Multi-Function printers (MFP) can scan, copy, fax and print, now they can also send email, host web-based administrative pages, and even tell you when the ink is low. While doing all that, MFP’s can store image files on on-board hard drives which can contain sensitive personal identifiable information (PII). Compliance with standards/laws as PCI-DSS, HIPAA, Sarbanes Oxley, or state privacy laws, etc. may force MFP’s to be secured.

SecureState suggests some general questions to ask when trying to understand the criticality of these systems and to show some due diligence:

• Are these devices accessible on the network? If so, how is “Administrative” access controlled?
• How long are the image files retained on these systems?
• If the device is compromised, can the attackers actually capture sensitive data?
• If a hard drive fails, does the replacement process follow the normal standard for securely destroying the disk?
• What are some of the services enabled on these devices? Is there an administrative website, SNMP client, or SMTP server? How about the accounts and passwords of the administrative websites; are they set to default accounts and passwords?

SecureState says If you answered “No” or “I don’t know” to these questions, some of the issues more than likely need to be addressed.

Just like any network appliance, MFP’s and other print devices are small computers that have memory, storage, processors, an operating system, full-fledged web servers and are connected to the network. These devices can hold sensitive information. Before that old printer is finally decommissioned, make sure that the hard drive is securely wiped. If the existing device does not have advanced security options such as disk encryption or immediately overwriting data, the hard drive should be removed and securely wiped or destroyed separately before being decommissioned.

Recommended best practices for multifunction printers and copiers with disk drives:

• Review vendor security configuration guides
• Develop a standard configuration and check regularly
• Enable immediate image overwrite and schedule regular off-hours overwrite (DoD 3 pass)
• Enable encryption (minimum 128-bit AES)
• If network-enabled, use network encryption and secure protocols such as IPSec, SSL, SNMPv3
• Regularly review vendor security bulletins
• Enable authentication and authorization (if possible, use network credentials)
• Change admin password regularly
• Enable audit log and review periodically
• Treat network-enabled devices like any other computer on the network
• Purchase a device which has an EAL2 Common Criteria certification

If the device processes restricted data, it MUST have encryption and image overwrite. For devices which process restricted data but do not have the necessary security features:

• If possible, buy the necessary security modules and enable the features.
• If security features cannot be purchased or enabled, replace the device as soon as is appropriate and have the hard drive removed and destroyed.

By Vendor

Xerox – Newer Xerox (XRX) devices come with security features that often have to be turned on. See the Xerox Information Security Guides for more info.

Ricoh -  Security options for Ricoh’s (7752) have to be purchased separately. See the Ricoh Common Security Features Guide (PDF) for more info.

Canon – Security options for Canon (CAJ) devices have to be purchased separately. See Canon Security Solutions for iR and iP Devices (PDF) for more info.

HP – All HP (HPQ) multifunction printers have hard drives.

• There is a disk-wipe utility for all MFPs.
• This utility is not installed by default and has to be downloaded from HP.COM. The utility is protected by an admin account and password.
• The utility can be configured to do a printer disk wipe daily.
• Some non-MFP HP printers may have hard drives. These printers will have an occupied EIO card (with resident hard drive) in the slot next to the network card. This EIO card should be physically evident by viewing the printer external case.
• Third party disk wipe utility cannot be used against HP MFP hard drives without removing the drive from the card – which is likely to cause damage to the card and, possibly, the hard drive.
• Non-MFPs with hard drives are somewhat rare and may be purchased for special purposes.
• Non-MFPs with hard drives and network connections can be remotely disk wiped. Non-MFPs with a hard drive but without a network connection need to be handled by HP.
• For leased HP printers, the agreements should include a defective media retention provision that permits the lessor to keep the hard drive before releasing the printer.
• The WebJetAdmin tool, downloadable from HP.COM, can scan a network subnet and identify HP printers (and non-HP printers if the tool has a MIB for the non-HP printer).

rb-

I don't worry about data security

All they focused on was the costs, they did not ask any of the due diligence questions pointed out in this post. They had no plans on having the HDD’s on the 12 networked copy/scan/print Ricoh’s wiped. It is pretty clear that all the info on the HDD’s was bound for South America or else were on the secondary market, was I wrote about here.

Related articles

• Corporate Espionage’s New Friend: Embedded Web Servers (informationweek.com)
• Electronic Security of Business Information on Your Network (bdemarest.wordpress.com)
• Business insurance news: Mobile devices present computer security risk (premierlinedirect.co.uk)