IT Administrators May Be Overlooking Copier/Printer Security Risks

According to a survey of more than 1,100 IT professionals recently sponsored by Sharp Electronics, nearly half said they did not believe copiers and printers have hard drives. Sixty-five percent said the machines presented little or no risk to data security.

"People have been focusing on antivirus software and firewalls and protecting workstations but not peripherals," says Peter Cybuck, senior manager of product planning, marketing and program management at Sharp's Document & Network Solutions Group.

The most common threats to digital copiers and printers stem from intruders stealing the hard drives containing confidential data, or reprinting documents directly from the machine after the earlier print command was canceled, according to Sharp, based here.

Today's multifunctional copiers and printers store documents in memory, Cybuck says. "They might not just retain the last job, but the last 20 to 30," he adds.

Sharp offers a Data Security Kit, through its dealers, that protects confidential documents processed by its digital copiers and printers by overwriting the data with random numbers.

Sharp, based here, recently announced that the kit won a Common Criteria certificate from the National Information Assurance Partnership (NIAP), a joint program of the National Security Agency and the National Institute of Standards and Technology. The Common Criteria program defines general concepts and principles of IT security evaluation.

While high-end copiers have the ability to store print jobs, the amount of storage is limited, compared with network storage, says Jim Kelton, president of Software Unlimited, an IT consulting company in Irvine, Calif.

Companies need to have a system in place to ensure they're not disclosing confidential information when they discard the machine, he says.

In addition to its Data Security Kit, Sharp's copier, scanner and printer products include a security feature that requires user authorization to prevent unauthorized viewing of documents sent to shared network printers.

Sharp also offers Windows NT server-based software that puts digital fingerprints on printed documents to determine the origin of final hard copy. The company recently added network interface controls to allow administrators to limit access to the machines.

Xerox also offers several security features on its digital copiers and printers. Hard drives on the machines are protected from unauthorized users by a strong encryption system, says Mark Burris, manager of product marketing for Xerox's document center products.

And two years ago, the company addressed a need among its government accounts by providing the ability to remove the hard drive from the machines, he says.

"Security-conscious customers can physically remove those hard drives at the end of the day," Burris says.

The company also recently unveiled new software that provides authenticated scanning.