Integrating Color Into Your Printing Strategy

Security Solutions

Helping to safeguard information confidentiality

By Brent Hoskins, Office Technology Magazine While many end users still remain unconcerned or unaware of the information security risks associated with MFPs, today there are a growing number of product features that help to safeguard the confidentiality of electronic documents and data in the workplace. The features also serve to maintain the integrity of information and control its accessibility. Increasingly, anyone with malicious intent will often find the office MFP well protected. Initially it was employees in the federal government who saw the risks inherent to MFPs and sought solutions. With data streaming in and out, and with the use of an internal hard drive, the MFP was viewed as akin to the personal computer, long known as hardware whose data required security. Given the confidential and even classified information government employees gather and generate, they made their concerns known to MFP manufacturers. "When we first came out with our data security kit, it was definitely customer driven; it was in response to a government request," acknowledges Vince Jannelli, associate director of applications and partners for Sharp Imaging and Information Company of America. "They wanted the risk mitigation of the encryption and overwrite on the hard drive. That was the genesis of it." Government officials received what they requested � an MFP solution that encrypts data prior to being written to RAM or flash memory or the hard drive and overwrites deleted data to help ensure all information is virtually irretrievable by unauthorized users. However, says Jannelli, the government sought an assurance that the data security kit would deliver as promised. Specifically, he says, "they wanted Common Criteria Certification to prove that we actually did what we said we did." The rigorous, government sponsored certification process, also known as ISO 15408 and implemented in 2002, requires certain security features of networked devices used in conjunction with the entering, processing and transmitting, etc., of national security information to be validated. While Sharp was the first MFP manufacturer to have a product validated through the process, today Common Criteria Certification of product security features is commonplace among MFP manufacturers. Likewise, manufacturers are also now embracing the IEEE 2600�-2008 family of standards for hardcopy device and systems security, resulting from efforts that began in 2004. The standards project is sponsored by the IEEE Information Assurance Standards Committee of the IEEE Computer Society. The standards define copier/MFP and printer security requirements in such areas as authentication, authorization, privacy, integrity, device management, and physical and information security. Among the sponsors of the standards initiative are such companies as Canon, Hewlett-Packard, Konica Minolta, Kyocera Mita, Lexmark, Oki, Ricoh, Samsung, Sharp and Toshiba. "Essentially, a number of manufacturers sat down together to address the question: 'What security features need to be on these products?'" says Jannelli, noting that the catalyst for the development of the standards was end-user demand and inquiries regarding such features. "The interest in security has risen to such a point that customers are saying, 'I need someone to guide me as to what the true risks are and the best way to mitigate those risks.'" Government agencies have remained the dominant customer group requiring security features. In recent years, the rise in use of common access cards (CACs) has been among the focal points for manufacturers selling to the government. "Basically, the use of a common access card is a Department of Defense (DoD) requirement," says Ron Nevo, senior product planning and marketing manager of security and applications at Sharp. "If you need to do anything with a machine, you have to authenticate with your CAC, which is a smart card. Its use is still ramping up. When you walk into any DoD facility today, not every copier/MFP in use is covered by CAC implementation, but certainly most of the new copier/MFPs being rolled in are covered." While the government remains dominant in terms of security requirements, the commercial market is increasingly adapting such requirements as well. Akisa Matsuda, director of software solutions for Kyocera Mita America Inc., says security features used to be primarily a "nice-to-have" but today are becoming a "must-have." The bid requests received by the manufacturer confirm the change. "The customer has decided that you have to have security features in order to enter the bid process," she says. "If you don't have it, you cannot submit a bid. This is not something where you can offer an alternative solution." In recent months, Matsuda says she has noticed an increase in the inclusion of security features as a requirement in bid requests, not only from government agencies, but also in the education, financial and healthcare industries. She has noticed, too, a shift from simply viewing security as an arbitrary bid criterion to viewing it as a real solution to specific, practical needs. "They do have confidential information that they want to protect," she says. "For example, I recently heard a comment from a customer representing a school that they are concerned about students hacking into their system, so they really want to address the need for security." Dennis Amorosano, senior director of solutions marketing and business support for Canon U.S.A. Inc., says there are two primary areas of concern among customers seeking to address the need for security. "I think the most common concern has been and continues to be related to securing the device, given that it is attached to the customer's network," he says. "So, for example, some customers want to understand the level of flexibility they have in configuring the different types of ports on the device. In many cases, they want to close down many of the ports on the device, particularly, of course, those ports they are not going to be utilizing." The second area of primary concern, "are the latent images that have been processed by the device," says Amorosano. "The customers want to know how they can effectively protect images that may reside on the hard drive of the device following the completion of the job. Of course, Canon offers a number of different methods to ensure that any images that may have been written on the hard drive of the device can ultimately be protected, whether it be by encrypting the entire hard drive or by implementing an overwrite of jobs following their completion." Like other manufacturers, Amorosano says Canon offers a broad range of security features, not just those that address the two primary concerns. Other features he cites, for example, include: user authentication, verifying that the user is who he (or she) claims to be through passwords or smart cards or both; access control, associated with the user's role and privileges, determining what the user can access and the actions he can take on the device; and logging and auditing, which provide audit trails of who accessed and printed specific documents, etc. "We have tried to take a holistic approach to looking at the topic of security, because there are so many different types of security-related issues that can come up when you are connecting these devices inside of a customer's environment," says Amorosano. "So, depending on the kinds of concerns that a customer has, the dealer can then talk in terms of the particular capabilities they can offer with Canon devices in one of the security areas." Bill Cassidy, associate director of product and solutions marketing at Kyocera, emphasizes that although many customers do have specific reasons in mind for product security features, security implementation simply for peace of mind is also becoming more common. "A lot of times, the IT directive is 'let's just secure everything and that way we never have to worry about anything,'" he says. "Even though the residual data on a hard drive is incomplete data for the most part, from the IT standpoint it's 'I don't even want that much data unsecured.' So, they prefer to basically lock it all down." Are you helping your customers "lock it all down" or address specific needs through the implementation and use of MFP security features? It is not simply an opportunity for manufacturers seeking to better serve customers and secure new product placements in major accounts or the federal government. Dealers should remember, for example, notes Jannelli, that the DoD extends well beyond large military bases. "Don't forget about the National Guard bases," he says. "They are mostly dealer opportunities because they are at the state level." There are, as noted, many commercial businesses increasingly seeking to better protect information and documents. "The dealership's general line sales reps need to have at least a base level of understanding as to the security capabilities that are inherent in the product platform in order to effectively address security concerns that may be raised by the customer in the normal sales cycle," says Amorosano. "Today, almost every customer is asking questions about security. "It is an opportunity," he says. "More customers are now looking beyond the basic capabilities of just connecting the device to a network in a secure manner. Increasingly, they want to do things that are tied to securing the document, providing audit controls, etc. Dealerships have the capabilities and technical skills that make them well positioned to support these requirements as they continue to emerge in the marketplace."  Brent Hoskins, executive director of the Business Technology Association, is editor of Office Technology magazine. He can be reached at brent@bta.org.

---

01/22/10 - 849am