Does your Mac need an antivirus? We asked the experts

There is a secular belief in the world of technology that Macs do not receive malware. We know that's not true. In June 2019, security firm Mac Intego discovered several new Mac-specific threats, and notable cases of Mac malware have been discovered in the past. But is it true that Macs are less vulnerable than Windows PCs?

Macs have many built-in features that can be powerful tools in the fight against malware. But are they enough? By default, these features are provided with all Macs. Do you really need to install third-party antivirus software on your computer? We asked the experts.

Vulnerabilities in Apple's systems

The belief that Macs are pretty resistant to malware is not just an idle fanboy-ism. Windows PCs account for about 90% of the market, making it a much more attractive target for malware makers.

And Macs really have integrated stellar tools that protect you immediately. For example, when you download an application over the Internet, your Mac compares it to a list of known malicious applications using XProtect. It works unseen in the background, which means it does not require any maintenance or activation and does not slow down your Mac. Meanwhile, Gatekeeper will prevent the application from opening without your permission if it has not been digitally signed as safe by Apple. And now, Apple has even started notarizing apps so they can prove they are trustworthy.

In addition to this, all applications are in sandbox mode, which means that they can only do what they are supposed to do without access to the infrastructure and system settings criticism.

But there are gaps in the armor that protects Mac users' systems. Apple's security layer relies on adding quarantine tags to suspicious or downright malicious malware, which opens the warning dialog that you see when you try to open them.

Thomas Reed, director of Mac & Mobile of the security company Malwarebytes, told me that the defenses were not as complete as it seems. "Adding this indicator is not a requirement and not all software [it], "he explained." For example, torrent software does not do it often, while being heavily used for hacking. "

In addition, XProtect's list of malicious file signatures is not exhaustive. Reed explained that he only checks files against 94 rules, "a tiny fraction of the rules found in any more powerful antivirus engine". Kirk McElhearn, co-organizer of the Mac Intego security company's podcast and malware editor, agrees that XProtect only looks for "a handful of malicious programs."

What about the new security features of MacOS Catalina, whose launch is scheduled for this fall? According to Apple, applications will require your permission before accessing your documents, desktop files, iCloud Drive and external drives. In addition, it provides increased security through a system volume dedicated to the operating system and the T2 security chip of new Macs.

However, Reed still does not believe it goes far enough. He told me that Gatekeeper still does not perform signature verification of non-quarantined applications at launch, which means that a malicious actor could tamper with a legitimate application and that it would still be allowed to run on MacOS.

Reed also thinks that the nature of sandboxing on MacOS limits antivirus software, at least if you download them from the App Store.

"By default, for example, [an antivirus app] can not access most files on the hard drive. Even if you grant access to the entire hard drive, many of these files can not be removed by an App Store application. This means that the antivirus of the App Store will have less chance of detecting all the threats, but also less of being able to remove all the threats. "

Where is the weakest link?

What about the current criticism that antivirus applications are putting unnecessary pressure on Macs, slowing them down and adding unwanted bloatware? McElhearn believes this concern is exaggerated.

"A decade or more ago, the argument that antivirus software could slow down your Mac would probably have had some merit, in some cases," he says. "But modern Macs usually have a lot of resources (processing power, memory and disk speed) to allow antivirus software to protect you without affecting the speed of the Mac."

Reed, however, is not so scorning, the performance of antivirus applications calling a "plague" for Mac users.

"So many people still think Macs do not need antivirus software – if you convince them to install something, it's an immediate failure if performance suffers," he laments. If you want to install an antivirus application, you need to find one that is not only reliable, but fast. If your Mac slows down while your antivirus application is scanning, you'll soon run out of patience and risk putting yourself at risk.

There are other indications that we are often the weakest link. Reed says Apple's built-in protection systems do not detect Adware and Potentially Unwanted Programs (PUP), things it describes as "the most common threats" for today's Mac users .

If you're a victim of a malicious Mac program, he explains, it's less likely to be manipulated by a traditional virus and more because you are brought to install malicious software by masquerading for a reliable application, the Mac Defender is well known. example.

McElhearn, meanwhile, says it's not enough to rely solely on Apple's systems. For example, while Gatekeeper may block applications from third-party or unapproved developers, it can easily be bypassed by the user in a few clicks.

Although Gatekeeper gives you ample warning that ignoring your checks is a bad idea, it still allows you to do so with relative ease.

These two points are at the heart of the greatest vulnerability of Mac security: us. Humans are fallible creatures, open to manipulation or simple laziness.

It may be thought that an application has been unnecessarily signaled by Gatekeeper (or that the "dialog fatigue" allows it to function without thinking), thus inadvertently opening the door to malware. We can also see that the falsification of a trustworthy website is well done, which leads us to disclose our bank details to fraudsters and dissatisfied.

In such cases, neither the built-in security layers of your Mac nor the third-party antivirus applications can offer you 100% protection.

A multi-pronged approach

The obvious conclusion seems to be that you need to install antivirus software on your Mac (we have rounded out the best options for you). However, as noted above, some caveats are important and certainly not the only precaution.

In the end, the only antivirus software will never be enough. You must always tap a lot of common sense. Do not download apps from questionable sources does not cancel the gatekeeper's warnings; do not click email links from unknown senders and do not listen to suspicious websites that invite you to install Adobe Flash Player or any other application.

That said, an effective and fast antivirus application can prove to be a useful tool to protect your Mac because it helps to cover Gatekeeper, XProtect and other security measures in place on your Mac.

So, there you have it. You need to install antivirus software on your Mac, but make sure you find one that does not slow down your computer and back it up with much common sense. Do all this and you have a good chance of containing Mac malware.

Editor's recommendations