Prediction: Apple will recommend security software

Correction, 5:05 p.m. PDT May 12: This story initially mischaracterized iBotnet. It is a Trojan horse.

As an analyst, it is my job to follow the industry, internalize trends, and then use this information to make predictions. OK, here goes: Within the next 18 months, Apple will begin recommending that Macintosh users install Internet security software on all systems.

Now I realize that this statement is blasphemy to dedicated Mac users, so let me start with a few qualifying statements. I am not comparing Mac OS with Windows, or Apple with Microsoft, and my prediction should not be interpreted as an attack on Apple, its developers, or the security of its code.

The truth is that all sophisticated software contains vulnerabilities and Mac-based malicious code is nothing new. The recent iBotnet Trojan is just one example. My hunch is that Mac attacks will increase precipitously over the next year, driving Apple to drop its Windows security insults and partner with the likes of Sophos, Symantec, and Trend Micro. Here are a few reasons why:

1. Macs users are a lucrative target. Mac owners tend to affluent and Net savvy. To the bad guys, this means identities to steal and broadband connections to exploit.

2. Organized cybercrime is diversifying. Cybercriminals tend to work as a loose confederation with each group specializing in a certain task. There are malware writers, botnet owners, mules, etc. Some entrepreneurial bad guy is bound to see a green field market in Mac cybercrime, recruit Mac hackers, develop expertise, and market these capabilities. If there is an equivalent of a cybercrime venture capital firm, they are probably looking at business plans like this already.

3. Macs are growing in the enterprise. In many large firms, Macs make up about 5 percent of endpoints. If the bad guys infect these systems, they can troll the network looking for other vulnerabilities and juicy data at will.

4. Macs are fairly easy to hack. In March as part of a contest, security expert Charlie Miller won $5,000 for exploiting a hole in Safari in about 10 seconds. If he can do this in 10 seconds, how many techies can do it in an hour? This is a frightening thought to me.

The company and Macintosh users should not fight this trend--doing so would only increase risk and help cybercriminals. Realize that most enterprises that already use Macs do so with the caveat that these systems must run security software. The goal is reducing risk, not singling out Mac users. There is a lesson to be learned here.

Senior citizens often hark back to a time when people left their house unlocked and left their car keys in the ignition. Now they lock their doors for safety. Apple, along with Mac users, should prepare for a similar transition. Given the state of cybersecurity today, pragmatism should trump romanticism.