Risk
8/10/2010
12:36 PM
50%
50%

Xerox Advises Securing Data In Printer Hard Drives

Network printer and MFP hard drives may contain sensitive data that can be secured using encryption or overwriting.

"The risk is that after a job is done, MARCed and printed, there may be some residual data left behind associated with that job," says Kovnak. And, as with computers, even if the system "deletes" a file, that doesn't actually remove file contents, just frees up those spaces on the disk for re-use, so if a large print job that contains sensitive data is followed by a smaller print job, some sensitive data might still be on the drive.

Also, Kovnak points out, "Some of our more complex devices let users store jobs for later reprinting, or to hold the job until the user arrives and requests the file" (so that it won't be sitting around where an unauthorized person can read or take it).

As with computers, says Kovnak, there are two ways to counteract the risk of that data being accessible: "Encryption, which protects the data while it's still in use, and overwriting, after a job is done."

How can you tell if your printer or MFP could have data at risk?

"It's hard to tell just by looking whether a device has a disk," Kovnat points out. "If it's a device you already own, you have to check the product description. SMBS can the vendor representative."

According to Kovnat, many Xerox devices include both encryption and overwrite. "The encryption feature in most of our devices is enabled by default; the overwrite is not enabled by default," says Kovnat. "For most of our products, they're now standard, but they may not be turned on."

Xerox also offers data security features that can be downloaded, for some machines -- but, he cautions, "for older products -- ones introduced five or more years ago -- these features may not be available."

Previous
2 of 3
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

CVE-2015-0915
Published: 2015-05-21
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.