NET.4.3 Fax Machines and Fax Servers

Fax machines MUST be installed in such a way that received faxes cannot be viewed or removed by unauthorised persons. The installation site SHOULD also be selected to ensure that an adequate number of telephone communication lines or channels are available. An installation site MUST have a suitable network connection for the fax machine in question. Fax machines MUST NOT be used with network connections that were not intended for this purpose.

All employees MUST be made aware of the specifics of transmitting information by fax. They MUST also be informed that fax transmissions are only legally binding to a very limited extent. An instruction manual that is easy to understand MUST be available at every fax machine. Users SHOULD receive at least a brief tutorial on the fax client software used by a fax server. In addition, instructions on correct fax usage MUST be displayed.

Before a fax server is put into operation, a test phase SHOULD be carried out. The configuration parameters and all the changes made to the fax server's configuration SHOULD be documented. The archiving and deletion of fax data SHOULD be regulated. In addition, the functionality of the connection from the fax server to the corresponding PBX system or the public telephone network MUST be checked regularly. It MUST also be ensured that the fax server only offers fax services and is not used for any other purposes. All features and communication interface access points that are not required MUST be disabled.

A security policy for fax use SHOULD be created before a corresponding device is used. It SHOULD detail the intended type of use. In addition, the way in which incoming and outgoing faxes are to be dealt with SHOULD be regulated. A regulation on the handling of undeliverable faxes SHOULD also be drawn up. The security policy for fax use SHOULD also contain information and instructions regarding contingency planning and fallback options for fax operations.

A requirements list SHOULD be created before fax machines and fax servers are purchased. The systems or components under consideration SHOULD be assessed using this list. The requirements list for fax machines SHOULD also include security-relevant aspects such as the exchange of subscriber IDs, the output of transmission reports, error logging, and journal management. In addition, appropriate additional security functions SHOULD be considered based on the protection needs at hand.

When selecting a fax server, the requirements to be met by the respective IT system—including the operating system, communications components, and application software—SHOULD be specified and taken into consideration. The option of integrating a fax server into an existing data network and groupware system SHOULD be considered if necessary.

The sender and the desired recipient SHOULD be visible on all outgoing faxes. If this information cannot be obtained from the document sent, a standardised fax cover sheet SHOULD be used. In general, a fax cover sheet SHOULD include at least the name of the organisation of the sender, the name of the contact person, the date, the number of pages, and an indication of how urgent the fax is. It SHOULD also include the name and organisation of the recipient. If necessary, the fax cover page SHOULD be customised for each outgoing fax.

All fax consumables from which information on sent and received fax messages might be retrieved SHOULD be made unreadable before disposal or disposed of by a reliable specialised company. The same procedure SHOULD also be followed for replaced parts that contain information. Maintenance companies that check or repair fax machines SHOULD be required to handle them appropriately in this regard. Regular checks SHOULD be carried out to determine whether these guidelines are being followed.

The transmission processes of incoming and outgoing faxes SHOULD be logged. The communication journals available on standard fax machines SHOULD be used for this purpose. If fax machines have logging functions, they SHOULD be activated. Logging SHOULD also be activated for fax servers. A decision SHOULD be taken regarding the information that should be logged.

The communication journals and log files of fax machines SHOULD be regularly evaluated and archived. They SHOULD undergo random inspections for irregularities. Unauthorised persons SHOULD not be able to access these communication journals or logged information.

Programmable speed-dial keys and saved destination addresses SHOULD be checked regularly to see if the desired numbers match the respective programmed numbers. Fax numbers that are no longer required SHOULD be deleted. Appropriate documentation SHOULD be created when a new entry is added or a recipient number is changed.

Sufficient communication lines or channels SHOULD be available. The expected fax volume SHOULD be estimated for a fax server. Components which are capable of handling this volume SHOULD be selected. Logs of fax servers SHOULD be checked regularly in order to prevent bottlenecks caused by overloads in good time. Fax data that is no longer required SHOULD be promptly deleted from fax servers.

Undesired fax addresses SHOULD be blocked. Alternatively, only specified numbers SHOULD be allowed. The appropriate approach SHOULD be determined for each individual situation.

Access to a fax machine SHOULD be restricted to a small number of employees. These employees SHOULD distribute incoming faxes to the recipients. The employees SHOULD be taught how to use the fax machine and how to implement the necessary security safeguards. Every authorised user SHOULD be informed about who may operate the fax machine and who is in charge of it.

Faxes printed on thermal paper that are needed for a longer period SHOULD be copied or scanned onto plain paper. It SHOULD be taken into account that the ink on thermal paper fades faster and becomes unreadable. Copies or scanned faxes SHOULD be archived appropriately.

Important faxes SHOULD be announced to the recipient before they are sent. The documents to be announced in advance SHOULD be specified. Employees who wish to send confidential fax documents SHOULD be instructed to have the recipient confirm full receipt. For important or unusual faxes, the recipient SHOULD have the sender confirm that the fax document came from them and has not been falsified. A suitable form of communication (telephone, for example) SHOULD be selected to announce or confirm fax documents.