Mitigating Risk Posed by Information Stored on Multi-functional devices, Photocopiers, Fax Machines and Printers

This article provides guidance on the risk posed by sensitive information stored on multi-functional devices and how institutions should mitigate that risk.

Risk

Photocopiers, fax machines and printers more often than not are equipped with a hard drive or flash memory that stores digital images of the documents that are copied, transmitted or printed by the device. Corporates use these devices regularly to process documents of their customers and also for their internal needs. Many of these documents often contain confidential information such as PII, Trade secrets or sensitive legal information. 

To reduce the capex expenditure, corporates lease photocopiers, fax machines and printers for a set period of time which includes service as well. At the end of the lease period, the devices are returned to the leasing company. During the lease period also there are chances that devices may go faulty and are replaced by the vendor. In both of these cases any data still stored on the devices may become exposed to an unauthorized entity. Since these are electronically stored and not transmitted documents, the traceability of the data may not be feasible. In some cases malicious actors have carried out these attacks by installing print devices and photocopiers through equipment leasing companies , gaining access to the premises of the corporates on the pretext of service , replaced the storage part to steal information. 

Controls

The first step could be implementation of written policies and procedures to identify devices that store digital images of business documents and ensure their hard drive or flash memory is erased, encrypted or destroyed prior to being services or returned to the leasing vendor , or otherwise disposed of. As most of these contracts are under the office administration department who may not be tech savvy, it becomes even more important that they are trained well to make them aware of the risks. The process of repair, servicing, replacement and disposing of all such assets should have a checklist clearly stating the need for erasure or removal of storage memory.

Becoming aware of the risks posed by the potential disclosure of sensitive information stored on the hard drive or flash memory of photocopiers, fax machines and printers is the second step in risk mitigation. The finally the last step is IT infra team validating the equipment , checking if encryption can be enforced , documenting the risk and providing the SOP for device handling.