SYS.4.1 Printers, Copiers, and All-in-One Devices

Introduction

Today’s printers, copiers, and all-in-one devices are complex devices which, in addition to mechanical components, contain their own operating systems and provide server services and functions. Since these devices often process confidential information, they must be protected along with the rest of an organisation's print and scan infrastructure.

All-in-one devices are devices that offer several paper-processing functions, such as printing, copying, scanning, and sending and receiving fax documents.

For many business processes, paper is still used as an information medium today. This makes printers, copiers, and all-in-one devices important components of IT infrastructure. If such devices fail or falsified documents are printed out, this can sometimes affect critical processes and lead to considerable economic losses.

Objective

This module describes how printers, copiers, and all-in-one devices can be operated safely so that information is not extracted from these devices and the security of the rest of the internal IT infrastructure at hand is not impaired.

Scoping and Modelling

Module SYS.4.1. Printers, Copiers, and All-in-One Devices must be applied to each printer, copier, and all-in-one device in the information domain under consideration.

This module covers the security of printers, copiers, and all-in-one devices. Networked document scanners or those connected locally to IT systems are not explicitly considered. However, corresponding risks and requirements can be derived from those described for all-in-one devices. Similarly, networked fax machines are not considered separately. The risks and requirements cited for fax functions in this module therefore also apply to this type of device. In addition, the requirements of module NET.4.3 Fax Machines and Fax Servers should be considered.

Printers, copiers, and all-in-one devices are often connected to data networks so that multiple users can use them. In addition to wired connections, some devices can also be connected directly to a WLAN. Recommendations for this are included in sub-layer NET Networks and Communication modules of the IT-Grundschutz Compendium, such as in module NET.2.2 WLAN Usage.

Printers, copiers, and all-in-one devices often contain confidential information that remains on the devices after they are taken out of service. Leased equipment is often replaced after a predetermined period or frequency of use, depending on the specific contract in question. At the latest, they are returned when the corresponding leasing contract expires. Paper and other equipment may also contain confidential information. Before these devices and resources are discarded, exchanged, repaired, or returned, all sensitive information must be deleted from them. Recommendations in this regard are not covered in this module. They can be found in module CON.6 Deleting and Destroying Data and Devices.

Print servers are systems with print queues, print job management features, and possible other functions, such as driver distribution or secure printing. For each print server, the general and operating-system-specific security requirements for servers must be met. Instead of being covered here, these requirements are described in module SYS.1.1 General Server and the respective operating-system-specific server modules.

An essential focus in securing printers, copiers, and all-in-one devices lies on regularly updating their software to close software vulnerabilities. This module does not deal with this aspect, however. Corresponding requirements are included in module OPS.1.1.3 Patch and Change Management.

Useful Resources

Within the framework of the Alliance for Cyber Security, the BSI offers recommendations in “Drucker und Multifunktionsgeräte im Netzwerk BSI-CS 015” [Printers and All-in-One Devices in the Network, BSI-CS 015] and “Sichere Passwörter in Embedded Devices (BSI-CS 069)” [Secure Passwords in Embedded Devices, BSI-CS 069]. In-depth information on printers, copiers, and all-in-one devices can also be found in the white paper “Datenschutz und Sicherheit in Druckinfrastrukturen” [Data Protection and Security in Printing Infrastructures], which was published by the ACS partner company mc² management consulting GmbH.

The National Institute of Standards and Technology (NIST) describes requirements for output devices such as printers, copiers, and all-in-one devices in Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations”, especially in section PE-5, "Access Control for Output Devices”.

1. Ülevaade

Pealkiri	Standard
SYS.4.1.A1 Planning the Use of Printers, Copiers, and All-in-One Devices (B)	Before printers, copiers, and all-in-one devices are procured, their secure use MUST be planned. In doing so, the following criteria should be taken into consideration: support of secure protocols for data transmission and administration encryption of stored information authentication of users directly on each device use of physical protection mechanisms, such as anti-theft eyelets or device locks existence of a reliable and efficient automatic page feeder on scanning units support for suitable data formats support for patch codes and bar codes for document separation and transfer of meta information (if required) existence of a function for secure storage deletion availability of regular updates and maintenance contracts The locations where devices may be situated MUST be specified. In addition, it MUST be defined who may access printers, copiers, and all-in-one devices. The results should be documented in a basic concept.
SYS.4.1.A2 Suitable Siting and Access to Printers, Copiers, and All-in-One Devices (B)	The IT Operation Department MUST set up and secure printers, copiers, and all-in-one devices so that only authorised users can use the devices and access processed information. In addition, it MUST be ensured that only authorised persons can administer, maintain, and repair the devices. Confidentiality agreements MUST be established in writing with service providers (e.g. for maintenance). Printers, copiers, and all-in-one devices MUST be set up with device passwords to block access to their web servers and administration control panels. They MUST comply with the respective organisation's identity and authorisation management requirements in this regard.
SYS.4.1.A22 Proper Disposal of Printed Documents (B)	Printed documents containing confidential information that are no longer required MUST be disposed of appropriately. If home workstations are equipped with printers, copiers, or all-in-one devices, it SHOULD be ensured that information printed there can also be suitably destroyed directly on site when it is no longer needed.
SYS.4.1.A4 Drawing Up a Security Policy for the Use of Printers, Copiers, and All-in-One Devices (S)	Organisations SHOULD develop a security policy for printers, copiers, and all-in-one devices. It SHOULD regulate the requirements and specifications for the information security of such devices and how they are to be met. It SHOULD also specify which functions may be administered or used by which users under which conditions.
SYS.4.1.A5 Drawing Up User Guidelines for Handling Printers, Copiers, and All-in-One Devices [Chief Information Security Officer (CISO)] (S)	A user guideline SHOULD also be created that summarises all the security requirements for handling printers and all-in-one devices in a clear and comprehensible manner. All users SHOULD be familiar with the guideline.
SYS.4.1.A7 Restriction of Remote Administrative Access to Printers, Copiers, and All-in-One Devices (S)	The IT Operation Department SHOULD ensure that only a clearly defined group of administrators and service technicians have remote administrative access to printers, copiers, and all-in-one devices. This SHOULD also be ensured if the organisation in question uses central device management software. It SHOULD be specified whether control panel displays can be viewed via a data network. If this is desired, such displays SHOULD only be transferable to employees in the IT Operation Department. This SHOULD also be agreed with the users concerned.
SYS.4.1.A11 Restricting the Connection of Printers, Copiers, and All-in-One Devices (S)	The IT Operation Department SHOULD ensure that network-enabled printers, copiers, and all-in-one devices cannot be reached from external networks. When connecting all-in-one devices to the telephone network, it SHOULD be ensured that no uncontrolled data connections can be established between an organisation's data network and the telephone network. Network printers and all-in-one devices SHOULD be operated in their own network segment and kept separate from an organisation's clients and servers.
SYS.4.1.A15 Encryption of Information for Printers, Copiers, and All-in-One Devices (S)	If possible, all information stored on internal non-volatile storage media SHOULD be encrypted. Print jobs SHOULD also be transmitted in an encrypted form if possible.
SYS.4.1.A17 Protection of Payloads and Metadata (S)	Payload data and metadata such as print jobs and scan files SHOULD only be stored on devices for as short a time as possible. Data SHOULD be deleted automatically after a predefined amount of time. File servers on such devices and functions such as “scan to device memory” SHOULD be disabled by the IT Operation Department. The protocols and functions required for this SHOULD be blocked whenever possible. In general, the IT Operation Department SHOULD ensure that no metadata is visible to unauthorised parties. Organisations SHOULD regulate how printouts with metadata are to be passed on to third parties.
SYS.4.1.A18 Configuration of Printers, Copiers, and All-in-One Devices (S)	All printers and all-in-one devices SHOULD only be configurable by the IT Operation Department. Unused device functions SHOULD be switched off. In particular, all unnecessary data and network interfaces of printers, copiers, and all-in-one devices SHOULD be disabled. The devices SHOULD be managed exclusively via encrypted protocols such as HTTPS and SNMPv3. All protocols that allow unencrypted access to printers and all-in-one devices SHOULD be replaced by encrypted ones by the IT Operation Department or switched off. This SHOULD be implemented in particular for protocols that can be used to change a device's configuration (e.g. SNMP, Telnet, PJL).
SYS.4.1.A14 Authentication and Authorisation for Printers, Copiers, and All-in-One Devices (H)	Only authorised persons SHOULD be able to access printed or copied documents. If possible, only central printers, copiers, and all-in-one devices SHOULD be used that require user authentication before starting printing tasks (“secure print”). After users have authenticated themselves, only their own print jobs SHOULD be visible. Only the functions necessary for each respective user SHOULD be enabled.
SYS.4.1.A16 Reducing Downtimes for Printers, Copiers, and All-in-One Devices (H)	To minimise the downtime of printers, copiers, and all-in-one devices, the safeguards taken SHOULD include the following: replacement devices should be available an appropriate response time should be ensured in maintenance contracts a list of specialised suppliers should be maintained for the purpose of quickly purchasing replacement devices or spare parts a store of regularly required spare parts should be maintained if necessary
SYS.4.1.A20 Enhanced Information Protection for Printers, Copiers, and All-in-One Devices (C)	The names of print jobs SHOULD only be displayed in anonymised form on print servers. All interfaces for external storage media SHOULD be disabled. Furthermore, device-internal address books SHOULD be disabled and alternative addressing methods (e.g. address search via LDAP) offered to users. Printers and all-in-one devices with e-mail functionality SHOULD ensure that e-mails can only be sent using the e-mail address of an authenticated user. Documents SHOULD also only be sent to internal e-mail addresses. Incoming fax documents and transmission reports SHOULD only be accessible to authorised users.
SYS.4.1.A21 Extended Protection of Printers, Copiers, and All-in-One Devices (H)	The IT Operation Department SHOULD regularly check the security settings of printers, copiers, and all-in-one devices and correct them if necessary. If an automated control and correction system is available, it SHOULD be used. In addition, there SHOULD be a restriction on devices being reset to factory settings via their boot menus. It SHOULD be ensured that no firmware or additional software can be installed on printers and all-in-one devices that has not been verified and approved by the respective manufacturer.

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded
Allikas	Nõue

3. Seotud regulatsioonid

Regulatsioonid
Allikas	Regulatsioon

Lingitud teemad

Lingid
Lingi tüüp	Teema
includes	SYS.4.1.G1. Unauthorised Access to Printed Documents
includes	SYS.4.1.G2. Visibility of Metadata
includes	SYS.4.1.G3. Insufficient Protection of Stored Information
includes	SYS.4.1.G4. Unencrypted Communication
includes	SYS.4.1.G5. Unauthorised Sending of Information
includes	SYS.4.1.G6. Uncontrolled Data Exchange via Memory Interfaces on Printers, Copiers, and All-in-One Devices
includes	SYS.4.1.G7. Inadequately Secured Network Access of Printers, Copiers, and All-in-One Devices
includes	SYS.4.1.G8. Poor Access Protection for Device Administration

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)