Security

Ask something
Discussion Locked

Are Multi-Function Printer a Security Risk?

0 helpful
7 replies

by sgeorge

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello to all,

Some of my users work as veteran?s advocates within Veterans Administration offices across the country. As such they are gests on the VA's network subject to there rules and guidelines. Recently I was informed that they are not allowed to use Multi-Function Printers due to the possibility of someone gaining access to the network by dialing into the Fax line of the Multi-Function Printer. Is this a real possibility?

7 replies

by bfilmfan

HIPPA forbids individuals without a clear need-to-know from potentially accessing client sensitive data. Is it possible that they could inadvertanly pick up a print out that had social security or health-related sensitive information?

Yes, it is. And you will see the effects of HIPAA expand as the government begins auditing both government and private companies to verify compliance. A whole industry is going to ramp up for audting HIPAA compliance after the government levels a fat hefty fine for failing to comply with the law (that's a hint for you younger engineers that are hungry for a new career opportunity in IT!)

by sgeorge

To my knowledge this is not due to HIPAA. They are not saying they cannot have a Fax, just that it cannot be part of a MFP. They are saying that someone can dial into the MFP Fax, access the PC that it is attached to through the printer interface and thus gain access to the network. This sounds a bit far fetched to me.

by capstonecollege.com

The school where I teach is betting on that. There is clearly going to be a demand for medical IT specialists. This month I am being sent on a training for certing as a HIPAA instructor, and starting in June we will be offering a Medical IT program.
The cool thing is that HIPAA fits pretty nicely with other IT security issues and certs. Both Comptia's Security+ and CISSP apply to the Certified HIPAA Security Specialist cert from HIPAA Academy.

by charlieharley

I work for company that sells and installs MFPs from different manufacturers and yet to find one (mfp)that will act or work like a bridge from fax line to network.
Hope this helps

by peltw

A recent article written by an industry security expert recommended purchasing MFPs where the fax and network circuitry resided on two separate circuit cards in order to prevent a hacker gaining access to the network via the fax/modem phone line. Is this a common practice for manufactuers to follow (two separate cards)? Is it possible to have circuitry that physically resides on one card yet is logically separated and therefore prevents the possibility of an intrusion? I'm having trouble locating MFPs that have separate cards. I've found one model (manufactured by Sharp, Model im3511) that has 2 cards. Other manufactuere's documentation says its not possible to hack through. Who am I to believe?

by robo_dev

I think it was a Canon MFP where you could gain remote access thru the modem.

Most of these MFPs are a UNIX or LINUX box, either a PC or a powerPC box.

For example, if you look at a Xerox MFP, there's basically a PC running LINUX attached to the rear of the machine. It's got a 20gig hard drive, and if you're not careful, everything you ever scanned or printed is on that hard drive.

The thing to watch out for is that many vendors like to be able to do remote diagnostics or gather page counts via the modem, so this security hole may exist.

by forum surfer

a total pain in my @$$! Why can't people deal with a network printer, get up and walk 5 feet to a printer close by? If you print that much, batch your printjobs and send them out when you need to get up and stetch. Those things are junk for enterprise use anyway, they never last long.

This discussion is closed to new replies.