New bells and whistles aren’t the only reason to upgrade to Lion. The new version of Apple’s operating system for the Mac also includes updated security features.

Macs have long been safer than Windows PCs, because they are very rarely chosen for attacks, probably because of the Mac’s much smaller market share and to crooks’ extensive expertise in writing malware for Windows. But now, they are also more secure than PCs, thanks to several crucial security improvements in the operating system itself, Mac OS X 10.7 ($30 download from the Mac App store).

So says Dino A. Dai Zovi, an independent security consultant. Those operating system features now put Lion ahead of Windows 7, the latest version Microsoft’s operating system, whose leadership was forged from the fire of relentless attacks by hackers and malware writers, he says.

Security Privacy

Keeping tabs on online threats.

The move comes while OS X remains a virtually malware-free zone, but concerns are rising that that won’t last. Quite a few Mac users were hit by a “scareware” program known as MacDefender this spring. As cybercrime rises and Mac’s market share grows, many experts expect more to come.

Seeing an increasing need for caution, “Apple put a lot of security features in the iPhone,” Mr. Dai Zovi says. “But on the Mac they haven’t really put in a lot of security features until now.” After all, why bother with locks if no one is trying to get in? But today, there is good reason: dissuading attackers from ever trying and knocking them back if they do. “They’re increasing the security protections as the bull’s-eye gets bigger,” he says.

Here are the top three new Mac security measures, according to Mr. Dai Zovi:

Sandboxes — Apple has embraced “sandboxing,” technology that restricts what an application can and can’t do and forces it to play only in its own little sandbox. Apple’s take on sandboxes — applications cannot read or write data in any app but their own — is stricter than that of Microsoft and Adobe, Mr. Dai Zovi says.

Many Apple applications are sandboxed in Lion, including the Safari Web browser and the Preview application that is used to view PDFs and images. This is welcome, considering that Web sites and Adobe files are the favorite vehicles of malware today. It means that a virus from the Web would be stuck in Safari and unable to grab assets elsewhere in your computer.

Even better, says Mr. Dai Zovi, starting in November, Apple will require that all applications sold in its Mac App store use this sort of sandbox by default. The requirement will end what has been an honors system in which Apple trusts but does not enforce that requirement. In the past, for example, Apple could not be sure that Skype wouldn’t read cookies stored in your browser and log into your Gmail account. Sandboxed, Skype wouldn’t be capable of that — and neither would that random product purchased from a fly-by-night start-up.

Apps sold in the store will also be subject to security checks by Apple, which could make the Mac App store the safest place to buy software for your Mac. It will work a lot like Apple’s store for mobile apps, where nary a malicious application has been seen.

Address Space Layout Randomization — It’s a mouthful, but it’s very good for you. ASLR, which involves rearranging memory in an application, makes it significantly harder for hackers to exploit software vulnerabilities because they don’t know where their potential targets are located.

Snow Leopard used ASLR in a limited way, and “if it’s not complete, it’s almost a waste,” Mr. Dai Zovi says. Lion, however, carries out ASLR fully, catching Macs up to Windows and Linux.

So far, most Mac attacks have involved “social engineering” to trick users into installing something malicious, not the sort of automated download that ASLR defends against. “Apple is being proactive here,” he says. “It’s likely that, as the Mac platform gains market share, they will see this type of malware.”

FileVault 2 — Lion includes Apple’s second stab at data encryption for your computer. In Snow Leopard, FileVault encrypted only users’ home directories, the place where most user files are kept. The program was also slow and didn’t work well with Time Machine, the Mac backup system.

With Lion, however, FileVault delivers full-disk encryption and encrypted data in Time Machine backups and on removable drives. This change means that if your laptop (or USB stick) is lost or stolen — arguably Mac users’ biggest security risk — your data is safe. You do have to be careful not to get locked out yourself. As a safety net, you can have Apple store a recovery key for you, should you forget your password, or you can print it out and stash it in a safe place.

So is all this a reason to upgrade to Lion immediately? Not necessarily.

With the security threats so limited, it isn’t vital to have these features right now, Mr. Dai Zovi says. “There are always a few rough edges in an initial release, and there might be some incompatibilities with various applications,” he says. “These kinks are usually worked out by the .1 or .2 releases, and that would be a better time for most users to upgrade.”

Article source: http://feeds.nytimes.com/click.phdo?i=d8ed8d8466f15f767a59a49c82b28571