I recently read this article titled A more secure OSX before Leopard, aimed at hardening the default installation. The important thing to me about this article is that each approach taken to harden OSX Leopard is what Windows Vista employs out-of-the-box.
Operate as a non-root user:
Windows Vista by default employs User Account Control (UAC) to address this issue. In past versions of Windows client, the default user has administrative privileges, but in Vista, even administrator is not a true administrator without user elevation for certain system operations. The process for creating a new non-root user in OSX is not without pain, but a step in the right direction. And, what do you know, the new non-root user is prompted for root credentials whenever certain system tasks are attempted, much like the default Vista behavior.
Enable the network firewall:
If you can’t find the firewall configuration in OSX, that’s because it is non-intuitively placed in the sharing preference pane. The author points out that even if you enable all of the options, you still have some work to do using the command-line ipfw tool. Not consumer friendly. Apple has not innovated at all in this area, and the default firewall settings do not provide consumer-friendly insight to end users, but enabling the defaults is definitely a step in the out-of-box Vista direction.
User comments to the article provide other valuable information for making OSX more secure, so I encourage folks who aren’t booting their MacBook into Vista to take the steps to be more secure.
Windows Vista does do a good job of being secure out-of-the box, but looking forward, there is a lot of work ahead to improve/balance usability in the face of such security improvements.