Hard Disk Security Printers, multifunction printers, and copiers

Hard Disk Security for Printers, MFPs, and Copiers What Resellers need to know to advise their customers. Hard disk security Risks, safeguards, and solutions

It’s common knowledge that computers store information on hard disk drives. What’s not as well known is that some printers and most multifunction printers (MFPs) and copiers also contain hard disk drives that record and store data. Residual data that may remain on the disk after printing, copying, etc. could pose a risk.

Your customers’ data at risk Printer, MFP and copier hard disks How to tell if your printer or MFP has Recent reports on the CBS Evening News and Digital information is transmitted to a printing a hard disk drive? 60 Minutes demonstrated the security risks to device through a computer, over a network, by data stored on MFP hard disk drives. In their scanning, or through a telephone line. Most of First, go to www.xerox.com/security reports they recovered dozens of pages worth the time this data is stored on a hard disk drive and click on the Data Protection: Image of confidential information stored on MFPs, so the device can print quickly and multitask— Overwrite, Encryption and Disk Removal warehoused in several used equipment facilities. provide more than one function (print/copy/ link to download the PDF. This document scan) at the same time. includes a list of Xerox products, indicates The purpose of this document is to help whether a hard disk is standard or Xerox Resellers become experts on hard disk optional, and which disk security features security. Understanding the potential risks are included. and safeguards—and the advantages Xerox products provide—will help position you as a If the hard disk for your product is valued consultant for your customers. optional, there are two easy ways to find out if your specific model has a hard disk drive. From the printer or MFP’s control panel, locate and print the page that lists the device’s configuration information. Locate the entry for Hard Disk or Image Disk, as it’s sometimes referred to. An alternative if your device is networked, is to connect to its built-in web server by typing its network IP address into your web browser. Once connected, click on the Properties link or tab and review the hardware specs. Look for information on a Hard Disk or Image Disk.

1 Hard disk security How your customers can Data encryption Security safeguards to look for protect their data In addition, most Xerox products equipped with when buying a new printer or MFP From the introduction of our first digital disk drives also include our data encryption □□Hard disk drive image overwrite with a products, Xerox recognized the potential feature. When enabled, it encrypts all stored DoD-approved three-pass algorithm security risks of stored data. The robust data with a state-of-the-art AES 128-bit □□Hard disk drive data encryption with an safeguards built into many of our products like encryption algorithm. AES encryption algorithm Disk Image Overwrite and Data Encryption, ensure data security from installation and setup, Safeguards for disposition □□Hard disk removal option through the productive life of the product, to its When a printer, MFP, or copier reaches its end □□Network security support for SSL, IPsec, eventual recycling or disposition. of life, it’s ready to trade-in, recycle, donate, or and SNMPv3 dispose. But how can your customers be assured Disk Image Overwrite any residual intellectual or confidential property □□Device authentication to control, manage, and track device access The Disk Image Overwrite feature “scrubs” on the hard drive isn’t at risk? Here’s a simple the disk drive in accordance with stringent process your customers should follow to protect □□Secure fax specifications established by the US their data for Xerox products: □□Secure print feature Department of Defense (DoD). This option 1. Determine whether the printer, MFP, or □□Customer security alert process became a standard feature on nearly every copier being retired is equipped with a product in the Office portfolio in 2006. hard disk. □□Secure product disposition process The Disk Image Overwrite feature can be 2. If the Xerox product is equipped with a customized to remove all data from the disk hard disk, enable the Disk Image Overwrite Product/feature availability according to customer needs: function and “scrub” the disk. A comprehensive list of Xerox products and their available security features is provided • Immediate—automatic data overwrite as 3. If the product doesn’t include the Disk in the Data Protection: Image Overwrite, soon as printing is complete. Image Overwrite function, customers may Encryption and Disk Removal document. • Scheduled—automatic, daily data overwrite. be able to use a third party software to Download the PDF at overwrite the disk. They can also arrange www.xerox.com/security • On Demand—executed as needed, removal of the hard disk by Xerox, enlist your prior to disk removal, or for end-of-life help, or remove it themselves. device disposition. 4. Xerox provides several venues for the Hard Disk Removal Program disposition of used equipment including our Xerox also established a hard disk removal Trade-In Program, product recycling, and program for any Xerox product at ready for donation referrals for equipment with some disposition. A Xerox technician will remove remaining usable life. It is in the customer’s the disk and leave it with the customer. This best interest to ensure they have overwritten program provides customers physical control of or removed the hard disk prior to the product the disk and provides a secure solution for the leaving their facility. While Xerox will make minority of products without the Disk Image every reasonable effort to safeguard any Overwrite feature. Contact Xerox Customer residual data that remains on a product Support for more information on fees and provided for trade-in or recycling, we can not availability in your geography. guarantee its safety. The best practice is for the customer to remove any confidential data prior to disposition. For more information on product security see www.xerox.com/security

Hard disk security 2 Hard disk security risks Additional Xerox product security features

Beyond hard disk security Embedded fax Additional data vulnerability In addition to data storage protection, Xerox Unprotected fax connections in MFPs can be With all of the attention on digital information products provide robust safeguards for data as a back door into the network. Xerox was the security, another critical point of potential it’s being used. first manufacturer to offer Common Criteria- security leaks may go unnoticed: paper certified products with fax internally separated documents. Paper documents are generally Network security from other network functions. unsecured or locked in file cabinets. Often years Xerox products are compatible with multiple worth of proprietary data is kept on file under network security protocols. The Secure Sockets Securing the output tray minimal security in rows of file cabinets. Layer (SSL) protocol is used for secure job On a shared device in an office environment the Xerox offers powerful scanning solutions communication and reporting. The IPsec output tray of a printer or MFP can be a security that can automate the conversion of paper protocol protects network channels for DNS, risk. Our Secure Print feature enables a user documents into secure, searchable digital DHCP, IPP, lpr, and Port 9100 printing. SNMPv3 to send a job to print, where it will wait in the archives. Storing your proprietary records is used for encrypted device management. queue, until they enter a password (PIN) at the digitally is not only more secure than paper device to release the job. This feature is ideal for documents, it’s also more efficient and less Securing device use printing confidential documents securely on a expensive. Xerox scanning solutions provide an Firewall—a built-in firewall manages all workgroup device. impressive ROI. They often pay for themselves communication access to authorized users. in as little as six months. Robust security made easy Authentication—network authentication For more information on Scan to PC Desktop®, It’s one thing to provide stringent security validates user names and/or passwords prior to ScanFlowStore®, and DocuShare® Express visit features and safeguards for MFPs and printers. device use. It can also be configured to allow www.xerox.com/office/software-solutions But if they aren’t easy to set-up and use, or deny access to specific device functions such company data may continue to be at risk. as scan, email, or fax functions. For additional Xerox makes system administration and security, the device may be configured to device management easy. Our free software, require log in by IT staff in order to change CentreWare® Web, allows IT staff access to access or other configuration settings. device configuration, control, and management Security vigilance and alerts Internal audit log—Xerox MFPs and many of over the network through an easy-to-use Xerox is the only printer manufacturer our printers can maintain audit logs to track browser-based interface. with an active security patch program. activity by document, user, and function. We consistently monitor for new Ports and services—Unused ports and services vulnerabilities on our MFPs, just as can be shut off to prevent unauthorized use or operating system software developers malicious access. track new viruses that could threaten their software. Xerox security bulletins are posted on www.xerox.com/security. Customers can sign up for the RSS feed to be alerted immediately when a new bulletin or downloadable patch is posted.

For more information on Xerox security or to subscribe to our RSS security feed visit www.xerox.com/security

© 2010 Xerox Corporation. All rights reserved. XEROX®, XEROX® and Design®, CentreWare®, Scan to PC Desktop®, and DocuShare® are trademarks of Xerox Corporation in the United States and/or other countries. Xerox Canada Ltd. is a licensee of all Xerox trademarks. ScanFlowStore® is a registered trademark of Nuance Communications, Inc. or its affiliates in the United States and/or other countries. SECWP-01UA