How you can avoid the potentially catastrophic security leak in your printers and copiers

Jacques van Wyk, COO of Ricoh SA

---

A Carte Blanche segment on Sunday, 30 August, highlighted the need to secure documents on copiers, printers and multifunction printers (MFP) because the devices contain hard disk drives (HDD) that store document data that villains could later reproduce.

And they couldn't be more correct, says Jacques van Wyk, COO of Ricoh SA.

Securing the information on those devices is a crucial element in the chain to meet regulatory, compliance and general data and information security requirements in the modern, connected age, particularly when handling sensitive data.

As the segment highlighted, many devices that had reached end of lease terms then disposed of still contained their hard drives, unaltered. Nobody had formatted the drives, magnetised them to destroy data, removed them, opened them, nor destroyed the platters they contain that store the actual data. In some cases data on the drives were encrypted but a skilled person using software downloadable from the Internet could retrieve the data and reproduce any of the documents the drives contain - encrypted or not.

The threat

Drives picked up from a local e-waste facility by the Carte Blanche team contained such documents, including sensitive financial information from a church, tender documents, company letterheads and more.

Crime syndicates could use the information to access bank accounts to syphon funds, or disgruntled employees to sabotage the organisation, one of the most common types, or by a competitor to disrupt a tender or another nefarious purpose.

8 Solid tips

Carte Blanche posted these eight tips to its Web site to counter this threat. They offer sound advice. Carte Blanche also posts its segments to the Web site following airing and it should become available here should you wish to view it entirely.

Since most of these devices are leased or serviced and maintained by the internal IT department it is important to engage the vendor's security services. Any vendor worth their salt will offer them yet they are not always enforced. People, as with many IT systems, are the weakest link in the chain. With that in mind and considering the potential reputation loss for the vendor involved we have a certified, audited process for any machines that we work on, whether it be to service them or when they reach end of life.

What your vendor should provide

1. Before the vendor removes the device from the customer's premises they should inform the customer of the potential threat, offer to leave the drives onsite, or insist on following the necessary procedure should the drives remain in the device.
2. The necessary procedure is twofold:
a. For devices reaching end of life, the drives should be removed, formatted, physically opened, the platters removed and physically destroyed. The same applies to RAM modules and fax boards.
b. For devices under maintenance or service the drives should not be connected to any networks nor removable data storage media, a format service should be offered and a waiver signed by the customer in the case of refusal.
3. Most importantly, for both procedures, the entire process should be audited for verification and certificates issued for every device.

Industries and sectors that cannot afford to be complacent include, but are not limited to:

* Government;
* Financial services;
* Pharmaceutical;
* General office;
* High-tech;
* Laboratories;
* Law firms;
* Accounting practices; and
* Medical and hospitals.

4 Phases of document security on your devices

There are four phases to securing the documents your devices handle, with escalating security threats from phase one to four:

Phase 1
* Restrict unauthorised device access.
* Control device output.
Phase 2
* Secure network devices.
* Secure network print data.
* Destroy latent data.
* Phase 3
* Physically secure data ports.
* Encrypt Web communications.
* Authenticate users.
* Phase 4
* Monitor and control resources.
* Audit all device activity.