Large enterprises may have developed and implemented data retention and destruction policies but rarely do these include, or even mention, printers. Companies look at hardcopies of documents, CD's, DVD's and workstation, laptop and server hard drives when developing their data destruction policies. While it is clear they identify hard drives as a source of sensitive information, rarely do they consider the hard drives contained within their printers, if they even know of their existence. Printers are also commonly overlooked when security policies, procedures and guidelines are developed and implemented. Little time, if any, is spent looking at printer security or the implications of not securing the corporate printers. All the more disturbing this becomes when you contemplate the common types of documents that pass through printers in a corporate environment. Depending on the industry or the department within the organization, documents can vary from sensitive financial records, personal customer data or detailed network diagrams, to name a few.
123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com
To understand how sensitive data is leaked via a simple printer to the outside world, it requires an understanding of the corporate environment, security controls within that environment, and the general flow of information between users, printers and file systems that house restricted data.
In the ideal, secure corporate environment, a user has restricted access to files that pertain to his or her job function. The files reside on a secure server within the corporate network and are protected by strong access control policies requiring a user to authenticate before being allowed access to files. In our example, a user requires a sensitive financial document for a meeting he is about to attend. The user authenticates to the server, access to the file is authorized by the access control policies set on the file and the user opens the file in Microsoft Word. He clicks on the print icon and sends the document as a print job to his nearest printer. With this simple act, we have taken a secure document that very limited users have access to, and have created two copies that are no longer protected by any form of access control. The first is the obvious; the paper copy our user requires for their meeting.
123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com
The second is a copy housed in the buffer on the printer. In the ideal world, our user will keep the printed copy safe at all times and follow the organization's data destruction policy and destroy the copy of the document when they no longer require it. As for the virtual copy created on the printer, the user has no real control over this, nor probably knows it even exists. If we are lucky, the document is overwritten when the next print job comes through, but this is very dependent on the brand and model of printer and how the printer was initially set up by the administrator.
123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com
Slightly different to the straight printing of documents, scanning of documents or receiving faxes on a multifunctional printer writes documents to non-volatile areas of memory, usually a hard disk drive. If documents are not manually removed, they will remain there indefinitely, often long forgotten by the original user that scanned the document or received the fax.
In either of these scenarios, improper disposal of a decommissioned printer could have catastrophic consequences for a company. Leased printers may be returned to the leasing company for resale. Purchased printers are discarded in the trash or sold at auction or online via auction sites such as eBay. Either way, countless sensitive documents could pass into the hands of nefarious individuals. While the leaking of some documents could financially affect organizations, leaking personal information pertaining to hundreds or thousands of customers or clients could have reputation ramifications that could destroy a company.123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com123.hp.com
No comments:
Post a Comment