HP Commercial LaserJet Printers and MFPs - Imaging and Printing Security Best Practices

Chapter 7 HP LaserJet and Color LaserJet MFP Security Checklist 79
 Disable unused Protocol Stacks. These options provide for the various types of network
communication to the MFPs. Closing down unused protocol stacks is affective toward better
network security. See the ramifications of each option below:
 Disable IPX/SPX. IPX/SPX is the network protocol for Novell. Disabling it prevents
printing and all other communications with Novell non-TCP/IP components. With it
disabled, Novell non-TCP/IP components will not recognize the MFPs on the network.
 Enable TCP/IP. TCP/IP is the standard network protocol for MFP operations. It provides
the necessary network communication for printing and for configuration. It should be
enabled during normal use of MFPs.
 Disable DLC/LLC. DLC/LLC is used in small networks in which routing is not required. The
MFPs include it for compatibility with older HP products.
 Disable AppleTalk. AppleTalk is used with older Apple computers. You should disable
it unless your network includes older Apple or Macintosh computers. With it disabled MFPs
will not appear on the network for these computers.
Disable Web Services Print. This disables the Microsoft WSD Print services supported on the
HP Jetdirect Print Server. If this feature is enabled someone with a host that supports Web
Services Print can discover IP Addresses and other information about the printers in your
environment.
Security Page Options
 Configure Bootloader Password.
The Bootloader Password protects against accidental or unauthorized intentional access to the
MFP Bootloader settings. These settings are similar to the BIOS settings on a PC. They affect the
services that are loaded when the MFP is turned on. The Bootloader Password setting is
permanent. There is no way to reset it or to change it without providing the correct password.
Thus, it is extremely important to use a password that can be remembered and to record the
password in a safe place.
 Configure color restriction settings. If your network includes Color LaserJet MFPs, you can
configure settings to restrict the use of color printing by users and by applications.
With color restriction settings configured, an MFP will print only in black and white for
restricted users or applications.
 Configure Control Panel Access Lock to Maximum Lock. Control Panel Access Lock
denies access to configuration settings from the MFP control panel. This ensures that no one will
be able to change configuration settings from the control panel.
This setting places a lock icon on the affected settings on the control panel. If a user selects a
locked setting, the control panel states that access is denied. Access can be restored only by
changing the Control Panel Access Lock configuration using Web Jetadmin (assuming that
you are following all of the recommendations in this checklist).
The Control Panel Access Lock prevents everyone from accessing settings on the control panel.
There is no way to give access to authorized users. The MFP does not include functionality to
setup authorization for control panel controls.