If you’re evaluating the best antivirus for Mac, you should be aware of not only your Mac’s built-in security features, but also of one of the most devious types of cyber attacks, called a “supply chain attack”.
First, you should know that Apple includes built-in security features, such as XProtect and Gatekeeper, with every Mac computer…
Second, adding a third-party antivirus program to your Mac could be more trouble than it’s worth if that software provider gets compromised… Third-party antivirus scanners will require total access to every area of your Mac, which puts you at risk in the event of a supply chain attack.
Third, you should view any decision as a series of trade offs and weigh the cost of any third party Mac antivirus software and any additional features against your security needs.
The Best Antivirus For Mac... Already Included With Your Mac?
Apple has built a reputation for privacy, reliability and security by maintaining tight control over their software and hardware ecosystem…
They’re not perfect, no company is, but Apple has deliberately chosen a “walled garden” approach in contrast to the value added retailer (VAR) model of the Microsoft PC ecosystem to boost security.
For software to be approved for use on a Mac, Apple requires all app developers to go through a formal approval process and requires sandboxing to secure user data on their apps and reduce the likelihood of a hack.1
In terms of antivirus, Gatekeeper and XProtect are two security features that are built into every Mac that you should know about.
What Is Gatekeeper For Mac?
Gatekeeper is a built-in Mac security tool that helps you ensure that only trusted software runs on your Mac.
When you download an app, plug-in or an installer package, Gatekeeper does three important things to ensure downloaded software is legitimate and checked for known malware:
- Verifies that downloads, such as apps, are from the Mac App Store or from identified developers.
- Confirms that apps are notarized by Apple, meaning they’ve been checked by Apple for malicious content.
- Ensures apps haven’t been altered since they were signed by the developer.
Gatekeeper also checks whether a file is “executable“2, as opposed to just a data file.
If you attempt to open software downloaded from outside the App Store for the first time, Gatekeeper may restrict your ability to install it based on your security settings. You may see a popup requesting your explicit approval (by confirming with your password) to run the downloaded software.
You can configure the restriction levels for what types of software your Mac can install by going to “System Settings” > “Privacy & Security”.
What Is XProtect For Mac?
XProtect is Apple’s built-in anti-malware system for macOS that uses signature-based detection3 to protect against malware and viruses.4
There are several advantages to relying on XProtect over third party Mac antivirus software options:
- Built-in and free: XProtect is included with every Mac, for no additional cost, and no installation is required.
- Lightweight: XProtect operates natively with minimal impact on system resources.
- Privacy: XProtect doesn’t require you to grant full system access to a third party provider that may itself get hacked.
- Regular updates: Apple requires XProtect to be constantly maintained with frequent security updates.
- Integration: The software works seamlessly with other macOS security features like Gatekeeper, described above.
However, there are also disadvantages of relying only on XProtect that you should consider:
- Limited scope of existing threats: XProtect focuses on known malware signatures, meaning it may not protect against “zero day” attacks.
- On-demand features: May not offer advanced features like real-time scanning or real time web protection.
- Detect unknown threats: Antivirus equipped with advanced dynamic or heuristic analysis capabilities may catch new threats, including zero-day malware, that Apple could miss.
You may not have every security feature you might want included with your Mac… For those additional features, a third-party Mac antivirus option may be your best bet.
Third Party Antivirus For Mac
Antivirus for Mac is available from third party providers, such as Malwarebytes, Norton 360, Intego and Bitdefender.
Based on expert reviews you can find online, these providers offer strong malware protection and minimal system impact. Aside from virus scanning and quarantining of malware, third party Mac antivirus providers may include other useful features, such as:
- Real time protection: Often includes real-time scanning, web protection, and email filtering.
- Privacy and security features: May offer VPNs, password managers, ransomware defenses or parental controls.
- Cross-platform support: Useful if you have multiple device types.
Disadvantages of third-party antivirus:
- Price/Cost: Most require paid subscriptions for full feature access.
- System impact: Can potentially slow down your Mac.
- Supply chain attack concerns: In most cases, using a third-party antivirus software requires granting that third-party provider complete system access to your Mac which leaves you open to privacy and supply chain attack concerns…5
- Potential conflicts: May interfere with other software or system processes.
And note that some expert reviewers, such as the “Wirecutter”, have come to the conclusion that most people may be OK just relying on Apple’s built-in security features, such as XProtect and Gatekeeper, described above.
However, if you do decide that a third-party Mac antivirus is something you want, choose an antivirus offering that is easy to use, won’t slow down your Mac and is a good value. Some providers, such as Malwarebytes, which I have experimented with in the past, offer a free trial or a limited set of features for free.
You may want to refer to analysis from expert reviewers who aren’t compensated for referring you to one antivirus offering or another… A good source of expertise is this web security blog by Carey Parker.
Complimentary Malware Protection For Your Home
Adding a separate firewall to your home network can create an additional layer of security to protect against malware while complimenting your Mac’s XProtect service.
This augmented approach helps keep your home malware free while not compromising the device itself with a 3rd party anti-virus software that itself could be compromised.
An affordable home firewall, such as those available by Firewalla and pfSense, is relatively easy to use and offers a range of useful enhancements to your home network.
Specifically, a firewall notifies you if abnormal traffic is happening, while also allowing you to control specific devices, filter ads, block pornography, limit social media use, or gain VPN functionality. You can also segment your home network to create a separate virtual local area network (VLAN) for all the IoT devices in your home.
Summary
For most Mac users, Gatekeeper and XProtect combined with safe browsing habits and regular system updates provides adequate protection. The built-in security features of macOS, including XProtect and Gatekeeper, to create a robust security environment.
However, if you are someone who requires additional protection due to handling sensitive data, or if you spend time on websites you’re concerned about, you may prefer a more comprehensive security suite, might still opt for a reputable third-party solution.
That said, with Kaspersky, a well-known antivirus company, recently being banned outright in the U.S., it’s hard to know who to trust these days.
Remember, no antivirus software is going to keep you safe from falling for a phishing attack.
At the end of the day, the security of your Mac depends as much on maintaining a healthy level of healthy paranoia in daily browsing decisions6 as any automated software tools.
Footnotes
- Apple continues to build out software tools that help secure its hardware... For instance, Apple's Safari browser also includes a privacy feature called iCloud Private Relay, which is similar to a Virtual Private Network (VPN), to help keep your browsing data private from data brokers. I'm also looking forward to Apple's built-in Password Manager which will be released this fall.
- An executable file is a file that runs a program on your computer, instructing your computer to perform a particular task.
- Signature intrusion detection systems (SIDS) are based on pattern matching techniques to find a known attack; these are also known as Knowledge-based Detection or Misuse Detection (Khraisat et al., 2018). In SIDS, matching methods are used to find a previous intrusion. In other words, when an intrusion signature matches with the signature of a previous intrusion that already exists in the signature database, an alarm signal is triggered. For SIDS, host's logs are inspected to find sequences of commands or actions which have previously been identified as malware. SIDS have also been labelled in the literature as Knowledge-Based Detection or Misuse Detection (Modi et al., 2013).
- XProtect was first introduced in 2009 with Mac OS X 10.6 Snow Leopard.
- A supply chain attack exploits the trusted relationship between an organization (or individual) and its suppliers by using malicious code to infiltrate your computer system via a trusted software update or software component. The Internet has fostered the increasingly global, interconnected nature of our daily lives, leading to increasing risk of supply chain attacks. Any situation where a manufacturing process is being deliberately compromised by a bad actor may be considered a supply chain attack. In the infamous "SolarWinds" supply chain attack, 18,000+ customers, including multinational companies and governments, were compromised as foreign bad actors gained access to their systems and data. The late 2019 hack was undiscovered for over a year, and the fallout from this hack is still ongoing.
- aka your "Internet hygiene"
