Digital copiers a security threat

Security Policies and Procedures Manual Template

Order Security Manual Template Download Sample

Until recently CIOs and CSOs focused on external threats and developed strategies to address them. Now they are aware of internal threats and are focused on locking down IT systems even further to keep insiders and trusted vendors from taking data and/or compromising or inhibiting IT resources from proper operation. One area that often is overlooked is that potentially every digital copy machine and every digital fax machine is at risk for data leakage and/or data theft.

Digital copy machines can create and save digital versions of the documents they scan onto the copier's own internal hard drive. These copiers are often leased by office supply firms to the organizations mentioned above and, when the copiers are turned back over to the leasing agency at the end of the lease period, the data stored on the hard drive goes out the door with the copier; to unknown destinations all around the world. Once the copiers reach these destinations identity thieves, terrorists or others can pull out the drives and extract sensitive and damaging information: such as identity data, or intellectual property.

Action Items

In order to properly address this threat the people within the organization who are charged with information security need to have a thorough understanding of the technical operation of all copiers, copy systems, fax machines, fax systems and print queuing systems involved in the business operation.

Enterprises need a comprehensive equipment inventory in order to understand the size of the risk and to properly protect their critical information and data.

Technology security

When considering the lease or purchase of a copier, seriously consider technological safeguards. Many companies offer disk override or disk erase systems. These systems insure that each new document copied overrides the previous one, eliminating any potential threat. For a price, many copiers provide software to encrypt data being copied and stored and/or software to erase after each copy or an internal button to erase the drive upon completion of the lease.

Contractual security

Every leasing contract needs to be reviewed before it is signed to insure that before the copier or fax is returned to the lessor the hard drive can be removed and destroyed or wiped clean using a DOD type of erasing software provided as part of the copier's internals.

Security awareness

What can you do to minimize the risk? Make sure that each and every employee understands the risk associated with copying and faxing of documents. Make sure that they know what they need to do to guard against giving away your organization's proprietary or employee personal data.

Due diligence and trust

Recently in the news there have been many stories about inadequacies in security that could have led to disastrous impacts on the enterprises where they were found. At a health care firm, trusted employees were found to be using their system access privileges to gain entry into systems to obtain personal and financial information they would later use for financial gain. At a manufacturing firm a valued employee was found selling intellectual property to a competing firm for money and a job. And, at a bank in the south-west video cameras were placed at ATM machines by a thief to take pictures of credit cards and the keystrokes used to enter a personal pin so that later he could compromise the personal accounts of a series of unsuspecting bank customers. Now the very tools that make our operations more productive, that we use almost every day can also be the source of our largest information security compromise.

In the security business we learn that trust is very important. We also learn the mantra: 'trust but verify'. Trust but verify is the foundation of due diligence. Due diligence needs to become the essence and the watchword of both physical and information security programs at all enterprises in all market segments, financial, pharmaceutical, manufacturing, government, etc. Especially those that want to remain out of the press as one that has experienced a data breach.

Due diligence implies that oversight is always in place. That means that a continuous review of security controls is used to insure that they are applied correctly, functioning as desired, and continue to be utilized appropriately day-in and day-out. Security does not work in a 'set it and forget it' type of environment. We need to be ever vigilant and prepared to adjust, adapt, and make changes and to understand new technology where possible to aid in the protection of mission critical data.

Conclusion

As corporate or governmental IT security or business continuity experts need to make sure that they are ever vigilant and that we continue to communicate with our organizational leaders so that they have the necessary information to make informed choices for the protection of critical and sensitive information. Only then will we have given them the tools they need to make an informed decision on whether they want to act now to implement adequate controls and safeguards to protect against risks or to possibly pay later in reparations and lost confidence to those whose data they have been entrusted to protect and use which has been subsequently breached.

Security Policies are Comprehensive, Detailed and Customizable for Your Business

The IT Security Manual Template provides CIOs, CSOs, and IT Managers all of the essential materials with real live usable text for a complete security manual. Detailed language addressing more than a dozen security topics is included in a 230 plus page Microsoft Word document, which you can modify as much or as little as you need to fit your business requirements. The template includes sections on critical topics like:

• Risk analysis
• Staff member roles
• Physical security
• Electronic Communication (email / Smartphones)
• Blogs and Personal Web Sites
• Facility design, construction and operations
• Media and documentation
• Data and software security
• Network security
• Internet and IT contingency planning
• Insurance
• Outsourced services
• Waiver procedures
• Employee Termination Procedures and Forms
• Incident reporting procedures
• Access control guidelines
• PCI DSS Audit Program as a separate document
• Massachusetts Compliance Check List
• Security Compliance Check List

Order Security Manual Template Download sample Version History

The Security Manual Template can be acquired as a stand alone item (Standard) or in the Premium or Gold sets:

Order Security Manual Template Download sample Version History