Does A Copy Machine Save Everything?

Your Copiers Are Storing Confidential Information: What You Can Do About It

All of us copy all kinds of things at work.

Many do not contain sensitive data, but some probably do: financial organizational information, donor information, confidential customer data — the list is a long one. Modern digital copiers and larger networked multifunction printers have hard drives that store all of the documents they copy, print, scan, or fax data and images. In this little-known area of data protection risk, there are things you can do to protect the privacy of your organization.

We are constantly hearing about the risk of malware and hacking data into computers and networks. We hear far less often of data theft from copiers or multifunction printers, universal in offices.

The security of copiers is a real risk. Modern industrial copiers and multifunction printers are simply hard-drive computers with network access. They are as vulnerable to data theft as anything that is in the IT system of your office. They can store copies of records, and even have use logs that hackers can access, as can anyone who services the machines.

Ensuring Network Security

Hopefully, the organization’s built protections for the IT network. Making sure that the copiers and printers connected to your network are securely integrated is reasonably easy, just as the network computers and servers do.

Modern commercial printers and copiers usually have a web-based interface that allows an IT administrator to view the status of the printer, see reports and configure multiple printer aspects. Here are a few safety precautions.

• Of course, the web interface should have a long and strong password.
• Also, HTTPS (SSL or TLS) encryption should be enabled for the interface as well. 
• Because copier and printer operating systems include a network firewall, it should be enabled and should limit access to just trusted people in your organization.

Ensuring Physical Security

• Many copiers and multifunction printers support full-disk encryption. Full-disk encryption scrambles all of the hard drive’s contents so that data can only be recovered using a secret key. Disk encryption prevents intruders from retrieving documents that are stored on the disk, even if they do get the data. A recommended type of encryption for use in printers (PDF) is the Advanced Encryption Standard ( AES).
• Commercial multifunction printers and copiers support an additional data security type, called automatic disk wiping or erasure of data. When disk wiping is enabled, the device will automatically erase and periodically overwrite all of the saved data. It’s a good idea to have the entire hard drive overwritten at least once a month.
• Allowing for automatic log wiping is also a very good idea. Print logs contain information of the users who are printing it, including the name of the text, the type of file and the date it was printed. Regularly, the print logs can be purged automatically.

Additional Precautions

If your organization has a service contract with a provider or copier company, consult with them to see what safeguards they are actually using for data protection — both within the copier and within their company. Modern copiers regularly give the company diagnostic information, and that information can contain confidential data about the constituent or donor.

If you don’t think your service contract has strong enough data security precautions, ask what the firm can do to reinforce them. This can involve a cost if the security features your printers don’t need. Close to all commercial multifunction printers and copier brands such as Ricoh, Canon, Xerox (PDF), Sharp, and Kyocera sell an optional data security kit.

A final concern when you remove any IT devices that store data, including old printers or copiers, is to be aware of data security. Make sure that the final destruction of data is part of your contract for service. With data on hard drives perfectly intact, many copiers find their way to second-hand markets.