The Unkown Security Risk In Your Office

The topic I wanted to touch on this week has to do with the security of documents in your organization.  Specifically, the security risks posed by printers, copiers, and multifunction devices in your office.   I have travelled around the country implementing document capture solutions, like ILINX Capture, that leverage the use of typical office multifunction devices and it amazes me how many companies do not know of this security risk.

How it started…

As technology advanced and data storage became more cost effective the internal workings of printers and multifunction devices changed.  The processing of documents for printing, scanning, and copying was offloaded from the computer or print server to the actual printer/copier device.  To handle the onboard processing for these devices, manufacturers began adding hard drives to printers, copiers, and multifunction devices.

What’s the risk…

In most cases, the hard drives in the printer, copier, and multifunction devices store a copy of every document that is printed, scanned, or copied.  This can be no big deal as long as the device is located in your office, but when the device is retired the documents on the hard drives are usually not wiped off and they go with the device.  Now you have a hard drive floating around with any number of confidential documents creating a huge security risk and possibly compliance violations.  The devices usually are packaged up and shipped overseas for a fraction of the original purchase price.  This is a scary thought because anyone could have access to your documents now.

The following is a recent news report that CBS News did on this very subject:     http://www.cbsnews.com/video/watch/?id=6412572n

What can you do…

• If you are leasing these devices, understand the contract between your company and the vendor/manufacturer.  Many times it is detailed in the agreement that the customer is responsible for the documents on the hard drive.  If it is up to your company to dispose of the records, take responsibility and ensure that this is done prior disposing of the device.
• Many manufacturers offer disk security and cleanup features for these devices.  It will most likely cost extra money, but the few dollars may be nothing compared to outfall of losing sensitive and confidential information.  One thing to keep in mind is that not all manufacturers will bring this topic up at purchase time.  Their number one objective may be to keep the price down and close the sale.
• Help spread the word of this risk.  Again, it amazes me how many organizations have no clue about this risk and with the publicity it will be getting in the near future we should see some progress in this area.

Please feel free to leave comments and let us know about your experiences and knowledge related to these devices and the risk they pose.  Thank you.

Ryan S. Keller

ImageSource, Inc.