11 Things About Copier Security You Didn't Know
Your copier can be hacked.
Anything connected to a network can be hacked.
By anything, I mean anything – hackers have penetrated and hacked data through Internet-connected Teddy Bears.
Copiers are a potential treasure trove of data for cybercriminals, especially identity thieves. For those of us who still think of the “makin' copies” guy from Saturday Night Live relative to our copiers, that blind spot is one hackers can exploit.
As digital devices, copiers retain what passes through them in memory and in the hard drive – customer information like addresses, emails, and payment information; the confidential three-year strategy to grow your business; HIPAA-protected documentation; etc.
A CBS news report from 2010 is still one of the most vivid illustrations of this challenge. The video can be viewed below. In brief, reporters pulled the hard drives from a few of the 6,000 used copy machines in a warehouse as they were waiting to be resold. Within 12 hours, using a free forensic software program, tens of thousands of documents were retrieved – from pay stubs to copied checks to individual's medical records.
I'm going to outline five of the most common security loopholes.
Then, the good news, once you're aware of the issue it's easy to fix if you take preventative steps.
5 Copier Security Threats and Vulnerabilities
The following is extracted from the NIST (National Institutes of Standards and Technology) Report 8023, Risk Management for Replication Devices.
Some of the threats and vulnerabilities described include:
• Account/password weaknesses: Many devices are provided to the consumer with easily discernible or default administration accounts and configuration passwords.
• Unencrypted information: Unless encrypted, data transmitted or stored, including passwords, configuration settings, and data from stored jobs, is vulnerable to interception or modification.
• Alteration/corruption of data: If passwords or configurations are changed, users could be unable to access or use the RD, documents or objects could be printed incorrectly, and there could be damage to the device.
• Outdated and/or unpatched software and firmware: Many devices run an embedded operating system, making them subject to the same threats as any other computer running those operating systems. Also, some devices may have software or firmware that is not updatable or no longer supported by the manufacturer, which may leave unpatched security issues.
• Open ports/protocols: Open ports and protocols allow data to flow to and from a device. Through open ports, attackers may gain undetected access to a device, and data tampering or denial of service can result.
“Replication devices” include copiers, printers, 3-D printers, scanners, 3-D scanners, and multifunction machines.
6 Steps to Keep Your Networked Copier Secure
These steps are simple. Don't ignore them and put your office at risk of a data breach.
- Wipe hard drives regularly. Hackers can't steal what's not there. Make it a habit to wipe your hard drive and cache regularly.
- Encrypted hard drives. Encryption adds a layer of security to your data as well as helping to comply with stringent regulations such as HIPAA. Most Xerox copiers and printers include Disk Image Overwrite and/or Data Encryption standard or as options.
- Disable USB ports. While a USB port can make walk up printing/copying simple, an infected USB stick can insert a virus into your network if inserted into a copier. For a copier that is used to copy, print, and scan confidential information (banking statements, PII, health records, etc.) someone could insert a USB stick and download that data to it. There are easier ways to move documents than via USB.
- Plan for data security. As the saying goes, “Failing to plan is planning to fail.” Be sure to include your networked office equipment in your security plan. Ensure that any network-connected device isn't an open door for cybercriminals.
- Update firmware regularly.
- Enforce better passwords and consider adding a layer of security with a card reader or even biometrics to allow access to a device.
Implementing pull printing adds an additional layer of security for your documents. We'll cover that in a future post.
Getting Rid of Your Copier
When you retire office equipment, be sure to have the hard drive digitally shredded (or removed entirely) and the cache wiped. If you're leasing your equipment, work with your partner to ensure this step is taken. If you're selling, donating, or recycling equipment; be sure your IT team helps you remove all traces of your data from the machine.
The office copier can be a threat to your office security if you let it. Now that you know about the risks, take the necessary steps to keeping your office safe and secure.
Think your business or office is too small and hackers don't care about you? Think again – 62% of cyber breach victims are SMBs.
Need help?
Get in touch with one of our Printerpreters!
