Software Update: Software Update installs new Apple software, including Mac OS X updates and periodic Security Updates. These fix newly-discovered vulnerabilities in the BSD UNIX subsystem of Mac OS X and in Apple-specific components. Apple works with CERT and FIRST to discover new vulnerabilities, and it releases Security Updates quickly.

You can run Software Update manually (via the Apple menu), and you can schedule it to run at a particular time via the Software Update pane of System Preferences.

Desktop Macintosh computers in COSAM have the following line added to their system crontab file (/etc/crontab). This updates the computer at 2:01AM everyday.

1 2 * * * root /usr/sbin/softwareupdate -i -a; reboot now

Open Firmware Password Protection: Open Firmware password protection prevents an adversary from booting a computer from a volume other than the selected startup volume. With Open Firmware Password protection, other volumes can be chosen as startup devices by pressing the [option] key while rebooting your computer: after entering a password, the startup manager lets you choose a CD or other device. Open Firmware Password protection also prevents starting Mac OS X in single-user mode.

Desktop Macintosh computers in COSAM have Open Firmware Password protection enabled.

Security Pane of System Preferences: We check the following boxes by default:
• Require a password to wake this computer from sleep or screen saver
• Disable automatic login
• Require password to unlock each secure system preference

Additionally, lab computers have the following option checked:
• Log out after 90 minutes of inactivity

Fast User Switching: Fast User Switching adds the user menu extra to the right-corner of the menu bar, providing an easy method of accessing the Login Window if a user needs to step away from his or her computer without logging out or quitting applications.