Multifunction Peripheral (MFP) Security for Enterprise Environments

MFP Security White Paper
3
firmware updates, access controls integral to device management are supported. Mechanisms are used to
check the authenticity of the firmware image; however it is still recommended that only firmware images
provided directly from HP be applied.
Vulnerabilities, buffer overflows, et al.
HP MFPs have been extensively tested to ensure that they may not be compromised by buffer overflows,
malformed data requests, and malformed data submissions.
The embedded web server and SNMP MIB have been rigorously tested to ensure HTML management pages
and SNMP OIDs are only accessible to authorized users when access controls are enabled.
Chai Platform
The Chai Platform is a powerful mechanism for device extensibility. The Chai platform allows specialized
applications known as “Chailets” to be installed on the MFP, extending its capabilities. A wide range of
Chailets have been developed, enabling job accounting, custom management interfaces, and web services
functionality.
While the Chai platform provides an excellent means of extending the device’s capabilities, administrators
should be careful to only allow Chailets from known and trusted sources to be installed. As is the case for PC
servers and workstations, it is important for the administrator to enable security to prevent the unauthorized
installation of potentially malicious applications.
Network Interface, EIO bus
Network connectivity is provided by Jetdirect network adapters using the MFP’s EIO expansion bus. Jetdirect
adapters support a variety of network types using the EIO bus:
Network Medium Model
10/100T Ethernet Jetdirect 615n and 620n
802.11b Wireless Ethernet Jetdirect 680n
Wireless Ethernet
The 802.11b Wireless Ethernet adapter supports the leading industry standard security protocols, including
WPA, WEP 64bit and 128bit encryption, as well as 802.1x-based protocols (EAP-TLS, EAP-MD5, PEAP,
and RADIUS integration) for authentication and dynamic key distribution.
MFP Analog FAX Accessory
The Analog FAX accessory allows the MFP to act as a stand-alone FAX machine, able to transmit and receive
analog faxes. The analog FAX accessory operates through a parallel port connection with the MFP. Neither
the MFP nor Jetdirect network adapter nor FAX accessory firmware provides mechanisms for the bridging of
network to analog interfaces.
Disk Drive
The HP MFP uses a hard disk drive (HDD) for a variety of spooling, job retention, and private printing (see
MFP Scanning/Copying) tasks. The HDD uses the MFP’s EIO bus for connectivity. The HDD may be
physically secured from theft and tampering using an accessory lock. The accessory lock requires a physical
key for hard disk drive removal.