bizhub PRO C6500 - KONICA MINOLTA

Pre.fm
Page 1
Monday, September 11, 2006 3:49 PM
bizhub PRO C6500
Security
User’s Guide
The Control Software version is as follows.
Image control program (Image Control l1) version:
A03U0Y0-00I1-G00-11, A03U0Y0-00l1-G00-12
About the Firmware version display function:
The bizhub PRO Control Software (Image control program) version
mentioned above can be confirmed by using the service representative (CE)
service mode ROM version display function.
When you display the firmware version, the Image control program version
will be displayed as follows.
Image control program (Image Control l1) version:
G00 + 2 digits following the hyphen (Ex: G00-**)
Please keep this in mind when checking the software version.
Copyright © 2006 KONICA MINOLTA BUSINESS TECHNOLOGIES, Inc.
Pre.fm
Page 2
Monday, September 11, 2006 3:49 PM
ACKNOWLEDGEMENTS:
- KONICA MINOLTA, KONICA MINOLTA Logo, and The essentials of
imaging are registered trademarks or trademarks of KONICA MINOLTA
HOLDINGS, INC.
- bizhub PRO are registered trademarks of KONICA MINOLTA BUSINESS
TECHNOLOGIES, Inc.
EXEMPTION:
- No part of this manual may be used or duplicated without permission.
- Manufacturer and Sales Company will have no liability for any influences
caused by using the printing system and this User’s Guide.
- The information written in this is subject to change without prior notice.
bizhub_C6500.book
Page 3 Monday, September 11, 2006
1:56 PM
Composition of User’s Guide
This machine is provided with the following user’s guides as printed matters.
*bizhub PRO C6500 User’s Guide - Copier
This guide describes an outline of the machine and copy operations.
Please refer to this guide for safety information, turning on/off the machine,
paper supply, dealing with machine trouble such as paper jam, and copy operation available on the machine.
* bizhub PRO C6500 User’s Guide - POD Administrator’s Reference
This guide provides you with detailed information about the machine management and how to customize the machine according to your daily use.
Please refer to this guide for a setup and management of the machine including registration of copy paper and tray setting.
* bizhub PRO C6500 User’s Guide - Security (This book)
This guide describes the security functions.
Please refer to this guide for how to use the Security Strengthen mode, and
for detailed machine operation in Security Strengthen mode.
To operate safely, be sure to read "Section 1 Safety Information" in "bizhub
PRO C6500 User’s Guide - Copier" before using the machine.
bizhub_C6500.book
Page 4 Monday, September 11, 2006
1:56 PM
bizhub_C6500.book
Page 5 Monday, September 11, 2006
1:56 PM
Contents
1
Security Functions ............................................................ 1
2
Security Strengthen Mode ............................................... 3
3
2.1
Description of Security Strengthen mode ..........................................3
2.2
Data protected by Security Strengthen mode ...................................4
Machine Administrator Security Functions .................... 5
3.1
4
Turn Security Strengthen mode ON/OFF ...........................................6
3.2
HDD lock password ............................................................................10
3.3
Print audit log ......................................................................................14
3.4
Analyze audit log ................................................................................17
3.5
Table of items saved in audit log ......................................................19
Index................................................................................. 21
bizhub_C6500.book
Page 6 Monday, September 11, 2006
1:56 PM
bizhub_C6500.book
Page 1 Monday, September 11, 2006
1:56 PM
Security Functions
1
1
Security Functions
The bizhub PRO C6500 device has two security modes.
Normal mode
Use this mode if the machine is used by a single person and there is a low
possibility of illicit access and operations. This is the default mode when
shipped from the factory.
To use regular mode, please see the user’s guide for each individual
machine.
Security Strengthen mode
Use this mode if the machine is connected to a local area network, or to
external networks through a telephone line or other means. A machine
administrator manages the device according to this user’s guide, so that
users can have a safe operating environment.
Your machine administrator is the only one who can turn the Security
Strengthen mode ON and OFF, and make other changes, and your service
representative will designate an machine administrator.
To turn the Security Strengthen mode ON, the service representative should
set a CE authentication password and machine administrator password for
the device.
Please contact your service representative when using the Security
Strengthen mode.
Please be sure to use the Security Strengthen mode to prevent data from
being accessed or tampered with.
The Security icon
is displayed on the touch panel if the Security
Strengthen mode is activated.
Environments in which Security Strengthen mode is recommended
- The machine is monitored by a telephone line or a network.
bizhub PRO C6500
1
bizhub_C6500.book
Page 2 Monday, September 11, 2006
1:56 PM
Security Functions
1
Creating a secure environment
For security, we recommend that supervisors and a machine administrator
use Security Strengthen mode and establish an environment as follows.
- Qualifications to be a machine administrator
A supervisor must select a reliable person who has adequate knowledge,
technical ability, and experience as a machine administrator, to whom to
delegate administration of the device.
- Guarantee of service representative (CE)
A supervisor or a machine administrator can use Security Strengthen
mode after confirming that a service contract was signed with the service
representative (CE). Clearly state in the service contract that the service
representative will not engage in any fraudulent actions.
- Secure LAN
Be sure to connect the machine to the LAN protected by firewall in order
to prevent access from an external network.
2
bizhub PRO C6500
bizhub_C6500.book
Page 3 Monday, September 11, 2006
1:56 PM
Security Strengthen Mode
2
Security Strengthen Mode
2.1
Description of Security Strengthen mode
2
The following items will have enhanced security.
- Machine NIC setting
While the Security Strengthen mode is activated, available function is
limited to CS Remote Care.
- External access prohibited
No access is allowed over telephone lines other than CS Remote Care.
- Create, save and analyze an audit log
A history of security function operations will be created and saved. Date
and time, information identifying the person who made the operation,
details of the operation, and results of the operation will be saved,
enabling analysis of unauthorized access. This log will be overwritten if
the audit area is depleted.
- Machine Administrator authentication
A service representative will set up an authentication data for a machine
administrator.
The machine administrator must input a password to gain authorized
access. Only one authentication string can be registered per machine.
- Machine Administrator Setting mode
If the machine administrator Setting mode has been entered by
successful Administrator authentication, the setting change of various
machine functions will be available on the machine.
Be sure to exit the machine administrator Setting mode if you leave in
front of the machine while using the machine administrator Setting mode.
bizhub PRO C6500
3
bizhub_C6500.book
Page 4 Monday, September 11, 2006
1:56 PM
Security Strengthen Mode
2
2.2
Data protected by Security Strengthen mode
The data protected by Security Strengthen mode is the document data
stored in the machin.
To turn Security Strengthen mode ON/OFF
The machine administrator can turn Security Strengthen mode ON/OFF.
If Security Strengthen mode is OFF, data can potentially be accessed, so be
careful.
4
bizhub PRO C6500
bizhub_C6500.book
Page 5 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
3
Machine Administrator Security
Functions
The machine administrator turns Security Strengthen mode ON/OFF.
To do so, an 8-digit CE authentication password and Machine Administrator
password must be set for the machine. Ask your authorized service
representative to set up a Machine Administrator password. To change this
password, the machine administrator himself should operate the procedure
described in the User’s Guide of POD Administrator’s reference.
To protect data in the machine from access and tampering, please be sure
to designate a machine administrator and use Security Strengthen mode.
2
Reminder
Do not use your name, birthday, employee number, etc. for a password
that others can easily figure out.
Be careful not to inform anybody else of the password, or not to let it
known to others.
bizhub PRO C6500
5
bizhub_C6500.book
Page 6 Monday, September 11, 2006
Machine Administrator Security Functions
3
3.1
1:56 PM
Turn Security Strengthen mode ON/OFF
The following is an explanation of how to turn Security Strengthen mode
ON/OFF.
2
Note
Passwords are case sensitive.
If a wrong password or fewer than 8 alphanumerical characters are
entered and the [OK] key is touched, the warning message "Password
does not match" will appear, and no key will work for five seconds. Enter
the right password after five seconds.
If authentication fails, the information will be saved in the audit log.
Procedure
1
Press [Utility/Counter] on the control panel to display the Utility Screen.
2
Touch [03 Machine Admin. Setting].
The Input Password Screen will be displayed.
6
bizhub PRO C6500
bizhub_C6500.book
Page 7 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
3
Enter the password.
Use the touch screen keypad to enter the 8-digit Machine
Administrator password, then touch [OK].
The Machine Administrator Setting Menu Screen will be displayed.
4
Touch [10 Security Setting].
bizhub PRO C6500
7
bizhub_C6500.book
1:56 PM
Machine Administrator Security Functions
3
8
Page 8 Monday, September 11, 2006
5
Touch [04 Security Strengthen Set]
6
Turn Security Strengthen mode ON or OFF
If you want to turn Security Strengthen mode ON, touch [On] to
highlight it. If you want to turn it OFF, touch [Off] to highlight it.
bizhub PRO C6500
bizhub_C6500.book
Page 9 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
7
3
Touch [OK].
The Restart Confirmation popup screen will appear
8
Touch [Yes].
The machine will restart and the new setting will be activated.
bizhub PRO C6500
9
bizhub_C6500.book
Page 10 Monday, September 11, 2006
Machine Administrator Security Functions
3
3.2
1:56 PM
HDD lock password
While the Security Strengthen mode is turned ON, a lock password (8 to 32
alphanumerical characters, case sensitive) can be set up on the HDD to
protect the data stored on it.
If the HDD itself is externally accessed, the data readout will not be available
until the correct lock password is entered.
2
Reminder
Do not use your name, birthday, employee number, etc. for a password
that others can easily figure out.
Be careful not to inform anybody else of the password, or not to let it
known to others.
2
Note
The HDD lock password functions only when the Security Strengthen
mode is ON. When turned OFF, the message "Please set Security
Strengthen mode" will be displayed.
2
Note
Passwords are case sensitive.
If a wrong password or fewer than 8 alphanumerical characters are
entered and the [OK] key is touched, the warning message "Password
does not match" will appear, and no key will work for five seconds. Enter
the right password after five seconds.
If authentication fails, the information will be saved in the audit log.
!
Detail
The main body serial number will be printed at the upper right corner of
the audit log. For details, see the next section "Print audit log" and p. 17
for the sample log.
If authentication fails, the information will be saved in the audit log.
The current password cannot be used again as a new password.
10
bizhub PRO C6500
bizhub_C6500.book
Page 11 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
Procedure
1
Press [Utility/Counter] on the control panel to display the Utility Screen.
2
Touch [03 Machine Admin. Setting].
The Input Password Screen will be displayed.
3
Enter the password.
Use the touch screen keypad to enter the 8-digit Machine
Administrator password, then touch [OK].
The Machine Administrator Setting Menu Screen will be displayed.
bizhub PRO C6500
11
bizhub_C6500.book
Page 12 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
4
Touch [10 Security Setting].
5
Touch [02 HDD Lock Password].
The HDD Lock Password Menu Screen will be displayed.
12
bizhub PRO C6500
bizhub_C6500.book
Page 13 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
6
Touch [Current Password] to enter the password currently used, then
touch [OK].
The first password: 13-digit alphanumeric serial number of the main
body
7
If authentication is succeeded, touch [New Password] to enter the new
password.
The key will not be active until authentication is succeeded.
–
8
Touch [Check Input] to re-enter the same password as above.
–
9
Touch [OK] to return to the previous screen.
Touch [OK] to return to the previous screen.
Touch [OK].
bizhub PRO C6500
13
bizhub_C6500.book
Page 14 Monday, September 11, 2006
Machine Administrator Security Functions
3
3.3
1:56 PM
Print audit log
An audit log will be automatically created when the data saved in the
machine have been accessed.
All the audit log data can be output as follows.
2
Note
Passwords are case sensitive.
If a wrong password or fewer than 8 alphanumerical characters are
entered and the [OK] key is touched, the warning message "Password
does not match" will appear, and no key will work for five seconds. Enter
the right password after five seconds.
If authentication fails, the information will be saved in the audit log.
2
Note
To stop printing, press [Stop] on the control panel, then touch [Cancel] on
the confirmation popup screen.
Procedure
1
Press [Utility/Counter] on the control panel to display the Utility Screen.
2
Touch [03 Machine Admin. Setting].
The Input Password Screen will be displayed.
14
bizhub PRO C6500
bizhub_C6500.book
Page 15 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
3
Enter the [password].
Use the touch screen keypad to enter the 8-digit Machine
Administrator password, then touch [OK].
The Machine Administrator Setting Menu Screen will be displayed.
4
Touch [01 System Setting].
bizhub PRO C6500
15
bizhub_C6500.book
Page 16 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
5
Touch [06 List/Count].
The Management List Print Screen will be displayed.
16
6
Touch [Audit Log Report], then touch [COPY].
7
Press [Start] on the control panel.
bizhub PRO C6500
bizhub_C6500.book
Page 17 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3.4
3
Analyze audit log
Audit logs need to be analyzed by the Machine Administrator regularly (once
per month) or when unauthorized access and tampering of data saved in the
machine in Security Strengthen mode is noticed.
The machine is supposed to store up 750 logs per month.
If more than 750 logs are assumed to be stored in a month, carry out the
analysis in a shorter period before the unanalyzed logs reach that number.
bizhub PRO C6500
17
bizhub_C6500.book
Page 18 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3
Audit Log Information
The audit log contains the following information.
1. date/time: date and time when an operation was made that results in the
creation of a log entry.
2. id: the person who made the operation or who is subject to security
protection can be specified.
"-1": Operation by CE (service representative).
"-2": Operation by the machine administrator.
Other integer: Indicates subjects for security protection.
3. action: Used to specify the operation.
Check details of operation that action indicates in the following table.
4. result: Result of an operation.
For password authentication, success or failure will be indicated as OK
and NG.
For operations without password authentication, all log entries will be
indicated as OK.
18
bizhub PRO C6500
bizhub_C6500.book
Page 19 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
3.5
3
Table of items saved in audit log
No.
Operation
ID
Stored
action
Result
1
CE authentication
CE ID
01
OK/NG
2
Manager authentication
Machine Administrator
ID
02
OK/NG
3
Set/change Security Strengthen
mode
Machine Administrator
ID
03
OK
4
Print audit log
Machine Administrator
ID
04
OK
5
Change/register CE password
CE ID
05
OK
6
Change/register Machine Administrator password password
CE ID/ Machine Administrator ID
06
OK
13
Change HDD lock password
Machine Administrator
ID
19
OK
The purpose of analyzing the audit log is to understand the following and
implement countermeasures:
Whether or not data was accessed or tampered with
Subject of attack
Details of attack
Results of attack
For specific analysis methods, see the next page.
bizhub PRO C6500
19
bizhub_C6500.book
3
Page 20 Monday, September 11, 2006
1:56 PM
Machine Administrator Security Functions
Specify unauthorized actions: password authentication
If logs have NG as the result of password authentication (action: 01, 02),
items protected by passwords may have been attacked.
- Failed password authentication (NG) log entries specify who made the
operation, and show if unauthorized actions were made when password
authentication failed.
- Even if password authentication succeeded (OK), it shows whether a
legitimate user created the action. You need to check carefully when
successful authentication occurs after series of failures especially during
times other than normal operating hours.
Specify unauthorized actions: actions other than password
authentication under security
All operation results other than password authentication will be indicated as
successful (OK), so determine if there were any unauthorized actions by ID
and action.
- Check the time, and see if the user who operated the specific subject
made any unauthorized actions.
Actions to take if unauthorized operations are found
If it's found that a password has been leaked after analyzing the audit log,
change the password immediately.
20
bizhub PRO C6500
bizhub_C6500.book
Page 21 Monday, September 11, 2006
Index
4
1:56 PM
4
Index
A
Audit log
Analyze 3-17
Print 3-14
E
Enhanced security mode
Audit log 2-3
Normal mode 1-1
M
Machine Administrator Security
Functions 3-5
HDD lock password 3-10
S
Security strengthen mode
Data protected 2-4
Environments 1-1
Machine Administrator
authentication 2-3
Machine Administrator setting
mode 2-3
Turn ON/OFF 2-4
bizhub PRO C6500
21
bizhub_C6500.book
Page 22 Monday, September 11, 2006
1:56 PM