Oce Colorwave 300, Plotwave 900, Plotwave 750, Plotwave 350, Plotwave 300 User Manual
Administration guide
PlotWave - ColorWave Systems
Security information
Copyright
© 2014, Océ
All rights reserved. No part of this work may be reproduced, copied, adapted, or transmitted in
any form or by any means without written permission from Océ.
Océ makes no representation or warranties with respect to the contents hereof and specifically
disclaims any implied warranties of merchantability or fitness for any particular purpose.
Further, Océ reserves the right to revise this publication and to make changes from time to time
in the content hereof without obligation to notify any person of such revision or changes.
Edition 2014-06
GB
Trademarks
Océ, and its wide-format printing systems are registered trademarks of Océ.
Microsoft®, Windows®, Windows XP®, Windows XP® embedded, Windows Server® 2003,
Windows® Vista™, Windows Server® 2008, Windows ® 7, Windows 8, Windows Server 2012,
Windows Embedded Standard® 2009 are either registered trademarks or trademarks of
Microsoft® Corporation in the United States and/or other countries.
Linux® is a registered trademark of Linus Torvalds.
McAfee is a registered trademark or trademark of McAfee, Inc. or its subsidiaries in the United
States and other countries.
Symantec and Norton are trademarks or registered trademarks of Symantec Corporation or its
affiliates in the U.S. and other countries. Other names may be trademarks of their respective
owners.
Products in this publication are referred to by their general trade names. In most, if not all cases,
these designations are claimed as trademarks or registered trademarks of their respective
companies.
Contents
Contents
Chapter 1
Océ Security policy............................................................................................................. 9
The Océ Security policy ................................................................................................................................ 10
Downloads and support for your product....................................................................................................12
Overview of the security features available per Océ System .................................................................... 13
Chapter 2
Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
............................................................................................................................................ 17
Security on Océ PlotWave 300/350, PlotWave 900 R1.x and ColorWave 300........................................... 18
Overview...................................................................................................................................................18
Security overview for the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900
R1.x and the Océ ColorWave 300 systems .....................................................................................18
System and Network security................................................................................................................. 19
Ports - Protocols.................................................................................................................................19
Security Patches................................................................................................................................ 24
Security levels....................................................................................................................................26
Prevent any outgoing connection to the Internet .......................................................................... 29
Security of the USB connection (Océ PlotWave 300/350, Océ ColorWave 300)...........................30
Antivirus ............................................................................................................................................ 31
Roles and Passwords........................................................................................................................ 32
Data Security ........................................................................................................................................... 35
E-Shredding....................................................................................................................................... 35
IPsec (on Océ PlotWave 300/350, Océ PlotWave 900 1.2 and higher 1.x, Océ ColorWave 300)....
38
Prevent USB Direct Print and Scan to USB (Océ PlotWave 300/350, Océ ColorWave 300).........54
HTTPS with Océ PlotWave 900 R1.x................................................................................................ 56
Smart Inbox management................................................................................................................60
Security on Océ PlotWave 750 and Océ PlotWave 900 R2.x ......................................................................61
Overview...................................................................................................................................................61
Security overview for the Océ PlotWave 750 and the Océ PlotWave 900 R2.x systems............. 61
System and Network security................................................................................................................. 62
Ports - Protocols.................................................................................................................................62
Security Patches................................................................................................................................ 67
Security levels....................................................................................................................................70
Prevent any outgoing connection to the Internet .......................................................................... 72
Antivirus ............................................................................................................................................ 73
Roles and Passwords........................................................................................................................ 74
Audit log.............................................................................................................................................76
Data Security ........................................................................................................................................... 77
E-Shredding....................................................................................................................................... 77
IPsec ...................................................................................................................................................80
HTTPS (on Océ PlotWave 750 and PlotWave 900 R2.x)................................................................. 86
Smart Inbox management and job management...........................................................................93
Chapter 3
Security on Océ PlotWave 500 and PlotWave 340/360................................................. 95
Overview......................................................................................................................................................... 96
Security overview for the Océ PlotWave 500 and PlotWave 340/360 systems...................................96
5
Contents
System and Network security....................................................................................................................... 97
Ports - Protocols....................................................................................................................................... 97
Applications, protocols and ports used in the Océ PlotWave 500 and PlotWave 340/360
systems...............................................................................................................................................97
Security Patches.....................................................................................................................................101
Install the Océ Remote patch..........................................................................................................101
Protocol protection................................................................................................................................ 103
Network protocols protection ........................................................................................................103
Prevent any outgoing connection to the Internet ...............................................................................105
Security of the USB connection ...........................................................................................................106
The USB connection on the printer user interface ...................................................................... 106
Antivirus .................................................................................................................................................107
Roles and Passwords.............................................................................................................................108
Roles and profiles............................................................................................................................108
Passwords policy and behaviour in the Océ PlotWave 500 and PlotWave 340/360 systems... 109
Access control........................................................................................................................................ 111
Audit log................................................................................................................................................. 112
Data security................................................................................................................................................. 113
E-Shredding in Océ PlotWave 500 and PlotWave 340/360 systems.................................................. 113
E-shredding presentation................................................................................................................113
Enable the e-shredding in Océ Express WebTools.......................................................................114
E-shredding process and system behaviour................................................................................. 116
IPsec ....................................................................................................................................................... 117
IPsec presentation .......................................................................................................................... 117
Configure the IPsec settings in the Océ controller .......................................................................119
Configure the IPsec settings on a workstation or a print server..................................................121
Troubleshooting: Disable 'Access control' and IPsec (Océ PlotWave 500 and PlotWave 340/360
systems)........................................................................................................................................... 130
HTTPS (for Océ PlotWave 500 and PlotWave 340/360).......................................................................132
Encrypt print data and manage the system configuration using HTTPS....................................132
Request and import a CA-signed certificate..................................................................................137
Prevent 'Print from USB' and/or 'Scan to USB' on Océ PlotWave 500 and PlotWave 340/360....... 143
How to prevent 'Print from USB' and/or 'Scan to USB'............................................................... 143
Smart Inbox management and job management............................................................................... 144
Chapter 4
Security on Océ ColorWave 550/600/650 (and Poster Printer).................................. 145
Security on Océ ColorWave 550, ColorWave 600 (Poster Printer), ColorWave 650 R2.x (Poster Printer)
....................................................................................................................................................................... 146
Overview.................................................................................................................................................146
Security overview for the Océ ColorWave 600/650 (Poster Printer) and the Océ ColorWave 550
systems.............................................................................................................................................146
System and Network security............................................................................................................... 148
Ports - Protocols...............................................................................................................................148
Security Patches.............................................................................................................................. 151
Protocol protection..........................................................................................................................153
Prevent any outgoing connection to the Internet ........................................................................ 154
Security of the USB connection .................................................................................................... 155
Operating System and software protection.................................................................................. 156
Roles and Passwords...................................................................................................................... 157
Access control..................................................................................................................................159
Data Security.......................................................................................................................................... 160
E-Shredding on Océ ColorWave 600 and Océ ColorWave 650 (PP) and Océ ColorWave 550.. 160
IPsec on Océ ColorWave 550 v2.3.1 and higher and Océ ColorWave 650 (PP) v2.3.1 and higher
...........................................................................................................................................................163
How to prevent 'Print from USB' on Océ ColorWave 550/650 (and PP) .....................................176
Smart Inbox management and job management.........................................................................177
Security on Océ ColorWave 650 R3.x......................................................................................................... 178
Overview.................................................................................................................................................178
6
Contents
Security overview for the Océ ColorWave 650 R3.x system........................................................178
System and Network security............................................................................................................... 179
Ports - Protocols...............................................................................................................................179
Security Patches.............................................................................................................................. 182
Protocol protection..........................................................................................................................184
Prevent any outgoing connection to the Internet ........................................................................ 186
Security of the USB connection .................................................................................................... 187
Antivirus .......................................................................................................................................... 188
Roles and Passwords...................................................................................................................... 189
Access control..................................................................................................................................191
Audit log...........................................................................................................................................192
Data security...........................................................................................................................................193
E-Shredding..................................................................................................................................... 193
IPsec .................................................................................................................................................194
HTTPS (on Océ ColoWave 650 R3.x)..............................................................................................199
How to prevent 'Print from USB' on Océ ColorWave 550/650 (and PP) .....................................206
Smart Inbox management and job management.........................................................................207
Index.................................................................................................................................209
7
Contents
8
Chapter 1 Océ Security policy
The Océ Security policy
The Océ Security policy
Definition
At Océ, security is an integral part of system development, and the company is taking a proactive
approach to the improvement of security-related issues. Océ is working to address security
requirements across all of its digital document systems.
For its printing systems connected to the network, Océ strives to ensure the:
- Security of the system on the network
- Security of the data sent to the printers, with a focus on protecting sensitive documents from
being captured by un-authorised persons
- Security of the configuration and data on the controller
NOTE
See the
available per Océ system.
Table of the security features
System security and security on the network
on page 13 to get an overview of the security features
Faced with system vulnerabilities, viruses, worms and in order to maximise the protection of the
Océ print systems from hackers and networking attacks, Océ has reinforced the security of the
Océ systems by:
•
Introducing the Océ Security levels to offer network security protection against virus / worm
attacks or system vulnerabilities (on Windows Operating Systems).
Once the Security Interface is activated, you can define the level of security according to your
system needs. Notice that the higher level of security you set, the fewer printing and scanning
functionalities you get.
•
Implementing network protocols protection features (by use of the Océ Security levels filtering
or by configuring each network protocol for firewall filtering)
•
Protecting the system roles and passwords. The main network and system settings are
protected against change. Only authorised users can configure or change these settings
•
Regularly checking the relevance of Microsoft flaws and delivering security patches whenever
it is necessary.
•
Providing OS and software protection mechanism. The internal system software is protected
against alteration
• Make the USB connection secure (on systems with USB slot)
• Restricting the access to the printer to allowed stations only
•
Allowing the installation of an Antivirus software on the Océ system controller
•
Being compliant with IPv6 and then benefiting from IPv6 secured assets
NOTE
The availability of the security features depends on the products. See the
security features available per Océ System
on page 13.
Overview of the
Data security on the network
To ensure the security of the print data sent on the network, Océ has implemented:
•
The HTTPS (HTTP over SSL) protocol to encrypt the configuration management data,
submitted print data and saved scan data:
Find all information about
page 56.
Chapter 1 - Océ Security policy
10
Use the Océ self-signed certificate with Internet Explorer
on
The Océ Security policy
•
The e-shredding feature to overwrite any user data (print/copy/scan) when it is deleted from
the system.
This feature prevents the recovery of any deleted user data.
•
The IPsec configuration, that provides authentication, data confidentiality and integrity in the
network communication between devices.
A strong mechanism of encryption guarantees the confidentiality of the user print and scan
data on the network.
• The Smart Inbox and Job protection by:
- Limiting and restricting the access to the print and scan job data with the Smart Inbox
management capability
- Managing the visibility of jobs and their availability through job submission tools with the job
management settings
Chapter 1 - Océ Security policy
11
Downloads and support for your product
Downloads and support for your product
Downloads
User guides, printer drivers and other resources can change without prior notice. To stay up-todate, you are advised to download the latest resources from:
"http://downloads.oce.com"
Before you use your product, you must always download the latest safety information for your
product: make sure that you read and understand all safety information in the manual entitled
'Safety Guide' .
Support
For support information please contact your Canon local representative.
Find your local contact for support from:
"http://www.canon.com/support/"
Chapter 1 - Océ Security policy
12
Overview of the security features available per Océ System
Overview of the security features available per Océ
System
Security features in the Océ PlotWave and Océ ColorWave 300 systems
Operating System
Firewall
MS Security flaws /
Security patches
Network protocols
protection
OS and software in‐
tegrity mechanism
Antivirus
Océ PlotWave 300
Océ PlotWave 350
Océ PlotWave 900
R1.x
Océ ColorWave 300
Windows Embedded
Standard 2009
or
Windows XP embedded SP3
Security overview
See
on page 18
Yes Yes Yes
Yes Yes Yes
Océ Security levels - 3
levels
- - -
Compatible with 2 antivirus brands
Océ PlotWave 340
Océ PlotWave 360
Océ PlotWave 500
Windows Embedded
Standard 7 SP1
Yes. Protection configurable per protocol
Compatible with 2 antivirus brands
Océ PlotWave 750
Océ PlotWave 900
R2.x
Windows Embedded
Standard 7 SP1
Océ Security levels - 4
levels
Compatible with 2 antivirus brands
IPv6
SMB authentication
Feature to encrypt da‐
ta on the network
Password protection
Data overwrite
Access control
Yes (IPV6 and IPV4
combination)
NTLMV1
IPsec for:
Océ PlotWave 300
Océ PlotWave 350
Océ PlotWave 900 1.2
and higher
Océ ColorWave 300
HTTPS for:
Océ PlotWave 900
Yes for:
- User settings
- Administration settings
- Settings on the printer user panel
E-shredding E-shredding E-shredding
- IP filtering -
Yes (IPv6 only or IPv6
and IPv4 combination)
NTLMV2
- IPsec
- HTTPS
Yes for:
- User settings
- Administration settings
- Settings on the printer user panel
Yes (IPv6 only or IPv6
and IPv4 combination)
NTLMV2
- IPsec
- HTTPS
Yes for:
- User settings
- Administration settings
- Settings on the printer user panel
4
Chapter 1 - Océ Security policy
13
Overview of the security features available per Océ System
Smart Inbox manage‐
ment
- Smart Inbox restriction
- Remote view restriction (except Océ Plot-
- Smart Inbox capability can be disabled
- Remote view restriction
Wave 900)
Océ Publisher Express
- Access restriction Access restriction
access
Actions on jobs
- Remote action restriction
Security features in the Océ ColorWave systems (except Océ ColorWave 300)
Operating System
Océ ColorWave 600 (PP)
Océ ColorWave 650 R2.x
Océ ColorWave 650 PP
Océ ColorWave 550
Linux and WES 2009 for:
- Océ ColorWave 650 (multifunctional)
- Océ ColorWave 550 (multifunctional)
Linux for:
- Océ ColorWave 650 (printer only)
- Océ ColorWave 550 (printer only)
- Océ ColorWave 600 (PP)
- Océ ColorWave 650 PP
Océ ColorWave 650 R3.x
Windows Embedded Standard 7
SP1
- Smart Inbox capability can be disabled
- Remote view restriction
Remote action restriction
Firewall
MS Security flaws /
Security patches
Network protocols
protection
OS and software in‐
tegrity mechanism
Antivirus
IPv6
SMB authentication
Yes Yes
Yes for Océ ColorWave 650 / 550
Yes
(multifunctional)
N/A for Océ ColorWave 600 (PP),
ColorWave 650 PP, Océ ColorWave 650 (printer only) and Océ
ColorWave 550 (printer only)
Yes. Protection configurable per
protocol
Yes. Protection configurable per
protocol
Yes -
- Compatible with 2 antivirus
brands
Yes (IPv6 only or IPv6 and IPv4
combination)
Yes (IPv6 only or IPv6 and IPv4
combination)
NTLMV1 NTLMV2 or NTLMV1 (can be set in
Océ Express WebTools)
4
Chapter 1 - Océ Security policy
14
Overview of the security features available per Océ System
Feature to encrypt da‐
ta on the network
Password protection
Data overwrite
Access control
IPsec for:
Océ ColorWave 550 v2.3.1 and
higher
Océ ColorWave 650 v2.3.1 and
higher
Océ ColorWave 650 PP v2.3.1 and
higher
Yes for:
- User settings
- Administration settings
- Settings on the printer user panel
E-shredding for:
Océ ColorWave 650 2.0.1 and
higher
Océ ColorWave 650 PP 2.1 and
higher
Océ ColorWave 600 1.5 and higher
Océ ColorWave 600 PP 1.6.1 and
higher
Océ ColorWave 550 2.2 and higher
Access restriction to the printer
for:
Océ ColorWave 550 v2.3.1 and
higher
Océ ColorWave 650 v2.3.1 and
higher
Océ ColorWave 650 PP v2.3.1 and
higher
- IPsec
- HTTPS
Yes for:
- User settings
- Administration settings
- Settings on the printer user panel
E-shredding
IP filtering
Smart Inbox manage‐
ment
Océ Publisher Express
access
Actions on jobs
- - Smart Inbox capability can be
disabled
- Remote view restriction
- Access restriction
Remote action restriction Remote action restriction
Chapter 1 - Océ Security policy
15
Overview of the security features available per Océ System
Chapter 1 - Océ Security policy
16
Chapter 2 Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
Security on Océ PlotWave 300/350, PlotWave 900 R1.x and ColorWave 300
Security on Océ PlotWave 300/350, PlotWave 900 R1.x
and ColorWave 300
Overview
Security overview for the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and the Océ ColorWave 300 systems
Introduction
The Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave
300 are equipped with the following security features:
Security overview
Operating System
Firewall Yes
Network protocols protection 3 Océ Security Levels
MS Security patches Océ released patches
Antivirus Compatible with 2 Antivirus brands
IPV6 Yes
Data encryption on the network - IPsec for Océ PlotWave 300, Océ PlotWave
Data overwrite E-shredding
Password protection Yes for:
- Windows XP Service Pack 3 for all versions of
Océ PlotWave 300, Océ PlotWave 350, and Océ
ColorWave 300 prior to R1.5 and Océ PlotWave
900 R1.x
- Windows Embedded Standard 2009 for Océ
PlotWave 300 R1.5, Océ PlotWave 350 R1.5,
Océ ColorWave 300 R1.5 and higher versions
350, Océ PlotWave 900 from R1.2, and Océ ColorWave 300
- HTTPS for Océ PlotWave 900
- User settings
- Administration settings
- Settings on the printer user panel*
* Except on Océ PlotWave 900 R1.2.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
18
System and Network security
System and Network security
Ports - Protocols
Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ ColorWave 300 systems
Printing applications: security levels, ports and protocols used by the Océ systems
Application /Function‐
ality
Océ Wide-format
Printer Driver for Microsoft Windows
(WPD or WPD2)
Océ Adobe® PostScript® 3™ driver
Océ Publisher Express Océ PlotWave 300/
Océ Publisher Express
over SSL
System Supported security lev‐
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ PlotWave 900 x
els (x) and open port
N* M* H*
x
TCP 515
TCP
65200
TCP 80
UDP
515
x
TCP 515xTCP
x
TCP 80xTCP 80
TCP 443xTCP
(1)
x
TCP
515
TCP
65200
TCP 80
515
443
(2)
x
TCP
515
x
TCP
515
x
TCP
443
Port used on the
controller: protocol
TCP 515: LPR
TCP 65200: Océ
back-channel
TCP 80: HTTP (for
advanced accounting)
UDP 515: Océ protocol (for printer discovery)
TCP 515: LPR
TCP 80: HTTP
TCP 443: HTTPS
(**)
Océ Publisher Select Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
x
TCP 515
TCP
65200
TCP 80
UDP
515
x
TCP
515
TCP
65200
TCP 80
TCP 80: HTTP
TCP 65200: Océ
back-channel
TCP 515: LPR
UDP 515: Océ protocol (for printer discovery)
(**)
4
19
Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ
ColorWave 300 systems
Application /Function‐
System Supported security lev‐
ality
Océ Publisher Mobile Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ Mobile WebTools Océ PlotWave 350
Océ PlotWave 900
R1.2 and higher
Océ ReproDesk Studio Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Novell NDPS printing Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
els (x) and open port
N* M* H*
x
TCP 515
TCP
4242
ICMP
UDP
515
TCP 21
(4)
x
TCP 80xTCP 80
x
TCP 515
TCP
65200
x
TCP
515
TCP
65200
x
TCP 515xTCP
515
x
TCP
515
Port used on the
controller: protocol
TCP 515: LPR
TCP 21: FTP
(3)
(4)
TCP 4242: FTP passive mode
(6)
ICMP: ping
UDP 515: Océ protocol (for printer discovery)
TCP 80: HTTP
TCP 515: LPR
TCP 65200: Océ
back-channel
(**)
TCP 515: LPR
LPR printing (command line)
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
x
TCP 515xTCP
515
x
TCP
515
TCP 515: LPR
Océ ColorWave 300
FTP printing Océ PlotWave 300/
PlotWave 350/ PlotWave 900R1.x
Océ ColorWave 300
x
TCP 21
TCP
4242
(5)
x
TCP 21
TCP 21: FTP
TCP 4242: FTP
Notes:
• * Levels: N: Normal - M: Medium - H: High
(**)
•
Océ back-channel is an Océ proprietary protocol used to retrieve information from the
printer (status, media loaded...) and to display it in the application or driver.
(1)
•
LPR printing with back-channel and advanced accounting
(2)
•
LPR printing. No back-channel. No advanced accounting
(3)
•
Océ Publisher Mobile v 2.2 and later for Android, and for Océ Publisher Mobile v 2.3 and
later for iOS
(4)
•
Only for Océ Publisher Mobile v 2.0 to v 2.2 for iOS
(5)
•
FTP active mode only
(6)
•
Data channel for FTP passive mode
(6)
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
20
Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ
ColorWave 300 systems
Scanning / copying applications: security levels, ports and protocols used by the Océ systems
Application /Function‐
ality
Scan to File Remote
SMB
Scan to File Remote
FTP
Scan data retrieval by
FTP
Scan data retrieval
from Smart Inbox
(Scans)
System Supported security lev‐
els (x) and open port
N* M* H*
Océ PlotWave 300/
x PlotWave 350
Océ ColorWave 300
Océ PlotWave 900
x x x R1.x
Océ PlotWave 300/
x
(1)
x
(1)
x
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ PlotWave 300/
PlotWave 350/ Plot-
x
TCP 21
TCP
4242
x
TCP 80xTCP 80
(2)
x
TCP 21
Wave 900 R1.x
Océ ColorWave 300
Port used on the
controller: protocol
-
TCP 21: FTP
TCP 4242: FTP
(3)
TCP 80: HTTP
Scan data retrieval
from Smart Inbox
(Scans) over SSL
Océ Matrix Logic Océ PlotWave 900
Océ PlotWave 900
R1.x
R1.x
x
TCP 443xTCP
443
x
TCP 80
TCP 443
x
TCP 80
TCP
x
TCP
443
x
TCP
443
TCP 443: HTTPS
TCP 80: HTTP
TCP 443: HTTPS
443
Notes:
• * Levels: N: Normal - M: Medium - H: High
(1)
•
FTP passive mode only: the FTP server on the remote workstation must support FTP passive
mode
(2)
•
FTP active mode only
(3)
•
Data channel for FTP passive mode
Control management: security levels, ports and protocols used by the Océ systems
Application /Function‐
ality
PING Océ PlotWave 300/
System Supported security lev‐
els (x) and open port
N* M* H*
x x x ICMP
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Port used on the
controller: protocol
4
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
21
Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ
ColorWave 300 systems
Application /Function‐
ality
System Supported security lev‐
els (x) and open port
N* M* H*
SNMP based applications
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
UDP
161
Océ ColorWave 300
WSD Océ PlotWave 350 x
TCP 80
UDP
3702
Océ Express WebTools
Océ PlotWave 300/
PlotWave 350/ Plot-
TCP 80xTCP 80
Wave 900 R1.x
Océ ColorWave 300
Océ Express WebTools over SSL
Name resolution
(**)
Océ PlotWave 900
R1.x
Océ PlotWave 300/
TCP 443xTCP
PlotWave 350
Océ ColorWave 300
Océ PlotWave 900
R1.x
Port used on the
controller: protocol
x
x
TCP 80
TCP
UDP
3702
UDP
UDP 161: SNMP
x
TCP 80: HTTP
UDP 3702: WSD dis-
80
covery
3702
x
x
TCP 80: HTTP
x
TCP 443: HTTPS
TCP
443
443
x Outgoing connec-
tion:
- local port (on con-
x x x
troller): UDP(/TCP)
<dynamic value>
- remote port (on
DNS server): UDP(/
TCP) 53
DHCP Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ Account Center
Advanced accounting
(WPD)
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Accounting information retrieval by FTP
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Browse Océ systems
on the network with
Windows network
neighbourhood
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
x x x Outgoing connec-
tion:
- local port (on controller) : UDP 68
- remote port (on
DNS server): UDP 67
x
TCP 80: HTTP
TCP 80xTCP 80
x
TCP 21
(1)
x
TCP 21
TCP 21: FTP
TCP 4242: FTP
TCP
4242
x
UDP
UDP 137: NetBios
over TCP/IP
137
(2)
4
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
22
Applications, protocols and ports used in the Océ PlotWave 300, the Océ PlotWave 350, the Océ PlotWave 900 R1.x and Océ
ColorWave 300 systems
Application /Function‐
System Supported security lev‐
ality
Océ Service Logic Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
IPsec Océ PlotWave 300/
PlotWave 350
Océ ColorWave 300
Océ PlotWave 900
R1.2 and higher
Océ Remote Meter
Reading Manager
Océ PlotWave 300/
PlotWave 350/ PlotWave 900 R1.x
Océ ColorWave 300
Océ Remote Service Océ PlotWave 300
R1.5 and higher
PlotWave 350 R1.5
and higher
Océ PlotWave 900
R1.x
Océ ColorWave 300
R1.5 and higher
Port used on the
els (x) and open port
controller: protocol
N* M* H*
x
TCP 21
(1)
x
TCP 21
TCP 21: FTP
TCP 4242: FTP
TCP
4242
x
UDP
UDP 500
UDP 4500
500
UDP
4500
x
UDP 161: SNMP
UDP
161
x x x HTTPS outgoing
connection required:
TCP/IP port 443
(2)
(3)
Notes:
• * Levels: N: Normal - M: Medium - H: High
(**)
•
The name resolution is mainly used to determine the IP address of the scan destination
during Scan fo File operation
(1)
•
FTP active mode only
(2)
•
Data channel for FTP passive mode
(3)
•
TCP/IP port 443 must be opened and must allow response back on the IT infrastructure
firewall.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
23
Security Patches
Security Patches
Install the Océ Remote patch (on Océ PlotWave 300/350, PlotWave 900 R1.x and Océ ColorWave 300)
Introduction
You can install the Océ Remote patches (Security patches) in the following versions of the
systems:
• Océ PlotWave 300 1.2.1 and higher
• Océ PlotWave 350 1.0 and higher
• Océ PlotWave 900 1.x
• Océ ColorWave 300 1.2.1 and higher
Before you begin
Find the Océ Security patch from the Océ Downloads website on
Open the product page and go to the Security tab to download the available security patches.
Install the Océ Remote patch
Procedure
Open the Océ Express Webtools
1.
Open the 'Support' tab
2.
http://downloads.oce.com
:
Select 'Update'
3.
The Authentication window opens.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
24
Install the Océ Remote patch (on Océ PlotWave 300/350, PlotWave 900 R1.x and Océ ColorWave 300)
Log in as the System administrator or Power user
4.
All the patches successfully applied (when any) are displayed
Click on the 'Update' icon (top right corner) to open the wizard
5.
Click OK
6.
Browse to the Océ Remote patch and click OK to install it
7.
Click OK to confirm the update
8.
The system restarts to apply the patch.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
25
Security levels
Security levels
Security levels presentation
Introduction
Océ defined 3 levels of security according to the customer needs. The presentation below can
help you to select the most suitable level.
High security level
The High level is the most secure mode for printing and scanning.
The compliant applications are based on:
• the LPR protocol for printing
• the HTTPS protocol (Océ PlotWave 900 only) for printing
• the FTP protocol for scanning.
Target:
• This level provides you the most secure mode while using the basic feature for printing and
scanning. Only some Océ applications are available. See the
application/functionality
• This security level may also be used when you want to be protected whenever a vulnerability
has been discovered and the corresponding patch cannot be yet installed. As soon as the patch
can be installed, you can go back to the original security level.
on page 19.
security levels supported per
Medium security level
The Medium level is compliant with all the Océ applications available for printing and scanning
which do not present a high risk (as reported by most popular network scanners).
Target:
This level is recommended if you need to be secured while you want to use the Océ applications
for printing and/or scanning (you can use the system including more functions than with the High
security level).
Normal security level
This mode offers all the functionalities.
Target:
• You can select this level if you want to use some features not covered by MEDIUM security
level.
• This level is more dedicated for small network infrastructure where security is less required
versus features.
Set the security level in Océ PlotWave 300, Océ PlotWave 350 and Océ ColorWave 300
Introduction
The [Security] wizard on the printer user panel gives the option to check or change the security
level of the system.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
26
Before you begin
The System Administrator or a Power User can protect the security settings with a password.
When the protection is activated, you must type the password in the printer user panel before
you can change the security level.
Procedure
From the [HOME] screen select the [System] tab.
1.
Select the [Setup] tab.
2.
Use the scroll wheel to go to the [Security]([Configure settings]) wizard.
3.
Protect the security level by a password
Open this section with the confirmation button.
4.
The screen displays the security level and the active network access options:
5.
Two options are possible:
6.
• Press the [Back] key in case you only want to check the security settings.
• Press the [Next >] key in case you want to adapt the security level.
Enter the password if requested and follow the wizard to adapt the security level.
Protect the security level by a password
Procedure
Open the Océ Express Webtools in a web browser (http://Printer IP address or hostname)
1.
In the 'Preferences' tab, select 'System settings'
2.
In the 'Printer Properties', goes to 'Password to change security level'
3.
Click on the value to edit it
4.
Log in as the System Administrator or as a Power User
5.
Select 'New'
6.
Type and re-type a numeric password
7.
Confirm to activate the password.
8.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
27
Set the security level in Océ PlotWave 900 R1.1 and higher R1.x versions
Result
You must type the password in the printer user panel when you want change the security level.
Set the security level in Océ PlotWave 900 R1.1 and higher R1.x versions
Introduction
The security user interface is available through the Océ Express WebTools application.
NOTE
You need to be logged on as the System Administrator to access the security level interface and
change the security levels.
Procedure
Open the Océ Express Webtools in a web browser (http://Printer IP address or hostname)
1.
On the [Configuration] tab, select [Connectivity]
2.
Go to the Security section
3.
Click on 'Edit' or double click on the value to open the [Security level] window
4.
Set the security level and click 'OK'
5.
Restart the printer when prompted
6.
Result
After you set the Security level to 'High', you must open Océ Express Web Tools by means of the
HTTPS protocol: type https://Printer IP address or hostname in the web browser.
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
28
Prevent any outgoing connection to the Internet
Introduction
Some features of the following systems allow or request a connection over the Internet to work
properly:
• Océ PlotWave 300 R1.5 and higher
• Océ PlotWave 350 R1.5 and higher
• Océ ColorWave 300 R1.5 and higher
When the Security Policy in a company prevents any outgoing network traffic over the Internet,
perform all the following actions in Express WebTools:
Prevent any outgoing connection to the Internet
StepIn the Express WebT‐
ools section
1 Support - Remote Serv-
ice - Remote assistance
2 Preferences - System
Defaults - Service related information
3 Configuration - Scan
destination [X]
4 Support - About - Shut-
down - Restart
Action Detail
Stop the Remote assistance if is activated
Disable Online Services Set 'Océ Online Services
Delete any scan destination going to
the Internet:
FTP sites reachable through the Internet
Restart the system
Click 'Stop remote assistance' until it changes into
'Allow remote assistance' .
The two blinking arrows
on the right side disappear.
connection enabled' to
'Disabled'
Uncheck 'Scan destination
[X]: enabled'
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
29
Security of the USB connection (Océ PlotWave 300/350, Océ ColorWave 300)
Security of the USB connection (Océ PlotWave 300/350, Océ ColorWave 300)
The USB connection on the Local user interface
Introduction
A USB connection is available on the Océ PlotWave 300, Océ PlotWave 350 and Océ ColorWave
300 Local user interface.
This USB connection is used to:
• Install and upgrade the controller software
• Backup and restore the controller configuration
• Scan to the USB storage device
• Print from the USB storage device
Security on the USB port
General USB port protection:
• Booting from the USB device is not possible.
• Executing any programme present on the USB device is not possible
The Autorun is disabled and no operation on the controller can execute a programme on the
USB device.
• Propagating on network any infected file present on the USB device plugged on the USB port
is not possible
Read from / write to USB device protection
•
Protection of the USB READ operation:
- when restoring a controller configuration from the Local User Interface.
In that case, any file infected by a virus appears as an invalid backup file. The controller
software detects it and rejects the restore operation.
- when printing from the USB device.
Any print file infected by a virus will never compromise controller's software integrity.
•
Protection of the USB WRITE operation:
- during the backup of the controller configuration, from the Local User Interface.
The backup is performed by the internal controller software. It cannot contaminate the USB
device by any threat.
- when making a Scan To File to the USB device:
The Scan To File operation to USB device is performed by the internal controller software. It
cannot contaminate the USB device by any threat.
Disable the USB features
You can disable:
• The direct printing operation from USB. See
• The scanning operation to USB. See
How to prevent 'Print from USB'
1- Disable any 'USB stick' scan destination
on page 54
on page 54
Chapter 2 - Security on Océ PlotWave 300/350, PlotWave 750, PlotWave 900 and ColorWave 300
30
Loading...