Additionally if you're really paranoid

- Use LittleSnitch or similar to block traffic per process

- Use ad blockers in your browser and make sure Flash, Java and Silverlight are off by default

- Do update regularly

If you care about security in case your device gets stolen

- Use full disk encryption

- Do /not/ forget to also set a firmware password