Information is an essential resource for all businesses today and is the key to growth and success. However, companies have to ensure that the information held on their IT systems is secure. 

Multifunctional devices: Are your MFPs secure on the network?

by Sara White

Security is one of the big issues to consider when buying an MFP, but a lack of awareness about potential problems may be leaving some companies open to attack.

Productivity is one of the main benefits of moving to a multifunctional printer copier (MFP) environment, consolidating a mixed fleet of stand-alone printers, copiers, scanners and faxes. This provides workgroups with a mix of functionality on a single device. But, before deciding to move to a multifunctional print environment, there are a number of issues to consider and top of the list should be security.

Once a device is attached to the network, you need to think about potential security threats. The main factors to consider are document security; security on the device, hard drive and network; securing print jobs by implementing authorised user protocols with swipe cards and pin codes; document encryption; and image overwriting. The level of security required depends on the sector, with legal, medical and HR requiring high levels of security and confidentiality for documents.

There are a number of basic security vulnerabilities to consider when you install a multifunctional device. Make sure that the printer is not susceptible to viruses disguised as print files, the web server used to manage the MFP is not vulnerable to attack and that emails sent from the MFP can be tracked back to the originator. If you plan to use the MFP as a fax hub, check that the phone line attached to your MFP for fax access cannot be used to access the network. 

Latent threat

While networked multifunctional printers and copiers provide new ways for companies to improve customer relations, cut spending and streamline business processes, they also expose organisations to security threats.

"Crucial company assets and confidential data are at stake as even printers can get hijacked," said Andrea Pirotti, ENISA

A survey by the EU information security agency (ENISA) found that the majority of respondents were unaware of the threat to networks from printers and MFP devices, and only 53 per cent of companies use authentication for printing, such as smart cards, biometric identification or PIN codes. 

ENISA executive director Andrea Pirotti said: "Businesses in Europe must realise that printing and copying is not as safe as when Gutenberg started printing 540 years ago. Crucial company assets and confidential data are at stake as even printers can get hijacked."

ENISA advises organisations to control access to printers by setting a clear policy on who can print, scan and copy documents; classify documents to differentiate between internal, public, confidential and highly-confidential documents; and authenticate printing devices with smart cards, biometric identification or PIN codes. It also recommends that printing/copying devices should be located in controlled or secure areas to avoid unauthorised access, particularly from off-site visitors.

The ENISA report warns that printing devices can be used as a platform for denial of service attacks or other malicious activities. Default administrative settings such as FTP, SNMP and HTTP are open to most print devices; this means that hackers can use printing devices to penetrate the network, set themselves up as an administrator and replay print jobs stored on the MFP. www.enisa.europa.eu/doc/pdf/ENISA_secure_print ing.pdf 

Scanning

As the workflow in the office changes with the increasing use of scanning and electronic documentation, the move away from reliance on paper highlights potential weaknesses in the print environment.

By the end of 2011, analysts at Gartner predict that scanning will become a key functionality on MFPs, representing more than 15 per cent of MFP activity compared with around five per cent today. Changing business processes mean that more companies are scanning their paper-based information through multifunctional printers/copiers and then emailing attachments or saving them directly to folders or document management systems via the network.

Gartner points to a number of scanning benefits including ‘better control of business information, easier management of content and improvements in routine paper-based business processes'. It also points to lower service costs, particularly as the latest MFPs often provide alerts about preventative maintenance cycles, supply levels and repeat failures, and improved standards of security across the MFP fleet and extended network.

Digital data

Unlike a traditional copier, an MFP can be shared on a network and manages vast quantities of digital data. However, these advanced features have a downside as image data from any of the functions - scanning, printing, copying, faxing - is stored on memory devices such as RAM, flash ROM and hard disk drives. Non-volatile memory is at risk as these component parts can be stolen but still retain residual data from earlier use. In addition, connecting an MFP to a network raises the risk of hacker penetration to steal data from any memory or to mount a denial of service attack.

The evolution of the analogue copier to a digital hardware beast has raised the security stakes. Konica Minolta group product manager Wayne Snell added: "End-users are waking up to the reality that the hardware is not just a copier any more; there is RAM memory on the machine. People are asking about hardware - is it secure, is the hardware protected, can you move the device around the building and still keep the data confidential and safe?"

"For any company, the most expensive thing in the building is data; it has huge value for the company," said Sharp group product manager Tom Primett. "Security awareness is much better than it was 12 months ago and there is growing awareness about MFP security. With a network secured with a firewall, companies are relatively well protected." 

Cost concerns

When companies are considering a switch to multifunctional printers, there are concerns about the cost implications of setting up a robust security environment.

Xerox European product manager Peter Munday explained: "SMBs are concerned about the amount of support they would need for the security of MFPs. They are aware that there is an issue but are not sure about how they implement security without the hassle and high costs.

"People do not attribute MFPs to their PCs, but unlike printers, that are ultimately dumb machines, MFPs have a hard drive which should be encrypted. Users also have to consider who has access to the MFP. When storing documents on devices, you need to think of the different elements of protection. If someone walks into your building, they could get access to the hard drive. Now businesses, small and large, are being forced to protect themselves and their data because of all the regulations.

"We are trying to make people aware that behind all the technology, with a few clicks of the mouse, they can protect themselves easily. Every bit of sales collateral carries strong security messages and this message is going out to all our sales people." 

Staff training

Educating users about best practice is essential too, as although security issues are perceived as important, it can be difficult to pin down the best way to deal with them.

Ricoh product manager Bernard Cassidy said: "People are aware of the devices and their functionality, but are not so aware of the security implications. The MFP has changed totally in the past five years and it is on the network hub. An MFP is as powerful as a PC or laptop; it is almost like a server. When you send an email from a PC it is sent through the email server; in the same way, when you scan from an MFP you need the same security. 

"Knowledge is building about what end-users can use MFPs for but they need to counterbalance this with how they actually use devices. When organisations first install multifunctionals, users are not sure where they are printing to and where they are scanning to. They want to know how they can print confidentially when they are used to a desktop printer. User education is an important part of the security message." 

Two-step security

Setting up machines to meet standard security levels without IT support can seem daunting. However, there are certain steps you can take at the initial installation which are straightforward and use standard security tools without forking out extra money on security features.

Munday said: "To get the basics out of their security, they can implement the Xerox security features without the need for IT support. If you do a lot of scan to email, for example, you can encrypt PDFs when scanning documents. For secure printing, you can set this up from the print driver. There are a number of features that do not need IT support."

Scan to email

With the ever-increasing use of email and the popularity of scan to email, users need to be aware of potential risks.

"With email you need to check whether anyone has open access to use the email. You can set up authentication on the device so that users need to log on with the right credentials. If the trust is there, users can encrypt email data if it is sent outside the network and you can limit access to the worldwide web," said Munday.

Xerox product business manager Myriam Stafford added: "There is embedded security on the devices such as print protocols and security around sending faxes. If you have LDAP, then an email going through the machine has to go through the company server. Because we are confident about our security, Xerox products are certified with Common Criteria Certification. This gives businesses confidence. When we design the products, security is a very important issue."

Security features on Xerox MFPs include SSL (Secure Sockets Layer) and IPSec (IP security) protocols, while LDAP (Lightweight Directory Access Protocol), an internet protocol that email and other applications uses to look up information from a server, adds to security.  

User authentication

User access codes and swipe cards are being used increasingly to manage output.

"Although we are not seeing much demand for biometric access, when you look at the usage of machines there are already a lot of security systems in place. For example, companies can use their existing swipe cards - it is more about using systems that are already in place," said Cassidy.

"Organisations must identify the specific risks associated with networked devices and act to secure their interests. Authentication, from password to smartcard, copy protection and data overwrite features and, in the future, biometric access, will have an increasingly significant part to play in protecting the enterprise." 

System security

Advanced security features are an integral part of the latest Ricoh Aficio MP 4000/5000 design. Access to system functions can be protected with Windows/LDAP/Kerberos authentication and temporary data stored on the hard drive can be protected with the optional DataOverwriteSecurity system, which overwrites latent copy, print, scan, fax and document server data.

The Sharp Data Security Kit is now in its seventh generation and features full data encryption on the hard drive, auto overwrite of data and various print control and user authentication features. Available as an option on MFPs, there are signs that more security features are being built in as standard features. For example, the new Sharp 2600 and 3100 colour MFPs have auto data erase as standard.

"Secure print release and encrypted PDFs are all part of a core of very powerful data security features," said Primett. "All our future machines will be coming with more standard built-in security features."

User authentication at network level is a standard feature on Konica Minolta's range, giving administrators the power to control up to 1,000 user accounts by defining access to functionality, restricting colour and mono output, scanning and email features, and monitoring usage profiles. The MFPs are certified to ISO 15408 Common Criteria Certification and all models have the same security as standard. In addition, an optional data encryption module can rewrite data up to seven times for total data security.

Konica Minolta has taken user authentication one step further with its finger vein authentication pad on devices and has extended this offering with the Authentication Manager software application, which gives administrators network-wide control of users and the ability to control access through the IT admin PC. For example, when a new member of staff joins a department or company, this speeds up the process of registering the user's personal ID and providing them with access to designated machines from a remote admin point.

Until recently Konica Minolta concentrated on developing high-end colour MFPs, now the focus is moving towards a refresh of the mono range with security at the forefront.

Konica Minolta marketing manager Wayne Snell said: "The black and white range had not been replenished for a few years and the feature mix between colour and mono was limited. To redress the balance, we have launched three mid volume models - 36/42/50ppm - based on the Infoline design used for the colour range, with strong security features as standard, the first stage in a major refresh of the range."

The new Konica Minolta bizhub 361, 421 and 501 comply with the latest international security standard ISO 15408 EAL3 and are equipped with a security package to keep critical information safe, preventing unauthorised access to networks or tampering with confidential information. Options include biometric authentication finger vein scanners and non-contact IC cards.

With data security continuing to hit the headlines, it is certainly an important issue to consider when putting multifunctional devices into your office print environment. 

Checklist: protecting MFPs on the network

• Protect documents with secure settings
• Ensure the MFP is not susceptible to viruses disguised as print files
• Encrypt print data through SSL (Secure Socket Layer) via IPP (Internet Printing Protocol)
• Secure documents with password-protected printing to prevent unauthorised viewing or physical removal of documents at MFP
• Secure document release - delete a print job from the server if it is not collected after a specified time
• Control unauthorised copying
• Secure print jobs by controlling user access with swipe cards and pin codes
• User authentication: Windows, LDAP, user access codes
• External device authentication: ID/swipe cards or PIN codes
• Enforce administrator authentication
• Restrict manual email address entry to make sure documents can only be transmitted to authorised destinations
• Encrypt scanned data using SSL technology to counter hacking attacks
• Control access to the document server and set user access rights to protect stored information
• Encrypt settings using SSL via SNMP v3 to  
  counter theft
• Data overwrite - secure the Hard Disk Drive and protect confidential data by overwriting print, copy  
  and scan data
• Encrypt the address book to prevent unauthorised access
• Limit unauthorised network access
• Network protocol restriction: system administrators can disable unnecessary protocols
• IP filtering: authorised connections to the device can be restricted by selected IP addresses
• Secure wireless connectivity using authentication
• Protect phone/fax line access
• Secure the audit trail by tracking print, copy, scan and fax activities of users
• Track network activity
• Make regular backups to avoid loss of archived data
• Train your workforce to print and scan safely

Safe disposal

While environmental considerations may be the over-riding issue when disposing of old, redundant hardware, data security is equally important.

"Many companies are totally unaware of what is on the machine in terms of the data stored on the hard disk of the MFP," said Munday.

"You need to consider the disposal carefully; we can even give the customer the hard drive to keep if they are worried about disposal."

Primett feels that the dealer channel offers an advantage at the disposal stage, particularly as the majority of machines are leased.

"If you have a service contract, then you have regular services and there is a structured replacement programme," he said. "The disposal issue comes with smaller machines that you buy through the distribution channel and are never serviced. The question to ask is what happens to these machines at the end of life?"

The WEEE directive has also changed the responsibility for machine disposal. 

For the latest specifications and reviews of current MFD products and related articles, select Multifunctional Devices category reports and data.