Peripheral threats

Network security usually ' and logically ' has a digital focus. But you shouldn't forget about where ink hits paper.

Information is routed in huge amounts through networked printers, copiers and scanners every day, moving hard-copy data into information technology systems and putting digital data onto paper. And although most federal agencies have been working hard to secure their systems, little thought has been put into securing these devices.

This is bad news. The potential problem of smart peripherals has developed gradually, as stand-alone scanners, faxes and copiers have been integrated into online printers. Not only are these peripherals privy to sensitive information, they often have their own IP addresses and can be vulnerable to network attacks.

Although access to a printer typically requires a user to already have network access, incoming devices such as scanners often have no access control.
A malicious hacker, for instance, could serendipitously copy material as it crosses the memory of one of these devices or send forged documents from what might appear to be an official fax machine.

'In the past seven or eight years, the vast majority of these devices have become network-enabled,' said Bill DeStefanis, director of product management at security appliance vendor eCopy. They went from being islands that presented little threat to the enterprise to being integral parts of the network. 'It doesn't do just copying. In most organizations, it's a network printer device. Like any other technology, functionality was put forth first and the security was addressed later.'

'The printers are becoming more capable in what they can do,' said Don Wright, director of standards at printer manufacturer Lexmark International. 'They look like computers with the ability to spit out paper, and they are increasingly being linked to the network.'

The good news is that the Institute of Electrical and Electronics Engineers is addressing the issue by creating security standards for printers, copiers and other hard-copy devices.

Wright, who also is chairman of the IEEE working group that is writing hard-copy device security standards, said the need for this work was highlighted by the National Institute of Standards and Technology.

'A couple of years ago, NIST put together a workshop to look at creating security checklists for off-the-shelf products,' he said. 'Most of it was about operating systems and PCs,' but the need to address peripherals also was apparent. Out of this came the IEEE P2600 working group.

There had been some disjointed efforts to create security targets for these devices under the international Common Criteria scheme, but there were no broad industry standards for how they should be secured.

'The printer industry came together to do that,' Wright said. The working group is cooperating with the National Information Assurance Partnership, the U.S. government organization overseeing the Common Criteria standards, to develop protection profiles for the program in parallel with the industry standards. Both will define functionality and configuration requirements in four security environments. The IEEE standards will focus on commercial, nonmission-critical requirements.

Work on the projects began in 2004 but has been complicated by NIAP's production of a new version of Common Criteria. The working group targeted CC Version 2.3 for its profiles but had to shift its target to Version 3.0, which NIAP then abandoned in favor of the current Version 3.1.

'It has been a trying time,' Wright said. 'Our timing was as bad as it could be.'
But work on the industry standards has progressed, and final versions are being pulled together now.

'We would expect to open it up to the balloting process late this year or early next year,' Wright said. Balloting could take another three or four months.
While IEEE hammers outs the specifications, agencies can look to another standard to help secure devices ' the 2004 Homeland Security Presidential Directive 12.

HSPD-12 to the rescue

HSPD-12 mandated the use of new smart identification cards 'in gaining physical access to federally controlled facilities and logical access to federally controlled information systems,' according to the directive.

Using digital credentials to log on to a network through a PC equipped with a card reader is becoming common, especially in the military. The Defense Department already has issued more than 10 million of its Common Access Cards, and civilian agencies are beginning a long process of issuing personal identity verification cards to meet the requirements of HSPD-12.

The millions of standardized smart ID cards being put into the hands of military personnel, federal employees and contractors offer the opportunity to improve the security and accountability of multifunction hard-copy devices.

'We have been using CAC cards for computer log-in for about a year now,' said Sgt. Collin Johnson, chief of information services for the Utah Army National Guard. When word came down from headquarters that they should begin thinking about using the cards for access to copiers and scanners, 'we decided to implement that.'
The Guard is rolling out ScanStation from eCopy. The appliances not only provide authentication and access control to peripherals with a CAC reader but also integrate scanners and copiers with business applications.

'It gives us better security,' Johnson said. Scanners cannot be accessed without a CAC, and there is an auditable record of each use. 'It also gives us greater capabilities,' such as faxing, e-mailing and document management. 'It gives us a lot of opportunity to adjust and add things.'

The CAC-enabled ScanStation was developed at the request and with the help of the Massachusetts National Guard, DeStefanis said. As it became increasingly clear that peripherals were leaving an unsecured back door to the network because of their increasing functionality, military facilities would have to either secure scanners and copiers or forgo the convenience of importing data from printed material.

'They had a requirement to authenticate using these standards,' DeStefanis said. 'All they wanted to do was become compliant.'

The solution that eCopy came up with is built on its existing ShareScan software, which can be embedded in a hard-copy device to tie into applications and provide workflow functionality, or it can run on the ScanStation PC appliance. The software lets users scan documents directly into an application, and it is tied into Microsoft Exchange to handle authentication by user name and password, DeStefanis said.

'The government represents a large portion of our business,' he said. But, 'previous versions of ShareScan weren't aware of smart cards. We had to change our software to receive and pass those tokens. It wasn't too dramatic a challenge. We already understood how to authenticate against applications. This was just a different way of doing it.'

Development took a little more than two months' effort. 'We did have to scratch our heads a few times, but that was from a logistics standpoint,' in duplicating the CAC environment, DeStefanis said. The result is the same PC interface on ScanStation that National Guard members use to log on to the network. 'We're agnostic to what card readers you use,' DeStefanis said.

When the Utah National Guard wanted a CAC access-control solution, the eCopy ScanStation was an attractive choice. The guard already was using the DocSend workflow management system from IKON Office Solutions, but it would not support a card reader. There were some Canon scanners and copiers on the system, and Canon said it could support the eCopy system.

'We're going to have to replace the older systems' using DocSend anyway, so they are being replaced with Canon copiers linked to a ScanStation for authentication, Johnson said. 'This is basically an add-on.'

ShareScan not only provides access control and auditing capability, it is a good workflow tool as well, Johnson said.

The system is being rolled out, slowly, to 40 armories statewide.

'We have had a few problems,' Johnson said, and some of the software has had to be reinstalled because the installation sequence is very specific. But the eCopy support has been good. A bigger challenge has been budgets. The original schedule called for the new systems to be installed by June 1, but the expected money did not come through.

'We're still adopting,' Johnson said. 'It's going to take some time. We're implementing it as we can get new machines.'
The Institute of Electrical and Electronics Engineers is developing a series of security standards for selecting, installing, configuring and using peripherals such as printers, scanners, copiers and fax machines.

The P2600 series of standards defines rules for authentication, authorization, privacy, and physical and information security. They will define protection profiles for four operational environments.

Creating a consensus on security standards can be daunting ' and just coming up with names can be a challenge, said working group chairman Don Wright of Lexmark.
'We could never get a broad agreement on names for the environments, so we call them A, B, C and D,' he said.

The protection profiles for the four operational environments are:

• IEEE P2600.1 for Operational Environment A, the most rigorous, will address hard-copy devices in restrictive commercial information-processing environments requiring a relatively high level of document security and accountability. This would include trade secrets and material subject to legal regulation.
  
• IEEE P2600.2 for Operational Environment B will cover moderate security needs for day-to-day proprietary information.
  
• IEEE P2600.3 for Operational Environment C will address public-facing systems in which document security is not guaranteed but some level of access control is needed. Such environments could include retail copy centers, public libraries and Internet cafes.
  
• IEEE P2600.4 for Operational Environment D, the least rigorous, will address small, private environments where only a basic level of network security from outside abuse is needed. This could include small and home offices.