Well, my number one defense has always been (regardless of operating system) to (a) not visit shady websites, (b) adblock, and (c) don't open email attachments from untrusted senders.<p>I've been using the free version of Sophos (<a href="http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition.aspx" rel="nofollow">http://www.sophos.com/en-us/products/free-tools/sophos-antiv...</a>) on my MacBook for a year or two now, and haven't seen any problems yet. I'm not sure if that means it works, or if I just haven't caught anything yet.
1) Run the latest version of the OS and browsers, and check for updates often.<p>2) Run as a "normal" user account--not an admin.<p>3) Disable all auto-opening of so-called "safe" files.<p>4) Disable Java browser plugin entirely.<p>5) Configure browser to not load Flash or other plugin content unless I click to authorize it. Might require an extension like ClickToFlash in some browsers.<p>6) Be cautious. Stay away from sketchy sites and don't open emails and/or attachments that seem random, unexpected, or suspicious.
Same as with any platform:<p>1) You account is regular user, not one with elevated permissions<p>2) Keep system up to date<p>3) Use the most secure browser for the platform<p>4) Don't use Java or Flash on such browser (or plugins/extensions, as a matter of fact)<p>5) Know what you visit and use common sense<p>Never had a virus/spyware on Linux, OS X or Windows.
Something I've always wondered - if you use Parallels or VMWare to visit questionably risky sites in a VM, and only used that VM for that usage, wouldn't that essentially isolate the rest of your machine from exposure from any malware?
My strategy is don't do idiot stuff like:<p>- Not keeping your OS and the software you use up to date<p>- Open/run files that you are not fully aware of where it came from or from an idiot/spammy person<p>With this strategy I never got any virus at all... Not even in Windows XP!