everythingpossible - Fotolia

Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

What's new with Mac OS X Yosemite security?

Security expert Michael Cobb outlines new Yosemite features -- and the security risks posed by them -- that enterprises should be aware of, including Handoff, iCloud drive, Mail Drop and more.

The beta version of Mac OS X 10.10 was released in June, and the official version came out in October. Are there any security features or implications with Yosemite that our organization should be aware of?

OS X Yosemite (version 10.10) was unveiled at Apple's Worldwide Developers Conference in June and was released to the public on Oct. 16, 2014.

Many of the operating system's newer features focus more on its new look and the increased level of synchronization with Apple's iOS 8 mobile operating system, which is made possible through a set of services Apple calls "Continuity," rather than security and privacy.

Any new features that are introduced in new operating systems and applications that may present a possible threat to data security should always be risk assessed in an enterprise.

One of the major new features of Continuity is called "Handoff;" it automatically syncs files on Mac and iOS devices that are located near each other, allowing a user to start their work on an iPhone or iPad, and then finish it on a MacBook or Mac, and vice versa. So, for example, users can begin writing an email on an iPhone and then the mail app on their Mac will open up with the unfinished message ready for completion, and Safari will open the same webpage being viewed on the other device. However, note that the Handoff feature is limited to Macs that include Bluetooth 4.0.

Another link between iOS and OS X Yosemite is iCloud Drive. All data saved to iCloud is available from any Apple device, and all files associated with apps on either an iPhone, iPad or Mac are accessible from Finder. Users will no longer have to remember on which device the file originally resided or was last edited. Yosemite also allows simple local file sharing between iOS devices and Macs using AirDrop, potentially reducing reliance on file-sharing sites such as Dropbox.

For road warriors working from multiple locations or using multiple devices, the ability to switch seamlessly between different devices will be very attractive, but it further blurs the line between desktop and mobile. The ease with which data can be shared between different devices encourages data creep and data sprawl. Having both work and personal data located on numerous devices can increase opportunities for unintentional and malicious data leakage.

Yosemite's new Mail Drop feature does enable secure file sharing, allowing a user to forward large files to other Yosemite users. Files are encrypted and transferred to Apple's servers, and the intended recipient is sent a link to the file. Again, data leakage is a real danger, as the files are stored in a user's iCloud account, and spear-phishing attacks will definitely try to exploit the ease with which files can be dragged and dropped to other users.

Any new features that are introduced in new operating systems and applications that may present a possible threat to data security should always be risk assessed in an enterprise. Data loss prevention products should be audited to verify that they can both spot and stop inappropriate data transfers via new channels. Security awareness training must be refreshed to ensure employees not only understand how to use the latest OS and application features without putting data at risk, but also are aware of potential threats. An explanation of secure configuration settings will do a lot to prevent basic errors and will be much appreciated by users, as it also benefits them personally.

Finally, Apple's new programming language for iOS and OS X apps -- called Swift -- could help improve app security, as it removes entire classes of unsafe code. Variables are always initialized before use, arrays and integers are checked for overflow, and memory is managed automatically, which eliminates the problem of buffer overflows and other security issues that plague most languages. Enterprises that develop their own apps in house should certainly encourage their developers to move to this new language.

Note: As Mac OS X is a UNIX-based operating system, it is potentially vulnerable to the Shellshock vulnerability -- CVE-2014-6271. The publicly released version of OS X Yosemite includes fixes to mitigate this vulnerability, but users who are running earlier versions of OS X should apply the appropriate patch from Apple.

Ask the Expert!
Have a question about application security? Send it via email today! (All questions are anonymous.)

Next Steps

Learn more about Mac OS X security features and capabilities.

Comparing Mac OS X vs. Windows security.

This was last published in February 2015

Dig Deeper on Alternative operating system security