There are two schools of thought when it comes to the software firewall built into OS X.

One school says that it's not necessary. Firewalls prevent unapproved connections from opening ports on a computer's network interface. (Ports are how a software service talks to a network. You can think of a port as a window in a wall; some ports are left open on purpose to allow incoming and outgoing data traffic.) But by default, OS X doesn't leave many ports open. In contrast, most versions of Windows ship with a bunch of open ports, which is one reason that operating system is a riper target for malicious hackers. And while Leopard leaves open more ports than earlier versions of Mac OS X, so far there have been no known attacks on those default services. (Compare Desktop Firewall products)

The other school (to which I belong) says that the best security mantra is "never assume." As you install and use programs on your system, you often open ports without realizing it. And there's always the possibility that a chink in OS X's armor will lead to a wave of new exploits. That's why I recommend that all Mac users turn on OS X's built-in firewall.

The problem is that, while OS X has long included basic firewall software, Leopard introduced some significant changes to it, leaving many Leopard users confused as to how to keep their Macs secure. But though the firewall interface in Mac OS X 10.5 is indeed quite different from that in earlier versions of the OS, it's still relatively easy to use, especially since the release of the 10.5.1 update.

What's new

In previous editions of OS X, you configured the firewall in the Sharing preference pane. In Leopard, you do it in the Security pane.

That's not the only change. Instead of the Start/Stop button found in those earlier incarnations, the firewall in the initial release of Leopard gave you three options: Allow All Incoming Connections, Block All Incoming Connections, and Set Access For Specific Services And Applications.

Those options confused many users. For one thing, the terminology was vague. Also, the Block All Incoming Connections option actually left a number of ports open, including any service running as the root user; none of those open services were shown in the user interface.

For more Mac news, visit Macworld. Story copyright Mac Publishing, LLC.

Whitepapers

• Advancing the Economics of Networking
• Enterprise Data Center Network Reference Architecture
• Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices
• File Integrity Monitoring: Secure Your Virtual and Physical IT Environments
• Boost Productivity While Cutting Costs with Next-generation Collaboration
• Deploying Virtualized NetWare on Linux Whitepaper

View more SECURITY whitepapers

Webcasts

• PoE Plus: Impact on the PoE Market
• Creating a high performance workplace with wireless networking
• Harnessing the power of communications to increase workplace performance
• Making data centers the IT strategic focus
• Protecting assets and employees with IP Video Surveillance
• Stay out of the headlines: Detecting and preventing network intrusions

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports