Far from the innocuous single-function printers common in the late twentieth century, today’s networked printers and multifunction printers (MFPs) rival networked PCs in their ability to send and receive data. While it is doubtful that any organization would allow one of its PCs to be made publicly available in a hallway, providing easy, anonymous access to its internal network, it is not at all uncommon to find powerful printing and imaging counterparts in such situations. Although printerbaase security breaches are not yet common, industry watchers predict an increase as PCs and laptops become more secure and hackers go in search of an easier way to access valuable business intelligence.1 Scrambling to address this growing threat, many organizations are turning to print authentication as a cost-effective and relatively non-disruptive means of increasing security. Print authentication is a form of access control that enables organizations to: » Prevent unauthorized users from utilizing specific device functionality » Route sensitive documents to secure printers and regulate retrieval » Create an auditable paper trail detailing device usage to ensure regulatory compliance Methods of Authentication Generally speaking, there are two categories of print authentication controls: »Walk-up authentication – occurs at the device level and allows organizations to predetermine service availability based on specific user qualification criteria such as job function or title. » Network authentication – occurs at the infrastructure level and allows organizations to predetermine service availability based on specific technological criteria such as device type and location. It is not uncommon to find some form of both control categories in operation in many organizations today. Specific methods of authentication can vary widely from organization to organization and device to device but are typically broken into three distinct types: Authentication that is based on “things you know” » In printer password/PIN authentication – Users are assigned (or in some cases assign themselves) alpha-numeric PIN codes or passwords, which are associated with the level of service they are authorized to obtain. Codes are entered into a keypad on the device control panel. SPOTLIGHT ON SECURITY 2 in a series of 4 A quick look at print authentication Authentication that is based on “things you have” » Smartcards – These credit-card-sized badges have a magnetic strip containing coded access information. Cards are read by passing them through a detector at the device. » Common access cards (CAC) – These are smartcards that are issued to active duty military personnel, reserve personnel, civilian employees and eligible contractor personnel by the US Department of Defense (DoD). In addition to serving as a general identification card, CACs provide authentication that enables access to DoD computers, printing and imaging devices, and some facilities. Authentication that is based on “things you are” » Biometrics – This refers to authentication based on physical characteristics such as fingerprints or irises, or behavioral characteristics like voice or handwriting. Today, fingerprint biometrics is the most common form of biometric authentication for printing and imaging technology. Here is a quick look at some of the scenarios in which print authentication is useful and some of the many solution options available through HP and its partners to address them. Using print authentication to control access to MFP functionality PIN and Pull Printing allow print jobs to be saved electronically in the device or on an external server until the authorized user is ready to print them. The user provides a simple PIN code or uses an authentication method supported for other HP MFP walk-up operations to release the print job. Many HP printers and MFPs provide native support for PIN printing. With HP partner Capella Technologies’ subscriptionbaase authentication solution, MIPA PIN, users must enter their authorized alpha-numeric PIN code into the device keypad before they can utilize copy, color copy, fax or scan-to-e-mail functions. This approach not only prevents unauthorized users from accessing select functions, it also enables administrators to track utilization by employee, which can discourage frivolous or personal use. More importantly, MIPA PIN authentication creates an invaluable electronic paper trail should an MFP device’s fax or scan-to-e-mail capabilities be used to leak proprietary or confidential information. Using print authentication to control access to sensitive documents Developed by HP partner Jetmobile and available for almost the full range of HP devices, SecureJet enables secure mobile printing within an organization’s intranet. With SecureJet, users designate document recipient and handling criteria at the computer of origin. The print job is retained on the printer hard disk until the appointed recipient reclaims it by authenticating directly on the device. When required, encryption occurs in real time at the print engine while the document is printing. As a result of this innovative arrangement, data receives maximum protection at all times. Print Server Enter PIN Code and print job. SecureJet SecureJet Roaming print jobs can be stored on multiple servers and reclaimed from any enabled printer or MFP on the Intranet.Looking beyond authentication Printing and imaging technology evolves as security needs evolve. Because no two organizations or printing and imaging environments are alike, there is no such thing as one-size-fits-all. There are, however, some common-sense steps that every organization should take. » Turn on passwords, disable unused ports and services – It may sound simple, but these easily overlooked vulnerabilities can provide an open door into your network. » Update firmware images – Firmware updates protect against product defects and vulnerabilities. HP provides automated firmware update notification services. » Implement secure protocols – IPsec secures existing printing and scanning applications with strong encryption, while SNMPv3 and HTTPS secure management functions. Using server-based authentication to protect devices and data All HP MFPs and digital senders offer server-based Windows NTLM, LDAP, Kerberos and Novell authentication and authorization that integrates with your existing infrastructure to help your organization manage user access, prevent unwanted printing and digital sending, and help secure access to the management utility to prevent unwanted device configurations. Many HP MFPs have device-based LDAP authentication (embedded from HP or installable from Capella Technologies). The HP Output Server and the Microsoft® Print Spooler provide direct integration of domain accounts with printing access controls, which allows control of individual users and groups, including access rights to network printers. Want to know more? » HP provides a wide array of secure printing and imaging solutions for HP LaserJet printers and HP MFPs to help you simply and easily elevate the status of these devices to overall security plan. For details, visit www.hp.com/go/secureprinting. » To learn more about HP Managed Print Services, visit us online at www.hp.com/go/mps and www.hp.com/go/printservices. » For the remaining white papers in this series plus the latest research, tips and tools for lowering costs and improving IT, visit the HP Printing and Imaging Resource Center at www.hp.com/large/ipg. » See what other people in your industry are doing to manage their environments and keep their data safe. Visit www.hp.com/blogs/enterpriseprinting. Notes 1. “The Surprising Security Threat: Your Printers,” ComputerWorld, Deb Radcliff, January 2007. Why HP for printing and imaging security? HP has been an industry leader in printing and imaging innovation and reliability for more than 20 years. Whether you need to buy one printer, enhance the security of your entire fleet, or you want to improve and transform the way you manage your printing environment, HP has the expertise, experience and technology to deliver the right solution, right now. Looking for more accountability, security and a better return on your printing and imaging investments? HP Managed Print Services can: » Quantify the total costs of your existing printing and imaging infrastructure » Help you identify savings opportunities and reconfigure your environment to take advantage of them » Provide ongoing supplies, service and support designed to meet your company’s unique business needs » Monitor performance to maintain cost-effective and secure operation over time » Manage your printing and imaging environment for improved business results Your local HP representative can help you to explore a variety of cost-effective strategies for securing and enhancing your printing and imaging environment today and into the future. They can even help you to create a comprehensive security strategy that addresses your organization’s specific printing and imaging security concerns. Visit us on the web at www.hp.com/large/ipg © 2007 Hewlett-Packard Development Company, LP. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statement accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. 4AA1-5150ENUS, September 2007