I was talking with a friend who works in a large segmented organization, where administration is done ad-hoc in each segment with some infrastructure that covers the entire organization. They were having issues with one of the systems administrators after an outbreak of some virii in the administrators area. After having dealt with the issues in some highly non-professional manners, the administrator came up with the following:
"We're going to buy Mac Minis and run Windows on them because Macs aren't affected by these security problems." [1]
The number of things that are so wrong about this statement are astounding. The fact that the people for whom the adminstrator maintains systems for bought this line is even more astounding.
Let's break this down on where the security problems exist, and how this proposed solution helps with them.
If it's the fact that the Mac traditionally used Motorola processors instead Intel based processors and that's why they don't have security problems, then by going with Mac Mini's isn't going to help since they're Intel based machines (otherwise it would be pretty difficult to do what we're going to look at next, run Windows on them).
If it's the fact that Windows has a number of vulnerabilities, especially if it's not properly maintained and protected with firewalls then changing the operating system would be an acceptable alteration. But we're not, we're going to load Windows onto the Mac Minis.
The reason that the Macs currently are less of a security risk is that there are fewer exploits and known vulnerabilities out there for Mac OS X (and previous versions of MacOS as well). Personally, I expect that to slowly change as Mac OS X gains in popularity. But in this instance, that's not the method we're choosing to make these systems more secure.
So we're left with the best security method I've heard of: A different case! By affixing an Apple logo onto the host, we've made it more secure, because Macs aren't subject to the same security problems.
-- decaf out
[1] Unfortunately while this quote is as close as I can get to the spirit of what was said, it may not be accurate as I didn't hear the person say it.
UPDATE: Since this has been linked to by a couple places now I thought I'd add a quick note to clarify. It's not the entire organization that is making this change, just one small (but important) group out of the entire organization. Probably less than 1% of the people and hosts that exist in the organization.
