Canon Paper Shredder User Manual
INTENT OF THIS DOCUMENT:
Canon recognizes the importance of information security and the challenges that your organization
faces. This white paper provides information security facts for Canon imageRUNNER ADVANCE
systems. It provides details on imageRUNNER ADVANCE security technology for networked and
stand-alone environments, as well as an overview of Canon’s device architecture, framework and
product technologies as related to document and information security.
This white paper is primarily intended for administrative personnel responsible for the configuration
and maintenance of imageRUNNER ADVANCE systems. The information in this document, in
conjunction with other best practices, may be used as guidance to help improve your organization’s
overall security. Some security settings may affect device functionality or performance. You may
want to test these settings before deploying them in your environment to ensure you understand
their effects.
Canon does not warrant that use of the information contained within this document will prevent
malicious attacks, or prevent misuse of your imageRUNNER ADVANCE systems.
Products shown with optional accessories/equipment. The features review in this white paper include both standard and
optional solutions for imageRUNNER ADVANCE systems. Specifications and availability subject to change without notice.
White Paper: Canon imageRUNNER ADVANCE Security
Version 1.0
June 14, 2010
2
White Paper: Canon imageRUNNER ADVANCE Security
1.
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.
Device Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3.
Information Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.
Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5.
Security Monitoring & Management . . . . . . . . . . . . . . . . . . . . . 29
6.
Logging & Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
7.
Canon Solutions & Regulatory Requirements. . . . . . . . . . . . . . 32
8.
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
9.
Addendum. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table of Contents
3
White Paper: Canon imageRUNNER ADVANCE Security
Section 1 — Introduction
“If you look at these machines as just copiers or printers, you first wonder if you really need security.
Then you realize conventional office equipment now incorporates significant technology advances
and capabilities that make all documents an integrated part of a corporate network that also involves
the Intranet and Internet. Government agencies, corporations and non-profits are increasingly
transitioning from traditional stand-alone machines to devices that integrate these functions and link
them to corporate networks, raising a whole new era of information management and security
issues.
Our development of features within Canon imageRUNNER ADVANCE systems are designed to help
prevent data loss, help protect against unwanted device infiltration and help keep information from
being compromised.”
—Dennis Amorosano, Sr. Director
Solutions Marketing & Business Support, Canon U.S.A., Inc.
As the marketplace has evolved, the technology associated with office equipment continues to
develop at an ever-increasing pace. Over the last several years alone, traditional office equipment has
leapfrogged in technology, expanding its functional capabilities, while at the same time becoming an
integral part of the corporate network and the Internet. As a result, a new level of security awareness
has become imperative.
Canon’s attention to emerging market trends and details surrounding customer security requirements
has driven the development of features within imageRUNNER ADVANCE systems, which has been
designed to help thwart data loss and the potential threats posed by hackers.
1.1 — Security Market Overview
In today’s digital world, risks to networks and devices come in more forms and from more directions
than ever before. From identity theft and intellectual property loss to infection by viruses and Trojan
horses, IT administrators today find themselves playing an additional role of security officer to
adequately protect information and assets from threats from the outside as well as within.
Nearly every day destructive threats emerge and undiscovered vulnerabilities are exposed, proving
that you can never be too secure. IT administrators need a holistic security strategy that can be
applied at every level of the organization — from servers, desktops and devices such as MFPs, to the
networks that connect them all.
As if the risks to computers, networks and devices weren’t difficult enough to address, increased
governmental regulations add an additional layer of strict compliance standards that must be met.
Legislation such as Sarbanes-Oxley Act (SOX), Gramm-Leach-Bliley Act (GLB), Health Insurance
Portability and Accountability Act (HIPAA) and Family Education Rights Privacy Act (FERPA) all require
that IT administrators ensure the security, privacy, accuracy and reliability of information receives the
utmost attention.
1.2 — Imaging & Printing Security Overview
Today’s multifunction devices share many similarities with general purpose PCs. They contain many
of the same components like CPUs, memory and hard disks; and some even use mainstream
operating systems like Windows or Linux. Like any other device on the network, sensitive information
may be passed through these units and stored in the device’s hard disk and memory. Yet at many
companies multifunction devices are not given the same attention concerning information security.
The Canon imageRUNNER ADVANCE Security White Paper has been designed to provide detailed
information on how imageRUNNER ADVANCE systems can address a wide variety of security concerns.
Canon imageRUNNER ADVANCE systems offer many standard security capabilities, as well as a
number of advanced security options that may be added for a higher level of confidentiality, integrity
and availability of your mission critical information.
1.3 — Key Security Concentration Areas
Canon recognizes the vital need to help prevent data loss, protect against unwanted device use, and
mitigate the risk of information being compromised. As a result, all imageRUNNER ADVANCE systems
include many standard security features to help safeguard information.
Canon imageRUNNER ADVANCE security capabilities fall into five key areas:
• Device Security
• Information Security
• Network Security
• Security Monitoring / Management Tools
• Logging & Auditing
Canon dedicates a significant amount of time and resources to continually improve the security
capabilities of its imageRUNNER devices. Numerous robust capabilities are available for
administrators to restrict access to the device’s features and functions at a granular level, while
maintaining high availability and productivity.
4
White Paper: Canon imageRUNNER ADVANCE Security
Section 1 — Introduction
2.1 – imageRUNNER ADVANCE Controller Security
The imageRUNNER ADVANCE series is built upon a new platform that provides powerful
enhancements to security and productivity. The new architecture centers on a new operating system
powered by an embedded version of Linux, which is quickly becoming the most widely adopted
platform for sophisticated devices. The source version used by imageRUNNER ADVANCE devices has
been hardened by removing all unnecessary drivers and services so that only the ones essential to its
operation are included.
2.2 – Authentication
Canon imageRUNNER ADVANCE systems include a number of authentication options which
administrators can use to ensure that only approved walk-up and network-based users can access the
device and its functions, such as print, copy and Scan and Send features. Beyond limiting access to
only authorized users, authentication also provides the ability to control usage of color output, and
total print counts by department or user.
Devic
e-Based Authentication
Department ID Mode
An embedded feature within imageRUNNER ADVANCE systems, the Department ID
Management mode permits administrators to control device access. If Department ID
authentication is enabled, end users are required to enter a password before they are able to
access the device. Up to 1,000 Department IDs can be configured and each can be configured
with device function limitations, such as limiting, printing, copying and access to Advance
Boxes, Mail Boxes and facsimile.
Access to Advanced Boxes, Mail Boxes, and Scan and Send (if applicable) can each be turned
“On” or “Off” from the Limit Functions screen located under Department ID Management.
The settings can be made under Settings / Registration > Management Settings > User
Management > Department ID Management.
Single Sign On (SSO) and SSO Hybrid (SSO-H) Login
Single Sign On (SSO) is a MEAP login service that can be used stand-alone with user data
registered locally on the device or in conjunction with an Active Directory (AD) network
environment. SSO supports the following modes:
• Local Device Authentication – with credentials stored in the device
• Domain Authentication – in this mode, user authentication can be linked to an
Active Directory environment on the network
• Domain Authentication + Local Device Authentication
When used in Domain Authentication mode, a user must successfully authenticate using valid
credentials on the system’s control panel, Remote UI utility, or web browser when accessed via
a network prior to gaining access to any of the device functions.
SSO ships standard with MEAP capable imageRUNNER ADVANCE systems and can support up
to 200 trusted domains plus the users that belong to the same domain as the device.
5
White Paper: Canon imageRUNNER ADVANCE Security
Section 2 — Device Security
Canon imageRUNNER ADVANCE systems also ship with SSO-H, which supports direct
authentication against an Active Directory domain using Kerberos or NTLMv2 as the
authentication protocol. SSO-H does not require any additional software to perform the
user authentication as it is able to directly communicate with the Active Directory domain
controllers. In Local Device Authentication mode, SSO-H can support up to 5,000 users.
Card-Based Authentication
uniFLOW Card Authentication
When combined with the optional uniFLOW Output Manager Suite, imageRUNNER ADVANCE
systems are able to securely authenticate users through contactless cards, chip cards,
magnetic cards and PIN codes. uniFLOW supports HID Prox, MIFARE, Legic, Hitag and Magnetic
cards natively using its own reader, as well as others through custom integrations. Certain
models of RF Ideas Card Readers can also be integrated to support authentication using
radio-frequency identification (RFID) cards.
Advanced Authentication—Proximity Card
Using a MEAP application, imageRUNNER ADVANCE systems can be customized to
automatically perform user authentication with contactless cards typically used in corporate
environments. User data can be stored locally in a secure table to eliminate the need for an
external server, or integrated with an existing authentication server through customization.
Support is provided for cards from HID Prox, HID iClass, Casi-Rusco, MIFARE and AWID.
Customization can also be performed to provide support for other card types.
Authorized Send for CAC/PIV
To fulfill the strict security requirements of government agencies as dictated by Homeland
Security Presidential Directive-12 (HSPD-12), imageRUNNER ADVANCE systems support the use
of Common Access Card (CAC) and/or Personal Identity Verification (PIV) card authentication
for the embedded Authorized Send MEAP application. Authorized Send for CAC/PIV is a
server-less application that protects the Scan-to-Email, Scan-to-Network Folder and
Scan-to-Network Fax functions, while allowing general use of walk-up operations like print
and copy.
Authorized Send for CAC/PIV supports two-factor authentication by prompting users to insert
their card into the device’s card reader and requiring them to enter their PIN. ASEND for
CAC/PIV supports the Online Certificate Status Protocol (OCSP) to check the revocation status
of the user’s card, and then authenticates the user against the Public Key Infrastructure (PKI)
and Active Directory. Once authenticated, users can access the document distribution features
of Authorized Send.
Authorized Send for CAC/PIV supports enhanced e-mail security features such as
non-repudiation, digital signing of e-mail, and encryption of e-mail and file attachments.
The cryptographic engine used by Authorized Send for CAC/PIV is based on the industry
leading RSA BSAFE security software and has undergone the stringent testing and validation
requirements of the FIPS 140 standard.
Control Cards/Card Reader System
Canon imageRUNNER ADVANCE systems offer support for an optional Control Card/Card Reader
system for device access and to manage usage. The Control Card/Card Reader system option
requires the use of intelligent cards that must be inserted in the system before granting access
to functions, which automates the process of Department ID authentication. The optional
Control Card/Card Reader system manages populations of up to 300 departments or users.
6
White Paper: Canon imageRUNNER ADVANCE Security
Section 2 — Device Security
2.3 – Access Control
Canon imageRUNNER ADVANCE systems support a number of access control options to help you
manage the use of device settings and functions in addition to specific capabilities of certain
functions. Access control solutions for the imageRUNNER ADVANCE can help Authentication,
Authorization, and Auditing. Canon offers solutions that can lock down the entire device, or simply
lock down specific functions (e.g. Send-to-Email), while leaving other applications available for
general use. With the power and flexibility of MEAP, some solutions can be customized to meet your
specific requirements.
Password-Protected System Settings
As a standard feature, imageRUNNER ADVANCE systems setup screens support password
protection to restrict device setting changes from the control panel and Remote UI tool. System
Administrators can set network information, system configuration, enable, and disable network and
printing protocols among many other options. Canon highly recommends setting an administrator
password at time of installation since it controls critical device settings.
A
ccess Management System
The Access Management System, which is standard on imageRUNNER ADVANCE systems, can be used
to tightly control access to device functionality. Restrictions can be assigned to users and groups, to
restrict entire functions or restrict specific features within a function. Access restrictions are managed
in units called “roles”. Roles contain information that determines which of the various functions of
the device may be used or not.
Roles can be set up based on individual user’s job title or responsibilities or by group, enabling the
administrator to create roles specific to certain departments or workgroups. Since the administrator
is not limited to restricting all or none of a particular function, the roles can be as specific as is
required for a number of business needs. Beyond the Base roles which contain default access
restrictions, up to 100 new Custom roles can be registered for up to 5,000 users. The administrator
can also define whether to allow unregistered users to log in as guests and then specify settings for
guest user’s roles.
7
White Paper: Canon imageRUNNER ADVANCE Security
Section 2 — Device Security
System Manager Screen
Store ID and Password Screen
The following describes the various Base access levels (roles) that are available:
The following functions and features can be restricted:
8
White Paper: Canon imageRUNNER ADVANCE Security
Section 2 — Device Security
Privileges by Access Level
Predefined Role Access Privileges
Administrator Given privileges to operate all device functions.
Network Manager/Admin Network manager mainly manages the settings related to the network under Settings/Registration.
Device Manager/Admin Device Manager can specify settings related to management settings for paper type and function settings for Send/Receive.
Power User Given privileges to operate all device functions, except managing the device itself.
General User Given privileges to operate all device functions, except managing the devise itself and specifying/registering address book.
Limited User Restricted from device management, all send functions and only allowed 2-sided printing and copying.
Guest Restricted from device management, all send functions and only allowed 2-sided printing and copying.
Device Function Values Description
Print Allowed, Not Allowed Allows or prohibits using applications related to the Print function.
Copy Allowed, Not Allowed Allows or prohibits using applications related to the Copy function.
Send/Store on Network
Sets restrictions for externally sending scanned documents, user inbox documents,
and saving documents to file servers or network storage.
E-mail TX Allowed, Not Allowed Allows or prohibits sending via E-mail TX.
I-Fax TX Allowed, Not Allowed Allows or prohibits sending via I-Fax TX.
Fax TX Allowed, Not Allowed Allows or prohibits sending via Fax TX.
FTP TX Allowed, Not Allowed Allows or prohibits sending via FTP TX.
NetWare (IPX) TX Allowed, Not Allowed Allows or prohibits sending via NetWare (IPX) TX.
Windows (SMB) TX Allowed, Not Allowed Allows or prohibits sending via Windows (SMB) TX.
WebDAV TX Allowed, Not Allowed Allows or prohibits sending via WebDAV TX.
Inbox TX Allowed, Not Allowed Sets restrictions for saving scanned documents to user inboxes.
Specify Address Domain/Send
to Addresses Received from
Cell Phone
Allowed, Not Allowed
For imageRUNNER ADVANCE devices, these restrictions also apply to addresses
received from cell phones.
Use Address Book/Register
Storage Location for Network
No Restrictions, Not
Allowed, Read-Only
For imageRUNNER ADVANCE devices, these restrictions also apply to registering,
editing, and deleting network storage.
Send to New Addresses/Send
to Addresses Received from
Cell Phone
Allowed, Not Allowed
For imageRUNNER ADVANCE devices, these restrictions also apply to addresses
received from cell phones.
Add Device Signature to
Sending Files
Added, Not Added Allows or prohibits adding of a device signature when sending PDF files.
Sending Files Format Allowed, Not Allowed Allows or prohibits sending file formats that a device signature cannot be added to.
Save Functions
(Mailbox/Hold/Memory Media)
Allowed, Not Allowed Allows or prohibits saving functions.
Web Access Allowed, Not Allowed Allows or prohibits using applications related to the Web Access function.
Utility Allowed, Not Allowed Allows or prohibits using applications related to Utilities.
Others Allowed, Not Allowed Allows or prohibits using other applications.
MEAP Applications Allowed, Not Allowed Allows or prohibits the use of MEAP applications.
* Requires SSO-H to be enabled.
When the Access Management System has been enabled, users must log in to the device using SSO
user authentication. Access Management System supports authentication through local device
authentication as well as Active Directory using SSO-H*, which includes support for Kerberos
Authentication. Once a user logs into the device with their user name and password, the device
can determine which roles are assigned to that particular user. Restrictions are applied based on
the assigned roles. If an entire function is restricted, it will appear grayed out to the user after
authentication.
Function Level Authentication
Canon imageRUNNER ADVANCE systems offer the ability to limit the use of specific functions by
authorized users by requiring authentication to use sensitive functions with Function Level
Authentication. Function Level Authentication is a part of Access Management System and works with
SSO-H for authentication. It enables administrators to choose precisely which functions are permitted
by walk-up and network users without entering credentials versus the ones that require a user to
login. For example, administrators may choose to allow all users to make black-and-white copies
while prompting users to login if they choose to output color or use the Scan and Send function.
Scan and Send Security
On devices that have Scan and Send enabled, certain information such as fax numbers and e-mail
addresses may be considered confidential and sensitive. For these devices, there are additional
security features to prevent confidential information from being accessed.
Address Book Password
Administrative and individual passwords can be set for Address Book Management functions.
A system administrator can define the specific Address Book data that can be viewed by users,
effectively masking private details. This password may be set separately so individuals other
than the System Manager can administer the Address Book.
By setting a password for an Address Book, the ability to Store, Edit, or Erase individual and
group e-mail addresses in the Address Book is restricted. Therefore, only individuals with the
correct password for an Address Book will be able to make modifications.
This same password is also used for the Address Book Import/Export function through the
Remote UI utility.
9
White Paper: Canon imageRUNNER ADVANCE Security
* Requires imageWARE Enterprise Management Console and the Access Management System Plug-In when authenticating through
Active Directory.
Section 2 — Device Security
Access Code for Address Book
End-users will also have the capacity to place an access number code on addresses in the Address
Book. When registering an address, users can then enter an Access Number to restrict the display
of that entry in the Address Book. This function limits the display and use of an address in the
Address Book to those users who have the correct code. The Access Number can be turned on or
off, depending on the level of security the end-user finds necessary.
Settings / Registration > Register Destinations > Register New Destinations, from here the user can
register an new e-mail address, fax number, I-Fax, file or group address and set an access code for
that specific address entry in the address book.
Destination Restriction Function
Data transmission to a new destination through the Scan and Send and Fax function can be
restricted, prohibiting transmissions to locations other than the destinations registered or
permitted by the System Manager.
In addition to restricting all new destinations, administrators can also restrict the addition of new
addresses for specific destination types that are available to users when sending documents with
Scan and Send and Fax. Permissions can be set to enable or disable the entry of new addresses
for the following:
• Entries in the Address Book
• LDAP Servers
• User Inboxes
• One-touch Buttons
• Favorites Buttons
• The User’s E-mail Address (Send to Myself, if Using SSO Login)
10
White Paper: Canon imageRUNNER ADVANCE Security
Address Book Password Screen Address Book Access Code Enable/Disable Screen
Section 2 — Device Security
Print Driver Security Features
Print Job Accounting
A standard feature in Canon’s printer drivers, print job accounting requires users to enter an
administrator-defined password prior to printing, thereby restricting device access to those
authorized to print. Printing restrictions can be set using Department ID credentials or through
the Access Management System.
Custom Driver Configuration Tool
Administrators can create customer driver
profiles for users to limit access to print features and specify default settings, thereby
protecting the device against unauthorized use, enforcing internal policies and better control
output costs. Security conscious settings that can be defined and enforced include duplex
output, secure print, B&W only on color devices, watermarks and custom print profiles, as well
as hiding any desired functions. For easier deployment, the customized drivers can be
distributed to desktops across the organization through the Printer Driver Management
Plug-in for imageWARE Enterprise Management Console (iWEMC).
USB Block
USB Block allows the System Administrator to help protect the imageRUNNER ADVANCE systems
against unauthorized access through the built-in USB interface. Access to the device’s USB interface
for desktop access and the device’s host mode for other USB devices can each be permitted or
disabled.
GGoo ttoo SSeettttiinnggss // RReeggiissttrraattiioonn >> PPrreeffeerreenncceess >> EExxtteerrnnaall IInntteerrffaaccee >> UUSSBB SSeettttiinnggss..
2.4 – Third Party MEAP Application and Development
Canon actively collaborates with leading third-party software companies to develop custom solutions
for imageRUNNER ADVANCE systems, known as MEAP applications. Each MEAP enabled device
includes a number of safeguards to help ensure the security and integrity of information stored on
the device.
Access to the Software Development Kit for MEAP is tightly restricted and controlled through
licensing. Once an application has been developed, it is thoroughly reviewed by Canon to ensure that
it meets strict guidelines for operability and security. Following the review, the application is digitally
signed with a special encrypted signature to protect the integrity of the application. If the application
is modified in any way, the signature code will not match and the application will not be permitted to
run on the device. These safety measures make it virtually impossible for an altered or rogue MEAP
application to be executed on an imageRUNNER ADVANCE system.
11
White Paper: Canon imageRUNNER ADVANCE Security
Section 2 — Device Security
Protecting your organization’s confidential information is a mission that Canon takes seriously.
From your documents, faxes and e-mails to the underlying data on the internal hard disk drive
and in memory, Canon has built in many controls to help ensure that your information does not
become compromised.
3.1 – Document Security
Secure Printin
g
Secured Print / Encrypted Secured Print*
Encrypted Secured Print and Secured Print are print functions that hold a job in queue until
the user enters the appropriate password at the device. This ensures that the user is in close
proximity before the document is printed and minimizes unattended papers left at the device.
The imageRUNNER ADVANCE system requires the user to set a password in the print driver
window when sending a print job from a connected PC. The same password is also required for
releasing the job at the device. When using the optional Encrypted Secured Print software,
security is further enhanced by using strong encryption to protect the print job data while in
transit across the network. On systems equipped with the optional Encrypted Secured Print,
administrators can use the print job restriction feature to permit only encrypted print jobs at
the designated device.
uniFLOW Secure Print
Exclusive to Canon is the uniFLOW Output Manager Suite, which is optional modular software
to reduce costs, improve productivity and enhance security. From a security perspective,
uniFLOW Output Manager Suite provides secure printing capabilities by holding jobs at the
server until released by the user at any desired imageRUNNER ADVANCE system. From their
desktop, users print documents by choosing the uniFLOW server as the printer. At the chosen
device, users can be authenticated using a wide variety of supported methods. Users can then
access the uniFLOW MEAP client application from the device’s control panel and release their
job from their queue of pending documents.
12
White Paper: Canon imageRUNNER ADVANCE Security
Section 3 – Information Security
* Requires the Encrypted Secure Print option.
Secure Print screen from the Printer Driver Print Job Status Screen
Loading...