Data
In the old days, you probably kept all of your private data on your Mac. Today, your information is most likely stored across multiple Macs, iOS devices, and cloud-based storage services. Fortunately, there are tools that can keep your data safe, no matter where it lies.
Losing or sharing a Mac
The risk: If your Mac is set up to boot up without a password, and if someone gains physical access to it, the data on your hard drive will be vulnerable. That private information is at risk if someone steals your Mac. But it’s also imperiled if you willingly share that Mac with others.
How to protect yourself: If your Mac logs in automatically, go to System Preferences -> Security -> General and (after authenticating) selecting Disable Automatic Login. Also, select Immediately from the Require Password After Sleep or Screen Saver Begins drop-down.
If you don’t trust the people you share your computer with, encrypt your home folder by turning on FileVault (in the FileVault tab of the Security preferences pane). While you’re at it, select Use Secure Virtual Memory on the Security panel’s General tab.
If you don’t mind paying, get a product such as PGP Whole Disk Encryption or WinMagic SecureDoc for Mac. These encrypt your entire hard drive, and require a username and password before you can even boot Mac OS X. If you want to be more selective about what you encrypt, use Disk Utility to create encrypted disk image files: launch Disk Utility and click the New Image button, then select an encryption option (I recommend 256-bit sparse image bundles).
Data in the cloud
The risk: The security of cloud services like MobileMe, Dropbox, Amazon S3, Evernote, and Google varies widely. The main risk is that someone will gain access to your account; the other is setting up your account incorrectly.
How to protect yourself: First, find out how the service protects your data. Some services encrypt your data and offer other security options, while others offer none. Second, make sure that whenever you use one of these cloud services, you do so over a secure connection. Some services support fully encrypted connections, but others don’t.
Most importantly, be careful where and how you log in. If you don’t trust the computer, don’t take the risk. Also, be careful about setting up sharing settings on any of these services; be sure you’re sharing only what you really want to share. You should also implement proper security on every device you use.
[Rich Mogull has worked in the security world for 17 years. He writes for TidBits and works as a security analyst through Securosis.com.]