Mac OS X Security Configuration - Office of Information Technology
Mac OS X Security Configuration - Office of Information Technology
Mac OS X Security Configuration - Office of Information Technology
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Users can restrict firewall access to essential network services (such as those needed forDHCP, BOOTP, IPSec VPNs, and Bonjour), or they can allow (or block) access to selectedapplications on an individual basis. The application firewall uses digital signatures toverify the identity <strong>of</strong> applications. If you select an unsigned application, <strong>Mac</strong> <strong>OS</strong> X v10.5signs that application to uniquely identify it.For expert users, the IPFW firewall is still available on the system. Because IPFW handlespackets at the protocol-layer <strong>of</strong> the networking stack and the application firewall is anapplication layer filter, IPFW rules take precedence.Signed ApplicationsBy signing applications, your <strong>Mac</strong> can verify the identity and integrity <strong>of</strong> an application.Applications shipped with <strong>Mac</strong> <strong>OS</strong> X v10.5 are signed by Apple. In addition, third-partys<strong>of</strong>tware developers can sign their s<strong>of</strong>tware for the <strong>Mac</strong>. Application signing doesn’tprovide intrinsic protection, but it integrates with several other features to enhancesecurity.Features such as parental controls, managed preferences, Keychain, and the firewall useapplication signing to verify that the applications they are working with are the correct,unmodified versions.With Keychain, the use <strong>of</strong> signing dramatically reduces the number <strong>of</strong> Keychain dialogspresented to users because the system can validate the integrity <strong>of</strong> an application thatuses Keychain. With parental controls and managed preferences, the system usessignatures to verify that an application runs unmodified.The application firewall uses signatures to identify and verify the integrity <strong>of</strong>applications that are granted network access. In the case <strong>of</strong> parental controls and thefirewall, unsigned applications are signed by the system on an ad hoc basis to identifythem and verify that they remain unmodified.Smart Card Unlock <strong>of</strong> FileVault and Encrypted StorageSmart cards enable you to carry your digital certificates with you. With <strong>Mac</strong> <strong>OS</strong> X, youcan use your smart card whenever an authentication dialog is presented.<strong>Mac</strong> <strong>OS</strong> X v10.5 has the following four token modules to support this robust, two-factorauthentication mechanism and Java Card 2.1 standards:Â Belgium National Identification Card (BELPIC)Â Department <strong>of</strong> Defense Common Access Card (CAC)Â Japanese government PKI (JPKI)Â U.S. Federal Government Personal Identity Verification, also called FIPS-201(PIV)26 Chapter 1 Introduction to <strong>Mac</strong> <strong>OS</strong> X <strong>Security</strong> Architecture
Change language