HP LaserJet M5000 LaserJet MFP - Imaging and Printing Security Best Practices - Page 82

•

Enable

HTTPS

, and configure the setting to

Encrypt all web communication

. This setting

enables encryption for configuration data between the PC and the MFP EWS. It prevents

sensitive data such as usernames and passwords from passing over the network in clear text.

This setting is related to the EWS

Encryption Strength

setting explained earlier.

Web browsers that do not support SSL and high encryption strength will not be able to access

the MFP EWS.

This checklist recommends disabling EWS Config during normal MFP operations and enabling

it temporarily for changes to configurations. This setting ensures that the network traffic is

secure during those configurations.

•

Disable

IPX RCFG Support

. The IPX RCFG Support setting (sometimes called RCONFIG)

allows remote configuration from IPX/SPX servers. Web Jetadmin may use RCFG to configure

Novell NetWare queue-server linkages on older Jetdirect print servers. You should disable

IPX

RCFG Support

unless your network has Novell and older Jetdirect print servers.

With

IPX RCFG Support

disabled, MFPs will deny access to Novell.

When you click

Apply

for this setting, a caution message will appear to alert you that you are

disabling certain types of Novell access. Click

OK

to go ahead with disabling it.

•

Configure

Job Timeout

. The

Job Timeout

option enables the MFPs to move on from jobs

that lack proper end of job signals. The MFPs will be able to switch protocols to continue with

other jobs rather than waiting indefinitely for improperly formatted jobs to finish.

•

Set the

Privacy

setting as desired. The Privacy setting is included in this checklist to inform you

of its purpose: it allows HP to collect statistical data on the use of MFPs. HP uses such

information to help improve the design and development of MFPs. HP will not collect network-

specific or personal data. For information on HP privacy policies, read the

HP

Online Privacy

Statement available by clicking privacy statement at http://www.hp.com.

If you enable this

feature, information collected by HP will be limited to the following items:

•

HP Jetdirect product number, firmware version, and manufacturing date

•

Model number of the attached printer or device

•

Web browser and operating system detected

•

Local language selections used for viewing Web pages

•

Network communications protocols enabled

•

Network management interfaces enabled

•

Device discovery protocols enabled

•

Printing protocols enabled

•

TCP/IP configuration methods enabled

•

SNMP control methods enabled

•

Wireless configuration methods enabled

For HP to collect any information, Internet access must be available.

Chapter 7

HP LaserJet and Color LaserJet MFP Security Checklist

78

Section	Page
HP Imaging and Printing Security Best Practices	1
Configuring Security for Multiple LaserJet MFPs and Color LaserJet MFPs	1
Version 5.0 for HP Web Jetadmin 10.1 or above	1
Table of Contents	2
Chapter 1: Introduction	5
Cautions	6
Follow the Checklist in Order	6
Understand the Ramifications	6
Continue to be Vigilant	6
MFP Environment	7
Assumptions	7
Solutions covered	8
Organization	8
Chapter 2: Threat Model	9
Spoofing Identity	9
Tampering with Data	10
Repudiation	10
Information Disclosure	11
Denial of Service	11
Elevation of Privilege	12
Chapter 3: Basic Security for Multiple MFPs	13
Notes on the Process of Configuration	13
Using Web Jetadmin and MFP Passwords	13
Getting started configuring MFP Security Settings	15
Setting up HP Web Jetadmin	15
Configuring HP Secure Hard Disk	17
Configuring SNMPv3	20
Configuring MFP Device Settings	26
I/O Timeout to End Print Job	26
Job Hold Timeout	26
Job Retention	27
Apply the Changes	27
Configuring MFP Network Settings	29
Enable Features	29
Encrypt all Web Communication	33
Encryption Strength	34
Error Handling	35
IPX RCFG Support	35
Job Timeout	36
Privacy Setting	36
Protocol Stacks	37
Web Services Print	39
Apply your Changes	40
Configuring MFP Security Settings	41
Bootloader Password	41
Color Access Control	42
Control Panel Access	42
Embedded Web Password	43
PJL Password	44
Printer Firmware Update	45
Secure Disk Encryption Mode	45
Apply the Changes	46
Configuring MFP Fax Settings	48
Configuring Fax Printing	48
Apply the Changes	49
Additional Fax Configuration	50
Configuring MFP Embedded Web Server Settings	52
Embedded Web Server Configuration Options	52
Apply the Changes	54
Configuring MFP File System Settings	55
File System External Access	55
File System Password	56
Secure File Erase Mode	57
Apply the Changes	58
Configuring MFP Digital Sending Settings	60
Auto Reset Send Settings	60
Default From Address	61
Apply the Changes	61
Configuring Final Settings	62
Disabling Direct Ports	62
Disabling EWS Config	63
Chapter 4: Advanced Security for Multiple MFPs	65
Access Control List (ACL)	65
Authentication Manager	67
Group 1 PIN and Group 2 PIN	68
LDAP	70
User Pin Authentication	71
Chapter 5: Settings List	72
Recommended Settings	72
Initial Settings	72
Device Category Settings	72
Network Category Options	72
Security Category Options	73
Fax Category Options	73
Additional Fax Configuration	73
Embedded Web Server Page Options	74
File System Page Options	74
Digital Sending Page Options	74
Final configurations	74
Chapter 6: Default Settings:	75
Chapter 7: Ramifications	79
Initial Settings	79
Device Page Settings	80
Network Page Options	80
Security Page Options	83
Fax Page Options	85
Additional Fax Configuration	85
Embedded Web Server Page Options	85
File System Page Options	86
Digital Sending Page Options	88
Final Configurations	88
Overall Limitations	89
Chapter 8: Physical Security	90

HP LaserJet M5000 LaserJet MFP - Imaging and Printing Security Best Practices - Page 82

Encrypt all web communication, Encryption Strength, IPX RCFG Support, Apply, Job Timeout, Privacy

Page 82 highlights