consumer [security] product for the Mac if there was not additional work to be done."

These sources all declined to go into details about their company's relationship with Apple.

MobileIron's Rege says nearly all of those details are covered under non-disclosure agreements with Apple. But he did say that Apple has been very open to listening to MobileIron and other third parties: they listen, evaluate, and sometimes say yes to requests and sometimes say no. Apple does not share any of its future product or technology plans. At some point before Apple releases the "gold master" of the next iOS release, the company starts to inform third parties about relevant new features. Rege wouldn't say when that occurs. "We've had enough runway' for our product to be ready to support that OS release as quickly as possible," he says.


Previous Page  1  2  3  4  Next Page 

Sign up for CIO Asia eNewsletters.