Printer/Copier/Fax Machines

[F.Viljoen]

Eye opener nou op Carte Blanche gesien rakende Printer/Copier/Fax masjiene.(Standalone)

Of dit nou 'n masjien by die werk, of een van die winkels waar jy kopiee/fakse kan maak, dit wat jy dink is vertroulik, sit op die masjien se hardeskyf.

So enige inligting kan deur iemand bekom word wat toegang tot die hardeskyf kry, hetsy die masjien by jou gekoop of die firma wat die masjiene uit verhuur.

[Jan Horn]

Care to give us hints how to secure our data Darryl?

[fugglefeet]

Hi all,

I also watched the same feature on Carte Blanche last night. Every copier that has a HDD in it, which is not properly secured through two known methods of data protection, are susceptible to having the data extracted from them. The two methods I am aware of to protect such data are as follows:-

1.) Data Encryption
2.) Disk Overwrite

The methods are reasonably self explanatory and I will elaborate a bit on both.

The data encryption method writes random bits (1's and 0's) into the existing scanned data using a predefined random bit depth (8, 16, 24 and so on number of bits). This makes decrypting the data on the HDD virtually impossible and hence any scanned images stored on the HDD irretrievable using forensic software to obtain the data.

The disk overwrite method overwrites the scanned images on the HDD with an algorithm employed to wipe the disk a preset number of times (1, 3, 7 and 35 times) with random sequences of bits in an attempt to make the data irretrievable. The disk wipe when performed on a disk can vary from a few hours to about 2 days nonstop.

The next question is whether both can be combined to wipe the data completely from the HDD? If the MFP (multi function printer) is equipped with both options, it would be possible to do it. The one thing that was strongly highlighted in the feature, is that the onus of data security rested with the end user of the MFP and that would entail making sure that the machine is equipped with either and/or or both features and that these features are working. The other aspect of security that was also mentioned regarding this, was that the use of passwords on these devices needed to be used and the passwords be changed on a monthly basis, thereby adding to the general security of the device. Since I have worked for a number of companies and have seen these technologies present, the end user needs to find out from their respective supplier before upgrading these devices if the new equipment has these features as standard or whether it's optional. Obviously if it's optional, then it means that an extra cost will be incurred to have the feature. The other alternative is to remove the HDD from the machine and have it given to the customer's IT department to perform a disk wipe using software to perform this function that would totally erase all data from the HDD. This would take place prior to the machine being returned to the supplier and once the contract is terminated. The other more drastic measures mentioned in the feature last night are also the most effective (that is to Degauss or shred the HDD's). That way the data doesn't fall into the wrong hands.

Hope this info helps.

Darryl