The beta version of Mac OS X 10.10 was released in June, and the official version came out in October. Are there...
any security features or implications with Yosemite that our organization should be aware of?
OS X Yosemite (version 10.10) was unveiled at Apple's Worldwide Developers Conference in June and was released to the public on Oct. 16, 2014.
Many of the operating system's newer features focus more on its new look and the increased level of synchronization with Apple's iOS 8 mobile operating system, which is made possible through a set of services Apple calls "Continuity," rather than security and privacy.
One of the major new features of Continuity is called "Handoff;" it automatically syncs files on Mac and iOS devices that are located near each other, allowing a user to start their work on an iPhone or iPad, and then finish it on a MacBook or Mac, and vice versa. So, for example, users can begin writing an email on an iPhone and then the mail app on their Mac will open up with the unfinished message ready for completion, and Safari will open the same webpage being viewed on the other device. However, note that the Handoff feature is limited to Macs that include Bluetooth 4.0.
Another link between iOS and OS X Yosemite is iCloud Drive. All data saved to iCloud is available from any Apple device, and all files associated with apps on either an iPhone, iPad or Mac are accessible from Finder. Users will no longer have to remember on which device the file originally resided or was last edited. Yosemite also allows simple local file sharing between iOS devices and Macs using AirDrop, potentially reducing reliance on file-sharing sites such as Dropbox.
For road warriors working from multiple locations or using multiple devices, the ability to switch seamlessly between different devices will be very attractive, but it further blurs the line between desktop and mobile. The ease with which data can be shared between different devices encourages data creep and data sprawl. Having both work and personal data located on numerous devices can increase opportunities for unintentional and malicious data leakage.
Yosemite's new Mail Drop feature does enable secure file sharing, allowing a user to forward large files to other Yosemite users. Files are encrypted and transferred to Apple's servers, and the intended recipient is sent a link to the file. Again, data leakage is a real danger, as the files are stored in a user's iCloud account, and spear-phishing attacks will definitely try to exploit the ease with which files can be dragged and dropped to other users.
Any new features that are introduced in new operating systems and applications that may present a possible threat to data security should always be risk assessed in an enterprise. Data loss prevention products should be audited to verify that they can both spot and stop inappropriate data transfers via new channels. Security awareness training must be refreshed to ensure employees not only understand how to use the latest OS and application features without putting data at risk, but also are aware of potential threats. An explanation of secure configuration settings will do a lot to prevent basic errors and will be much appreciated by users, as it also benefits them personally.
Finally, Apple's new programming language for iOS and OS X apps -- called Swift -- could help improve app security, as it removes entire classes of unsafe code. Variables are always initialized before use, arrays and integers are checked for overflow, and memory is managed automatically, which eliminates the problem of buffer overflows and other security issues that plague most languages. Enterprises that develop their own apps in house should certainly encourage their developers to move to this new language.
Note: As Mac OS X is a UNIX-based operating system, it is potentially vulnerable to the Shellshock vulnerability -- CVE-2014-6271. The publicly released version of OS X Yosemite includes fixes to mitigate this vulnerability, but users who are running earlier versions of OS X should apply the appropriate patch from Apple.
Ask the Expert!
Have a question about application security? Send it via email today! (All questions are anonymous.)
Learn more about Mac OS X security features and capabilities.
Comparing Mac OS X vs. Windows security.
Dig Deeper on Alternative operating system security
Related Q&A from Michael Cobb
Geofencing technology is increasingly being used as a security tactic, such as to control access to servers with DNS settings. Expert Michael Cobb ...continue reading
After a remote code execution flaw in PHPMailer was patched, the problem persisted, and had to be repatched. Expert Michael Cobb explains how the ...continue reading
The same-origin security feature in Adobe Flash Player was implemented incorrectly, allowing local attackers to spy on users. Expert Michael Cobb ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.