HP Enterprise printers and scanners - Imaging and Printing Security Best Practices (white paper)

The Fax Printing options limit access to timely faxes. You may wish to provide the PIN to a number of people to ensure that
someone can print a fax on demand. You can also configure fax alerts to ensure that personnel will know when a fax arrives even
though it is not printed upon arrival.
Additional Fax Configuration
Configure the number of Fax Speed Dials with the Embedded Web server. With the number of fax speed-dials configured and access
to these locked down no one can tamper with you speed-dial settings from the front panel of the MFP.
File System Options
 Configure File System External Access. The File System External Access settings shuts down access to the MFP file
system (storage devices and configuration settings) through protocols and ports. They eliminate access from various
types of management tools. HP recommends shutting down all unused access to the file system. See the ramifications for
each protocol below.
NOTE:
Some storage management tools, such as the Web Jetadmin Device Storage Manager (a Web Jetadmin add-on available in the
Product Update navigation mode), use some of these protocols to access the file system. You might consider enabling these
protocols only to update configurations and then disable them during normal MFP operation.
Also, note that disabling PJL and PML only affects file system access, but disabling NFS shuts down the protocol for the entire MFP.
o Disable PJL access. PJL (Printer Job Language) includes capabilities to manage configurations in the form of
commands inside print jobs. Some of these commands can access MFP storage devices. Disabling PJL access to the file
system disables only the commands that affect the file system. This will not affect the preferences available for
normal print jobs.
With PJL access disabled, the MFPs will ignore PJL commands that attempt to access the file system.
PJL access needs to be enabled for some solutions to be installed correctly. After a solution is installed it is usually
safe to disable PJL access till the next upgrade or installation.
o Disable PostScript access. The PostScript protocol enables programs such as Adobe® products to access the MFPs
directly for printing and for access to fonts. Some of the commands it uses can access MFP storage devices. Disabling
PostScript access to the file system disables only the commands that affect the file system. This will not affect the
preferences available for normal print jobs, but could affect interoperability with third party products.
 Configure the File System Password. The File System password feature restricts access to the Secure File Erase Mode,
Secure Storage Erase, and External File System Access Settings. This setting is important because it helps protect data
stored on the MFPs. It does not affect normal use of the MFPs such as job storage.
Users attempting to make changes to the file system settings or attempting to access data through network ports will be
required to provide this password. Without the password, the MFP denies access to the File System and to File System
configurations.
Web Jetadmin stores the file system password in its encrypted device cache. It automatically provides the password when
the MFPs request it.
 Set the Secure File Erase Mode to Secure Fast Erase or to Secure Sanitizing Erase. Secure File Erase enables the MFPs to
overwrite storage space whenever files are deleted. This ensures that the original data is destroyed.