Minimally: get and keep backups. Preferably keep some backups disconnected.
Even better: Disable or plug-in block Oracle Java and Adobe Flash Player, or remove those packages entirely. Disable opening "safe" downloads in Safari. Shut off remote image loads in Mail. Don't trust links in messages you've received, even if you think you know the sender.
Some considerations to factor into the discussion....
- Anti-virus tools are themselves ripe targets for attacks and more than a few of them have had spectacular breaches, and have opened up more than a few security holes. here's an AVG bug from last month. And here are the results of a researcher looking at Sophos security.
- The Symantec Vice President indicated that AV was probably ~45% effective; and was "dead", to use his word.
- False positives. Such as this case.
- The approaches used by AV including signatures are trivially bypassed with obfuscating compilers. Some of the recent macro malware attacks that had been caught learned to avoid AV scans by delaying their processing until document close, when the AV tools had stopped watching.
- The AV tools have themselves caused crashes and hangs.
- Phishing is on the rise, very effective, and AV does little or nothing for these attacks. Grab somebody's AppleID or other credentials via spoofed site, and it's off to the races...
To establish layers of protection where that's required, folks will want to establish perimeters within their networks, establish and maintain backup and recovery strategies and particular strategies locating the data off the local network and disconnected from the systems involved (to avoid deletion by an attacker), and will want to establish outbound firewall blocks and the related alerts (most folks are not running a mail server, so why would there be mail server ports active? block and flag those at the firewall), and distributed monitoring — what's called endpoint security — to scan for network and system anomalies and for exfiltration; for weird network traffic and for somebody copying your data off your network.
Unfortunately, adding additional layers of highly-privileged and deeply-integrated software onto a single box doesn't gain an advantage.
Remember too that OS X already has anti-virus and anti-malware tools, based on — for better and for worse — Gatekeeper and Xprotect. Keeping those enabled to App Store and Developer ID applications isn't a panacea, but does reduce the exposure to more than a little dreck.
AV? It's been a knee-jerk automatically good always have it blanket recommendation. But does it really work? Not very well, unfortunately. Increasingly, if at all. The malware is getting better at avoiding the scans, too. And it can cause stability problems, false positives, and some can reportedly upload and sell your data and your web browsing history.
I wish this mess were better, but add-on AV doesn't look like a net benefit to me. Others might make a different decision here, of course. But in any case, keep your backups current, and plan as if you expect to get breached.
