WorkCentre 7220-7225 Information Assurance Disclosure Paper
Ver. 1.0, January 2013
Page
35 of 61
3.3.
System Accounts
3.3.1.
Printing
The device may be set up to connect to a print queue maintained on a remote print server. The login name and
password are sent to the print server in clear text. IPSec should be used to secure this channel.
3.3.2.
Network Scanning
Network Scanning may require the device to log into a server. The instances where the device logs into a server are
detailed in the following table. Users may also need to authenticate for scanning. This authentication is detailed in
subsequent sections.
3.3.2.1.
Device log on
Scanning feature
Device behavior
Scan to File, Public Template
The device logs in to the scan repository as set up by the SA in the
Properties tab on the WebUI.The credentials may be the user’s
credentials or system credentials.
Scan to E-mail, I-Fax
The device logs into an LDAP Server as set up by the SA in User Tools. It
will log into the Server when a user is authenticated and the device is
configured for Remote Authorization or Personalization is enabled, and
when the user attempts to access LDAP based scan-to-email address
books. At the time the LDAP server must be accessed, the device will log
into (bind to)_ the LDAP server.
The device uses a simple bind to the LDAP server unless the device was
able to obtain a TGS for the LDAP server from the Kerberos Servier. In
this case a SASL (GSSAPI) bind is performed.. A network username and
password may be assigned to the device. The device logs in as a normal
user, with read only privileges. User credentials may be used if
configured by the SA for this authentication step.
The device then logs into the SMTP server as set up by the SA in the
Properties tab on the WebUI.The credentials may be the user’s
credentials or system credentials.
Scan to Fax Server
The device logs in to the Fax Server as set up by the SA from the
Properties tab on the WebUI. The credentials may be the user’s
credentials or system credentials.
Please note that when the device logs into any server the device username and password are sent over the network in
clear text unless:
•
SSL has been enabled
•
IPSec has been configured to encrypt the traffic
•
The device is logging into an SMB Server in which case the credentials are hashed.
•
The device is using NTLM to login to the SMTP server (the device negotiates the most secure authentication
method that both the device and server support).
•
The LDAP server is being accessed via SASL.
3.3.2.2.
Scan Template Management
This is a web service that allows the SA to manage templates stored in a remote template pool. The connection to
the remote pool can be secured with SSL.
