Smart Technology In The Office Opens Back Doors
Aug 14, 2007 3:33 PM
Information is routed in huge amounts through networked printers, copiers and scanners every day, moving hard-copy data into information technology systems and putting digital data onto paper. And although most federal agencies have been working hard to secure their systems, little thought has been put into securing these devices, according to Government Computer News.
The potential problem of smart peripherals has developed gradually, as stand-alone scanners, faxes and copiers have been integrated into online printers. Not only are these peripherals privy to sensitive information, they often have their own IP addresses and can be vulnerable to network attacks.
Although access to a printer typically requires a user to already have network access, incoming devices such as scanners often have no access control. A malicious hacker, for instance, could serendipitously copy material as it crosses the memory of one of these devices or send forged documents from what might appear to be an official fax machine.
"In the past seven or eight years, the vast majority of these devices have become network-enabled," says Bill DeStefanis, director of product management at security appliance vendor eCopy. They went from being islands that presented little threat to the enterprise to being integral parts of the network. "It doesn't do just copying. In most organizations, it's a network printer device. Like any other technology, functionality was put forth first and the security was addressed later."
"The printers are becoming more capable in what they can do," Don Wright, director of standards at printer manufacturer Lexmark International, told Government Computer News. "They look like computers with the ability to spit out paper, and they are increasingly being linked to the network."
The good news is that the Institute of Electrical and Electronics Engineers (IEEE) is addressing the issue by creating security standards for printers, copiers and other hard-copy devices.
Wright, who also is chairman of the IEEE working group that is writing hard-copy device security standards, says the need for this work was highlighted by the National Institute of Standards and Technology (NIST).
"A couple of years ago, NIST put together a workshop to look at creating security checklists for off-the-shelf products," he says. "Most of it was about operating systems and PCs," but the need to address peripherals also was apparent. Out of this came the IEEE P2600 working group.
There had been some disjointed efforts to create security targets for these devices under the international Common Criteria scheme, but there were no broad industry standards for how they should be secured, according to Government Computer News.
"The printer industry came together to do that," Wright says. The working group is cooperating with the National Information Assurance Partnership, the U.S. government organization overseeing the Common Criteria standards, to develop protection profiles for the program in parallel with the industry standards. Both will define functionality and configuration requirements in four security environments. The IEEE standards will focus on commercial, nonmission-critical requirements.
While IEEE hammers outs the specifications, agencies can look to another standard to help secure devices -- the 2004 Homeland Security Presidential Directive 12 (HSPD-12).
HSPD-12 mandates the use of new smart identification cards "in gaining physical access to federally controlled facilities and logical access to federally controlled information systems," states the directive.
Using digital credentials to log on to a network through a PC equipped with a card reader is becoming common, especially in the military. The Defense Department already has issued more than 10 million of its Common Access Cards (CAC), and civilian agencies are beginning a long process of issuing personal identity verification cards to meet the requirements of HSPD-12.
The millions of standardized smart ID cards being put into the hands of military personnel, federal employees and contractors offer the opportunity to improve the security and accountability of multifunction hard-copy devices.
"We have been using CAC cards for computer log-in for about a year now," says Sgt. Collin Johnson, chief of information services for the Utah Army National Guard. When word came down from headquarters that they should begin thinking about using the cards for access to copiers and scanners, "we decided to implement that." The Guard is rolling out ScanStation from eCopy. The appliances not only provide authentication and access control to peripherals with a CAC reader but also integrate scanners and copiers with business applications.
Want to use this article? Click here for options!
© 2008 Penton Media Inc.
Today's New Product
|
B.I.G. Parking Control/Guard BoothManufactured for Louisiana State University, The Estate parking control/guard booth from B.I.G. Enterprises was built to strict hurricane codes due to Hurricane Katrina. The booth features a copper standing seam roof, gutters and downspouts. It comes factory-prepared for on-site installation of architectural brick and has extensive electrical, high-output HVAC, data and communication lines, shelves and cabinets. |
advertisement
This month in Access Control
- Opening Up About Door Closers
- An Enterprise Approach
- The Framework For Open Systems
- On A Higher Plane
- More from April's issue
advertisement
