Device security

Controlling access by authentication according to your security policies is necessary. Healthy, secured devices can offer another critical level of security, including remote insight into device configuration, alerts related to usage and supplies, critical service alerts, and warnings for upcoming service issues.

1. Device user authentication

The ability to track, control usage, and prevent unauthorized access is predicated on requiring users to authenticate before they can print, scan, fax, etc. Once logged in, users will only see the device functions and features they’re authorized to use. Various authentication options give you the ability to control the level of capabilities granted to each user or group of users. This may include restricting the ability to change machine settings and view address book entries or granting access to scanning workflows, document servers, and other functions. In addition, the User Lock-out function — which triggers if it detects a high frequency of successful or failed login attempts — helps guard against Denial of Service attacks or brute force password cracks.

2. Network user authentication

Ricoh devices support network user authentication to limit access to authorized users. For example, Windows® authentication verifies a user’s identity at the MFP by comparing login credentials (username and password, ID badge with or without PIN, or a combination of both) against the database of authorized users on the Windows network server. In the case of access to the global address book, LDAP authentication validates a user against the LDAP (Light-weight Directory Access Protocol) server — so only those with a valid username and password can search and select email addresses stored on the LDAP server.

For customers utilizing SmartCards for authentication, including U.S. Department of Defense Common Access Cards (CAC) or Personal Identity Verification (PIV) IDs, Ricoh offers solutions for enabling this type of authentication.

Software such as RICOH Streamline NX — a modular suite that covers scan, fax, print, device management, security, and accounting processes — provides additional network authentication options. These include authenticating against the LDAP, Kerberos authentication, and an available SDK for custom integrations.

3. Device network authentication

Many Ricoh devices support the IEEE 802.1X authentication protocol, which is frequently part of zerotrust architecture (ZTA) network implementations. This port-based network access control allows a network administrator to restrict the use of a network until a device has been properly authenticated. This ensures secured communication between authenticated and authorized devices.

Device protection

When machines aren’t performing as expected, there are not only costs associated with downtime, but it can negatively impact other user behaviour, which may include less-than-desirable workarounds.

Keeping device firmware updated can be accomplished remotely and in batches, and updates can be set to your schedule.

1. Firmware and driver management

Working with your service provider, organizations can maintain a line of defence by ensuring current firmware on your devices through proactive remote management. You can prevent printer device firmware from becoming outdated via a remote cloud portal. A device’s firmware can be remotely checked, and an update can be immediately pushed. Or, updates can be performed automatically on a scheduled basis.

Refreshing firmware for large numbers of devices or across an entire fleet can be handled as a batch upgrade in moments. Drivers can also be pre-configured and pushed to devices remotely. You can package drivers with the appropriate defaults according to your print and security policies — and control who has access to different driver packages.

2. Digitally signed firmware and applications

If an MFP or printer’s built-in software — also known as firmware — is altered or compromised, that device can then be used as a method of intrusion into the corporate network to damage the device or as a platform for other malicious purposes. Many Ricoh-designed devices include a Trusted Platform Module (TPM,) a hardware security module that validates the controller core programs, Operating System, BIOS, boot loader, and application firmware.

Ricoh MFPs and printers use a digital signature to judge firmware and application validity. The public key used for this verification is stored in an overwrite-protected, non-volatile region of the TPM. A root encryption key and cryptographic functions are also contained within the TPM and cannot be altered from the outside. Ricoh uses a Trusted Boot procedure that employs two methods to verify the validity of programs/firmware:

• Detection of alterations

• Validation of digital signatures

Malicious programs and firmware cannot be installed as packages lacking a verified digital signature cannot start. Covering the range of software from boot programs to end-point functions and applications, the Trusted Boot validation process provides comprehensive, TPM-based security. When updated firmware or applications are uploaded onto a Ricoh device, a similar process checks for a valid digital signature, and if not validated, updates are aborted and the update file is deleted. At that point, the device automatically reboots and will return to running with the previous firmware. In the unlikely event that firmware is altered in some other manner, Ricoh devices will prevent the execution of malicious firmware by halting the boot process and displaying a service call code.

3. Disable unused protocols and services

To make it easy to add network devices, many vendors’ network-enabled systems are routinely shipped to the customer with all network protocols and services set to “enabled or active” — but unused services on network devices pose a security risk. Compromised ports can lead to various threats, including the destruction or falsification of stored data, Denial of Service (DoS) attacks and viruses or malware entering the network.

There is a simple but often overlooked solution for this particular risk source: disable all unrequired services. Ricoh device administrators can easily lock down unneeded services, helping to make devices less susceptible to hacking. In addition, specific protocols — such as SNMP or FTP — can be completely disabled to close off the risk of them being exploited.

4. Access control

The administrator can limit devices or protocols that can connect to the machine to avoid unintended access. Also, the administrator can select a security level at which to enable or disable a protocol and to configure the port status. They can block machine access and then allow it only from/to the IP addresses specified in reception/transmission filters. Up to five sets of filters, consisting of an IP address, a port number, and a protocol, can be defined for reception and transmission.

5. Fax line security

Enabling a device’s fax feature may mean connecting it to the outside via a telephone line — which means that blocking potential unauthorized access via the analog fax line is critical. Ricoh embedded software is designed to only process appropriate types of data (i.e., fax data) and send that data directly to the proper functions within the device. Because only fax data can be received from the fax line, the potential for unauthorized access from the fax line to the network or programs inside the device is eliminated.

The Facsimile Control Unit (FCU) in Ricoh fax-enabled devices supports only G3 FAX protocols. Therefore, even if an initial connection is established with a terminal that does not use these protocols, the MFP will view this as a communication failure and terminate the connection. This prevents access to internal networks via telecommunication lines and ensures that no illegal data can be introduced via these lines.

6. Simplify managing devices

Managing devices can be time-consuming, and security gaps can emerge unintentionally when aspects of proper device management go unattended. Ricoh device management software, such as Streamline NX, gives IT managers a central control point to monitor and manage their fleet of network-connected print devices — whether spread across multiple servers or geographic regions — from a single management console.

Here’s how Ricoh does it:

• SNMPv3-encrypted communications between devices and servers

• Central controls allow administrators to control access, monitor security settings, and manage device certificates

• Automated firmware update tasks reduce exposure from outdated firmware

• Deploy customer-approved firmware versions, or use the latest firmware available from Ricoh

• The Security Analyst feature for Streamline NX provides an at-a-glance dashboard for assessing device security policy compliance and offers a best practices checklist for whether devices are in policy

7. Meters and alerts

When an early warning enables teams to resolve a problem before it causes downtime, it helps reduce the risk of unexpected user behaviour, such as unsanctioned workarounds. If machines are not operating as expected, users may choose a different, unsecured course of action. They may print or scan from a local device with no ability to audit activity or protect the data being moved.

Using monitoring and management software with devices lets you collect information and keep your device healthy with timely alerts. This includes automatic collection of meter data based on your set schedule, low/ replace toner alerts, critical service alerts, and upcoming critical service issues.

8. @Remote.NET

Ricoh’s @Remote Connector NX enhancement for Streamline NX collects approaching critical service alerts and communicates them directly to your service provider. Your provider can schedule remote firmware updates and push critical updates immediately. The @Remote Connector also collects device meters and makes them available on a pre-defined schedule — along with notifications of consumables levels — to maintain uptime and reduce administrative burden. The collected data is available via the @Remote.NET web portal.

9. Physical port security

On Ricoh devices, physical ports (USB, SD card, etc.) can be controlled by the device administrator, thereby preventing users from storing to or printing from external memory devices.

1. Drive and memory encryption (data at rest)

If the drive is physically removed from a Ricoh machine, the encrypted data cannot be read. Once enabled, the drive encryption function can help protect an MFP’s drive and non-volatile RAM against data theft while helping organizations comply with corporate security policies. Encryption includes data stored in a system’s address book — reducing the danger of an organization’s employees, customers, or vendors having their information misappropriated. The following types of data — which are stored in non-volatile memory or on the drive of MFPs — can be encrypted:

• Address book

• User authentication data

• Permanently and temporarily stored documents

• Logs

• Network interface settings

• Configuration information

2. Device network encryption (data in transit)

As information moves through the network, a knowledgeable hacker can intercept raw data streams, files, and passwords. Without protection, unencrypted information can be stolen, modified, or falsified and re-inserted back into the network with malicious intent. To combat this, Ricoh uses encryption and robust network security protocols that can also be configured according to customers’ needs. For example, the Transport Layer Security (TLS) protocol is used to help maintain the confidentiality and integrity of data being communicated between two endpoints. Many Ricoh devices support TLS 1.3, the most current version of that protocol.

3. Print stream encryption

Data sent in a print stream can be exploited if unencrypted and captured in transit. Ricoh enables the encryption of print data using Secure Sockets Layer/Transport Layer Security (SSL/TLS) via Internet Printing Protocol (IPP) — encrypting data from workstations to network devices or MFPs. Because this is a protocol that helps maintain data confidentiality, attempts to intercept encrypted print data streams in transit would only produce data that is indecipherable. Data sent to printers could be misused or attacked if it is not encrypted.

4. End-to-end driver-based encryption

Concerns about a malicious attack on print job data can be addressed using the Ricoh Universal Print Driver for end-to-end encryption of print data between the user’s system and the Ricoh MFP. End-to-end encryption can be enabled in the print dialog so a user can set an encryption password. To release the print job, the user enters the encryption password at the Ricoh device, which then decrypts the data and prints the job. This method of print data encryption utilizes AES-256 encryption.

5. IPsec communications

Ricoh multifunction printers can use IPsec for encrypted communications. IPsec enables communications in units of secure packets at the IP protocol level. Even if no encryption is used by a high-order protocol or application, IPsec enhances security by preventing the communication content from being tapped into or altered.

More security features

1. Locked print

Printed documents sitting on the paper tray or left out in the open can be picked up by anyone. This puts the document’s information at risk, and the potential impact grows dramatically when printing confidential documents. Ricoh locked print capabilities can hold encrypted documents on the device’s hard drive until the document’s owner arrives and enters the correct PIN code or network credentials. For even more capability, software such SLNX can provide full-featured secured document release — giving users options over their secured print queue while letting administrators maintain control.

2. Copy data security

Ricoh offers functions to thwart unauthorized copying of hardcopy documents — helping prevent possible information leaks. The copy guard function prints and copies documents with special invisible patterns embedded across the background. If the printed or copied document is photocopied again, the embedded patterns will become visible on the copies.

The unauthorized copy control function protects against unauthorized copying in two ways. Masked Type for Copying embeds a masking pattern and message within the original printout, safeguarding the information. If unauthorized copies are made, the embedded message appears on the copy. This might include the document author’s name or a warning message. When the Ricoh device detects the masking pattern, the printed data is obscured by a gray box that covers all but a 4mm margin of the masking pattern.

3. Compulsory security stamp

Stamping documents with key identifying information can achieve greater accountability and management control. Mandatory security information print is a feature that forces key information — including who printed a document, when it was printed, and from which device — to be printed with a document. This feature can be enabled for copy, print, fax, and document server functions.

Administrators can select the print position and which types of information will be automatically printed on the output, which may include:

• Date and time the job was printed

• Name or login user ID of who printed the job

• IP address and/or serial number of the device used

4. Temporary data removal

When a document is scanned or when data is received from a PC, some may be stored temporarily on the hard disk drive or memory device. This can include scan/print/copy image data, user-entered data, and device configuration. This temporary data represents a potential security vulnerability.

The DataOverwriteSecurity System, built into most Ricoh devices, addresses this vulnerability, destroying temporary data stored on the MFP’s hard disk drive by overwriting it with sequences of 1 and 0. Temporary data is actively overwritten and thereby erased each time a job is successfully completed.

The DataOverwriteSecurity System can also:

• Include options for Canadian Security Intelligence Service (CSIS) and Department of National Defence (DND) recommendations for handling classified information

• Make it virtually impossible to access latent data from copy/print/scan jobs once the overwrite process is complete (overwrite process can be selected from 1 to 9 times)

• Assist customers in their compliance with HIPAA, PIPEDA, PHIPA, GLBA, FERPA, and other regulations

• Provide visual feedback regarding the overwrite process (i.e. Completed or In-Process) with a simple display panel icon

5. Fax number confirmation

People can easily make mistakes when entering a fax number directly on the keypad. Our engineers can set up the device so that the number needs to be entered twice or more for confirmation. If different numbers are entered, the transmission will not commence. This feature minimizes the risk of sending information to the wrong destination.

Common Criteria is used internationally for the evaluation of information technology security. It is used for measuring whether security functions are appropriately developed for IT products. The Common Criteria Certification is a standard recognized by more than 25 nations of the world. Domestic and overseas multifunction copier vendors are eager to obtain authentication for digital multifunction copiers.

The Common Criteria Certification process verifies protection provided by multiple security technologies against various security threats. The certification covers, for example, system validity verification at the start, access control and logging, data protection by encryption and data deletion at machine disposal. Therefore, it helps protect our products from various threats — such as software alteration, invalid access, and information leakage.

Protection Profile for Hardcopy Devices (PP_HCD_V1.0)

PP_HCD_V1.0 is a U.S. government-approved protection profile for hardcopy devices such as digital MFPs. It was developed by the Multifunction Printers Technical Community with representatives from industry (including Ricoh), U.S. and Japanese government agencies, Common Criteria Test Laboratories, and international Common Criteria schemes. The purpose of this Protection Profile (PP) is to facilitate efficient procurement of Commercial Off-The-Shelf (COTS) Hardcopy Devices (HCDs) using the Common Criteria (CC) methodology for information technology security evaluation.

The following areas — which have been identified as among the most important for security protections — have been validated in most Ricoh devices to the PP_HCD_V1.0 standard and can be enabled:

• User identification and authentication systems

• Data encryption technology available for multifunction printers

• Validation of the system’s firmware

• Separation of the analog fax line and the copy/print/scan controller

• Validation of data encryption algorithms

• Data protection

At Ricoh, our product line is constantly being enhanced to meet our customers’ and regulators’ changing requirements. Please visit the website for the complete list of Ricoh devices with ISO/IEC 15408 certifications.

IEEE 2600.2

The IEEE 2600.2 security standard pertains to hardcopy devices operating in a commercial information processing environment — with required levels of document security, network security and security assurance. It establishes a common baseline of security expectations for MFPs. To ensure that a device demonstrates conformance with the established standard, independent third-party laboratory tests provide verification of the manufacturer’s security features. Ricoh offers a broad line of MFPs that have been certified as conforming to the IEEE 2600.2 security standard.

FIPS 140-2/3

he Federal Information Processing Standard (FIPS) 140-2/3 is a U.S. government security standard for validating cryptographic modules through the National Institute of Standards and Technology’s (NIST) Cryptographic Module Validation Program (CMVP). Many cryptographic modules in Ricoh devices use algorithms that are recommended or approved by NIST, including algorithms validated under NIST’s Cryptographic Algorithm Validation Program (CAVP). CAVP validation is a prerequisite for CMVP validation.

Customers can upgrade certain devices to a CMVP validated drive* and an MFP firmware upgrade that will incorporate CMVP validated modules elsewhere within the MFP**. Firmware-upgraded devices will implement certain device hardening measures — including turning off less secured ports, protocols and limiting some application use. When a machine is being returned at the end of its lease or lifespan, the Erase All Memory function can be used to remove stored data from various areas of the device.