Much has been made in the media about high-profile losses of electronic data in public places. Lost laptops or USB sticks, containing sensitive data, routinely draw attention to inadequate security policies as well as the unreliability of human behaviour. While many organisations have taken steps to limit information loss via computers and hand-held devices, a more hidden security risk is often overlooked: the printing environment.
Information is every organisation’s key asset, and security is essential to the office – for documents and for any device connected to the network. Employees print, fax, copy, scan and send a company’s most important information across the enterprise network every day. Being part of the office environment for decades, printers have become so familiar that hardly anybody gives a second thought about using them. Yet, modern printers have become sophisticated devices. Consider today’s multifunction printers (MFPs), for example, which offer more data-handling features than ever, including hard drives for storing documents and scan-to-e-mail services that make them as sophisticated as many desktop PCs. Enterprises routinely attach MFPs to networks, giving them all the flexibility, and security vulnerability, of any computer on a network. Yet despite the vital role that networked printing and imaging resources play in many organisations, enterprises often leave them out of their security policies. Security is not optional. Customer privacy concerns and government security regulations are changing the way many industries conduct business today.
Safeguarding information
Internal threats are a concern. The threat from disgruntled employees or even from those who may wish to use sensitive data to their advantage is very real, as is the threat from simple, old-fashioned human error. How many times have you printed a confidential document or e-mail only to be distracted by a phone call or colleague and left your print-out sitting in the paper tray? For security, not to mention compliance reasons, enterprises need to identify who uses each MFP and control how each person employs it.
Security can also be breached externally. Information such as stored documents, scanned data or print data can be intercepted via Local Area Networks (LAN) or over the Internet via Wide Area Networks (WAN). In a worst case scenario, a user from the outside could obtain confidential information, unleash a Denial of Service (DOS) attack, or even gain access to a company’s network through the analogue fax line, meaning communications could be intercepted or the network breached.
Fortunately, the latest MFPs can be integrated into either a highly complex or a simpler security strategy. This scalable approach takes into account the size and nature of the business. For example, small businesses may be able to safeguard the printing environment with just a few adjustments to working practices. Financial or healthcare businesses may require a higher level of security, and companies that specialise in law, research and development organisations or the military would need the top level of security.
MFP security tips
Companies differ widely in their approaches to MFP security. For example, a leading defence and security technology company is able to delay printing until the person who sent the document is physically by the printer to collect it. Employees have a radio-frequency identification (RFID) tag meaning that anyone collecting copied, scanned or securely printed documents can be identified at the machine.
Below is a list of tips to help businesses of any size begin incorporating MFPs into their security policies:
- * Purchase the right device. Always check whether security features are built into the product as standard – and remember to use them
- * Before disposing of or trading in old equipment, check the manufacturer’s product documentation to understand the necessary steps required to wipe or remove the hard disk of the machine, if required
- * Paper is one of the least secure ways to manage information. Look at methods to scan and digitally secure information into a track-able and/or securable format. For fax users, consider converting incoming faxes into electronic formats. That will ensure no confidential faxes are left lying on the machine
- * Devices that are hidden from view (i.e. in a copy room with nobody near the machine) increase the opportunity for employees to breach security, so think about user authentication to gain access and use that equipment
- * Work with a vendor to identify specific security needs. The best vendors will work directly with a customer to identify where their information resides, track how it is transferred and ascertain the greatest area of risk
Once a security strategy is in place, CIOs can work with their provider to ensure that they keep up with developments. Encryption levels, for example, are constantly developing. Whereas only a few years ago 128-bit level of protection was considered solid, that level has now risen to 256-bit, with 512-bit on the way. Similarly, other developments such as Smart Card and bio-metric readers for authentication are quickly becoming the norm as the technology develops to keep pace with an ever-shifting threat.
Network and data security are one of the many challenges that businesses face on a daily basis. And because today’s MFPs serve as business-critical network devices that receive and send important data through a variety of functions, ensuring comprehensive security is paramount.
An MFP’s entire system, along with any device management software on the network, must be evaluated and certified in order for IT and all the employees of an organisation to be certain that their documents and network are safe and secure from external as well as internal security breaches.
In that respect, not all MFP’s are equal. Therefore, a comprehensive approach, based on foundational, functional, advanced and usable security, is critical to safeguarding the information assets of today’s businesses.
By making MFPs part of an holistic approach to corporate data protection, businesses can neutralise both internal and external threats and avoid the pain of key information loss.
Martin Boyle is general manager for Ireland & Scotland with Xerox.
Ltd
