Overview

• Business Risk• Secure MFP Program• Device Security• Access Security• Document Security• End of Life Security

Business Risk

• MFP’s - An Overlooked Security Threat• Internal Threats• External Threats

Significant Business Risks• Theft of Data, Intellectual Property• Unauthorized Access to Records• Malicious Exploitation• Regulatory Compliance Issues

Business RiskMFP’s & Printers – An Overlooked Security Threat•All types of data copied, scanned, faxed, printed on MFP’s•Personal information, Health Records, Financial Statements, Confidential Reports, e-mails, Customer Records and Employee Files, Social Security, Credit Card Numbers, Defense related data.

Business RiskInternal Threats (20% Traceable to insiders*)• Left unsecured an MFP or Printer is a huge point

of vulnerability to your network and your business

• Confidential documents can be retrieved from the MFP hard drive, taken from an output tray and emailed or faxed without authorization.

• MFPs and printers provide employees with a point of entry to the network that can be used to bypass network security mechanisms thus providing access to information on the network.

*2009 Data Breach Investigation Report

Business RiskExternal Threats (74% External*)• Data is also at risk via external threats, • Via Wide-Area Network (WAN), the public

Internet or a Virtual Private Network (VPN), stored documents, scanned data or print jobs can be intercepted.

• Malicious intrusions in the form of Denial of Service (DOS) attacks can be initiated via an unsecured MFP or Printer.

• Packet sniffers can be used to intercept data and sent to unauthorized parties

• Data stored on the copier’s hard disk drive can be retrieved remotely.

*2009 Data Breach Investigation Report

Secure MFP ProgramToshiba’s Solution – Secure MFP• Secure MFP addresses multiple avenues of

vulnerability with a broad array of countermeasures which are grouped as follows• Device Security• Access Security• Document Security• End of Life Security

• This holistic approach provides for defense in depth.

*2009 Data Breach Investigation Report

Secure MFP ProgramToshiba Security Assessment• Assesses the current state• Audits the devices (MFP’s)• Audit the document infrastructure• Assesses vulnerabilities in 4 categories

• Device Security• Access Security• Document Security• End of life Security

• Each category has many vulnerabilities & countermeasures

• Assigns grade, None, Basic, Optimal, Enhanced• Creates roadmap to secure future state

Device SecurityCategorization

Device Access Document End of Life

Optimal Secure Networking

Enterprise Tracking/Release

Document DRM Solution

Policy Implemented

Enhanced

Secure DataNetwork

Authentication Print Queues N/A

Basic Core Technologies Simple Authentication

Document Protection N/A

Device SecurityCountermeasures• SSL• IPv6• IP Filtering• SMB Signing• IPSec• Advanced Encryption • Data Overwrite Kit

Device Security• SSL

• SSL is a cryptographic protocol widely used on the Internet to provide secure communications for transfer of personal information.

• MFP devices employ this common encryption technology to protect all data traveling to and from the MFP.

• Print jobs sent via SSL are encrypted through symmetric cryptography, ensuring that the print data is secure and will not be used for any purpose other than print output.

Device Security• IPv6

• Commonly known as the next generation Internet Protocol— IPv6 is the latest version of IP.

• With the introduction of IPv6 come several new features that address IP security needs, such as a larger IP address range, protection from scanning and attacks, and built-in support for authentication and confidentiality.

• Toshiba supports IPv6 as part of our ongoing commitment to meeting your current and future network needs.

Device Security• IP Filtering

• IP Filtering acts like a firewall to protect your internal network from intruders.

• IP filtering lets you control what IP traffic to allow into and out of your network by filtering data from specified network addresses.

• MFP devices utilize this mechanism as a means of controlling which computers have access to its network functions.

Device Security• SMB Signing

• SMB Signing adds a digital signature to data transferred between the MFP and the server during network authentication.

• The signatures verify that the identity of the server matches the credentials expected by the MFP, and vice versa.

• By verifying that data is received from authenticated sources, the signature ensures the integrity of all communications.

Device Security• IP Sec

• Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream. IPsec also includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys to be used during the session.

• IPsec can be used to protect data flows between a pair of hosts (e.g. computer users or servers), between a pair of security gateways (e.g. routers or firewalls), or between a security gateway and a host.

Device Security• Advanced Encryption

• Advanced Encryption features 128-bit encryption and decryption of all data being written to the hard disk drive of the device.

• This includes all copy, print, fax, and scan information for every document processed on the multifunction device.

• Toshiba’s 128-bit encryption utilizes the Triple Data Encryption Standard (DES) algorithm.

Device Security• Data Overwrite Kit

• The Data Overwrite Kit completely overwrites all information on the hard drive after every job. It works by deleting all data within the File Allocation Table (FAT) partition, in addition to overwriting the actual data.

Device SecurityBasic (Core eBridge Technologies)• SSL• IPv6• IP Filtering• SMB Signing

Device SecurityEnhanced (Secure Data)• Advanced Encryption • Data Overwrite Kit

Device SecurityOptimal (Secure Networking)• IPSec

Access SecurityCountermeasures• Department Codes• Strong Passwords• Usage Limitations• Job Log• Network Authentication w/RBAC• Email Authentication• SmartCard Authentication• Ringdale FollowMe, PaperCut FindMe

Access Security• Department Codes

• Department Codes are private pre-set codes that give authorized users full functionality at the device, allowing them to copy, print, fax, and scan.

• In addition to controlling access, Department Codes provide valuable data tracking and usage information, which allows network administrators to easily track and view the volume and type of jobs being produced by each department or user.

Access Security• Strong Passwords

• Strong Passwords negate the effectiveness of password detection tools that can crack passwords instantaneously.

• Toshiba employs a ten-digit alphanumeric administrative password and a log-on limitation of up to three attempts.

• This process helps foil attempts to crack the administrative password by making it more difficult to ascertain, and disabling log-on privileges after three failed attempts.

Access Security• Usage Limitations

• Usage limitations allow the administrator to control and track output at the device.

• This also adds an additional level of security to control access to the device, and provides enhanced visibility to help track and control costs associated with the device’s use.

Access Security• Job Log

• Job Log is a Toshiba feature that makes it easy to track data and documents. Information about each completed job is stored within the e-STUDIO Job Log.

• Print, fax, and scan jobs are tracked with detailed information including the user name, date, time, number of pages, type of paper, and type of job.

Access Security• Network Authentication

• Network Authentication provides an additional means of control via the network.

• Ideal for larger scale installations with numerous users, network administrators can control access at the device in the same manner that they control network access from the desktop.

• Users are required to input their network user name and password to gain access to the control panel.

• Network Authentication can also be used in conjunction with Role Based Access Control (RBAC) which allows the administrator to control access to specific functionality by individual user. (i.e. copy, print, scan, fax)

Access Security• Email Authentication

• Email Authentication is critical when conducting business via the Internet or Email, because it ensures that you are corresponding with an authentic addressee.

• Toshiba’s Email authentication technology allows organizations to manage the Emails being sent from each multifunction device.

Access Security• SmartCard Authentication

• SmartCard Authentication offers extensive security features designed to eliminate unauthorized operation and reduce costs and downtime.

• By utilizing a streamlined, single point of entry, SmartCard Authentication facilitates the user log-in process by requiring a card swipe instead of typing a User Name and Password.

• You control who has authorization, thereby maintaining cost efficiency and security.

Access Security• Ringdale FollowMe *

• Secure Printing - Print jobs are never lost, stolen or picked up accidentally - nothing gets printed until the user is identified and authenticated at the printer.

• Convenience Printing - Print jobs follow users to their choice of network printer.

• Authenticated Printing - Authenticate on the printer or MFP with PIN codes, bar codes, proximity, swipe or smart cards to enable equipment feature access and usage profiles.

• Green Printing - Advance green initiatives across the enterprise by eliminating duplicate print jobs at source, enforcing printing restrictions to conserve toner, paper and developer.* Not available in every location

Access Security• PaperCut FindMe *

• Secure Printing - Print jobs are never lost, stolen or picked up accidentally - nothing gets printed until the user is identified and authenticated at the printer.

• Convenience Printing - Print jobs follow users to their choice of network printer.

• Authenticated Printing - Authenticate on the MFP with username/password, proximity cards to enable equipment feature access and usage profiles.

• Green Printing - Advance green initiatives across the enterprise by eliminating duplicate print jobs at source, enforcing printing restrictions to conserve toner, paper and developer.* Not available in every location

Access SecurityBasic (Simple Authentication)• Department Codes

(with reporting)

Access SecurityEnhanced (Network Authentication)• Network Authentication w/RBAC• SmartCard Authentication

Access SecurityOptimal (Enterprise Tracking & Release)• Ringdale FollowMe• PaperCut FindMe

Document SecurityCountermeasures• SecurePDF• Private Print• Print to Hold• HardCopy Security

Document Security• Secure PDF

• Secure PDF provides control and protection for scanned documents sent to Email and network folders.

• With Secure PDF, users can assign a password to a scanned document that controls access to viewing, printing, editing and copying its content.

• Furthermore, up to 128-bit encryption can be applied to ensure it is stored safely. Usage Limitations can be set for copy and print jobs, in addition to black/white and color output limitations.

Document Security• Private Print

• Private Print offers complete control of print output by requiring users to input a password to initiate their printout.

• Private Print is ideal when printing confidential information by preventing other people from accidentally or intentionally picking up the wrong print job.

• Toshiba has made this process even more flexible by giving users the option to either print private documents individually, or to print multiple private documents at one time

Document Security• Print to Hold

• Print to Holdeliminates paper wastage through job loss by holding the job at the MFP and releasing it only on demand

Document Security• Hardcopy Security

• Hardcopy Security embeds a background image or configurable string(s) that reveal themselves if the document is copied.

Document SecurityBasic (Document Protection)• SecurePDF• Private Print• Print to Hold• HardCopy Security

End of Life SecurityPolicy• Policy Implemented

• As the owner of any HDD data it is the client’s responsibility for an end of life policy which ensures that as MFP and Printers reach their end of life either through lease end or technological refresh that the hard drive is scrubbed of all data.

Certifications• CCEVS Common Evaluation

and Validation Scheme• The CCEVS program recognizes and validates

security solutions based upon an internationally accepted methodology. Toshiba products comply with the Common Criteria Evaluated Assurance Level, and conform to ISO/IEC15408 (Information Technology Security Evaluation Criteria).

Standards• Dod – The Department of Defense

• The U.S. Department of Defense manual outlines rigid policies and standards in the interest of protecting the security of the United States. Toshiba’s Disk Overwrite solution clears and sanitizes hard disk drives that may contain classified information.