Needed measures to protect sensitive data

Use File Vault.

Protecting sensitive data is going to be an ongoing discussion, with ideas stemming from whether full disk encryption or perhaps avoiding your hard drive and storing files on external media is best.

Any additional encryption or protective measure you take for a file will have an impact on the system; however, in most cases this impact will be negligable.

If files you use are sensitive, then be sure to fully password-protect your system (use strong passwords), and ensure FileVault is enabled. In addition, ensure any external drive you use is fully encrypted, which can be done by formatting it to "Mac OS X Extended (Journaled) encrypted" in Disk Utility. When done, ensure the system has a sleep/screensaver password enabled, and you should be well-off to having your data secured with minimal impact on the system.

Apple's full-disk encryption rides above the storage device hardware, and below the operating system, so the type of storage you use should not matter one bit, and the encryption should be transparent to the operating system and programs you use. In the event of theft, however, without the proper password then all data on the drive will be garbled.

I suppose you are aware that Apple does not support secure erasure of Solid State Drives for many good reasons including the fact they cannot be truly erased. My suggestion would be when the time comes to pass your iMac along to another user you pop open the enclosure, yank out the SSD and place it in an external enclosure for use on the iMac's replacement. As for the old iMac, either replace the drive with a new blank drive or sell it as is without a drive.

1. Use Disk Utility to encrypt your sensitive files or folders. This is very secure. How to create a password-protected (encrypted) disk image
2. Before you sell your Mac, use disk utility to securely erase your HD. Securely wipe your hard drive | Macworld

If the new iMac is physically safe during your use, for example it is in a location where others do not have access to the physical computer then you may not need FDE (Full Disk Encryption) with File Vault. In this case before the iMac was sold I would simply remove the drive and replace with a new one before selling. The cost of a new drive is relativly small and in 1 to 2 years will be even less expensive. Not selling the drive is the only way to ensure you will not have any data leakage due to sector sparing by the drives internal firmware (the drive will disable access to certain locations if read errors are identified and you will not be able to erase them in the future). I concur with Joe just pull the drive before selling.

bostonpops wrote:

…before the iMac was sold I would simply remove the drive and replace with a new one before selling.

There's no simple way to open up a new iMac. Thus, removing and raplacing the SSD/HD is beyond the average user's ability.

Baltwo, I completely agree with you about the iMac's are not easily serviceable. However my point is if security is paramount, spending $150 to have a technician replace the drive is the safest option to security of any drive. If this is to much then security is not the most important issue.

I only balked about your use of the word simple. Additionally, using DU's Security Options and choosing to write over the data once, 7 times, or 35 times should do the job wanted.