The question does already contain a goodbasic set of good practices.
I would like to add here 2 points:
Choose a safe file system
Install your running MacOS X on a Case sensitive, Journaled File system.
Such a File system won't tolerate any application wich confuse a file
named /tmp/w0rm.log and anothrewith another one named /tmp/W0rm.log.
Then any poorly writen application and many crapwares won't be able
to either install or will run in the wall.
With such a sensitive file system, you will avoid and detect most of
these dangerous applications.
Control your firewall
By command your firewall I mean this is a defense weapon. Then it isn't just a magic feature you have to turn on and all the bad direct attacks will be blocked.
Read your firewall logfile which is something like:
/var/log/ipfw.log or /var/log/appfirewall.log
and decide of the adapted corrective action depending on what
kind of prey you find playing there:
- analyse what are all these unknown connexions to a server you don't even know the name;
- detect and block unwanted port scans;
- detect and close unwanted services;
- detect and close any remote control of your Mac;
- detect uninvited neighbours on your wireless network or from the other end of the Internet (which is just 2 s away at the slow
pingpace).