Home Search by Purpose Improving the Security of this Machine (For Administrators)

Search by Purpose

Improving the Security of this Machine (For Administrators)

To configure the IPsec operating environment ([IPsec Settings])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Network Settings]
        • [TCP/IP Settings]
          • [IPsec Settings]

Configure settings to enable use of IPsec on this machine.

The IPsec technology prevents the falsification or leakage of data on the IP packet basis by using encryption technology. As IPsec encrypts data in the network layer, secure communication is ensured even if you use protocols in an upper layer or applications that do not support encryption.

Settings

Description

[IPsec Settings]

Specify parameters required for IPsec communication.

You can configure IKE (Internet Key Exchange), SA (Security Association), IPsec peer, or IPsec protocol settings.

[IKE Settings]

Configure settings required to create a common key for IPsec.

For details, refer to Here.

[IPsec SA Settings]

Configure SA (Security Association) required for encrypted communication.

For details, refer to Here.

[Peer]

Register the peer of this machine to use IPsec.

For details, refer to Here.

[Protocol Setting]

Specify a protocol used for IPsec communication.

For details, refer to Here.

[Enable IPsec]

Configure settings to enable use of IPsec on this machine. Also, specify the policy for IPsec communication. For details, refer to Here.

[Communication Check]

Select this option to confirm IPsec communication error logs.

For details, refer to Here.

To specify an IP address that denies access to this machine ([IP Filtering (Deny Access)])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Network Settings]
        • [TCP/IP Settings]
          • [IP Filtering (Deny Access)]

Specify an IP address of a computer to which you want to deny access to this machine.

Settings

Description

[Enable]/[Disable]

Select whether to specify an IP address that denies access to this machine.

[Disable] is specified by default.

[Set 1] to [Set 5]

Enter the range of IP addresses that deny access using the following format.

  • Entry example: "192.168.1.1 - 192.168.1.10"

  • If a single IP address is allowed to access, you can only enter the address in one side of the range.

To specify an IP address that permits access to this machine ([IP Filtering (Permit Access)])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Network Settings]
        • [TCP/IP Settings]
          • [IP Filtering (Permit Access)]

Specify an IP address of a computer to which you want to allow access to this machine.

Settings

Description

[Enable]/[Disable]

Select whether to specify an IP address that allows access to this machine.

[Disable] is specified by default.

[Set 1] to [Set 5]

Enter the range of IP addresses that allow access using the following format.

  • Entry example: "192.168.1.1 - 192.168.1.10"

  • If a single IP address is allowed to access, you can only enter the address in one side of the range.

To configure the operating environment for IEEE802.1x authentication ([IEEE802.1x Authentication Settings])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Network Settings]
        • [IEEE802.1x Authentication Settings]

Select whether to use IEEE802.1x authentication. To use IEEE802.1x authentication, check the authentication status and configure the certification verification items.

Using IEEE802.1x authentication enables you to only connect devices authorized by administrators to the LAN environment. Devices that are not authenticated will not be allowed to even join the network, and this ensures rigid security.

Settings

Description

[ON]/[OFF]

Select whether to use IEEE802.1x authentication.

[OFF] is specified by default.

[Auth. Status]

Displays the status of IEEE802.1x authentication on this machine.

[Reset Job Settings]

Reset the current setting.

[Certificate Verification Level Settings]

To verify the certificate, select items to be verified.

  • [Expiration Date]: Confirm whether the certificate is within the validity period. [Confirm] is specified by default.

  • [CN]: Confirm whether CN (Common Name) of the certificate matches the server address. [Do Not Confirm] is specified by default.

  • [Chain]: Confirm whether there is a problem in the certificate chain (certificate path). The chain is validated by referencing the external certificates managed on this machine. [Do Not Confirm] is specified by default.

To change the administrator password of this machine ([Administrator Password])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Administrator Password]

If necessary, change the administrator password of this machine. Be sure to remember the changed password so that you do not forget it.

Enter the current administrator password before setting a new administrator password.

Settings

Description

[Password]

Enter a new administrator password (using up to 64 characters).

[Password Confirmation]

Retype the new administrator password for confirmation.

  • If you enter an incorrect administrator password a configured number of times, you are prohibited from using this machine. In this case, contact your service representative.

To change the level at which a user can change settings in the setting items configured by the administrator ([Administrator Security Levels])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Administrator Security Levels]

From those items that are set up by the administrator, select levels at which users are authorized to change settings.

Configure the settings you have opened up to users in [User Settings].

Settings

Description

[Level 1]

Open up the following settings to the users.

  • [Low Power Mode Settings]

  • [Sleep Mode Settings]

  • [Auto Zoom (Platen)]

  • [Auto Zoom (ADF)]

  • [Specify Default Tray when APS Off]

  • [Tri-Fold Print Side]

  • [Automatic Image Rotation]

[Level 2]

Open up the following settings to the users.

  • Settings that are opened up to users in [Level 1]

  • [Print/Fax Output Settings]

  • [Output Tray Settings]

  • [AE Level Adjustment]

  • [Blank Page Print Settings]

  • [Page Number Print Position]

  • [Change E-Mail Address]

  • [Print Jobs During Copy Operation]

[Prohibit]

The settings are not opened up to users.

[Prohibit] is specified by default.

To restrict the minimum number of characters used for a password or the available text types ([Password Rules])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Password Rules]

Configure whether to enable the password rules. Once you enable it, the number of characters and text types that are available for passwords is restricted. If necessary, change the minimum number of password characters.

Settings

Description

[Enable]/[Invalid]

Select whether to enable Password Rules. Before enabling Password Rules, change the current password to the one that complies with the password rules.

[Invalid] is specified by default.

Once Password Rules is enabled, the following rules are applied to any password that is configured on this machine.

  • The minimum number of characters set in [Set Minimum Password Length] (default: 12)

  • Passwords are case sensitive.

  • A password consisting of a string of identical characters cannot be used.

  • The previous password cannot be used.

The password rules are applied to:

  • Administrator Password

  • User Password

  • Account Password

  • User Box Password

  • User Box Administrator Password

  • Secure Print Document Password

  • WebDAV Server Password

  • SNMP Password

  • Remote panel server password

  • Encryption Passphrase

[Set Minimum Password Length]

If you enable Password Rules, change the minimum number of characters for a password, as required.

To specify the severity of penalties applied when an incorrect password is entered during the authentication process ([Prohibited Functions When Authentication Error])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Prohibited Functions When Authentication Error]

Define the severity of penalties applied if an incorrect password is entered during the authentication process.

Settings

Description

[Prohibited Functions When Auth. Errorr]

Select the severity of penalties applied if an incorrect password is entered during the authentication process.

  • [Mode 1]: If authentication fails, the authentication operation (entry of password) is prohibited for five seconds.

  • [Mode 2]: If authentication fails, the authentication operation (entry of password) is prohibited for five seconds. The number of times, authentication fails is also counted and if the failure count reaches a predetermined value, the authentication operation is prohibited and the machine is set into an access lock state.

[Mode 1] is specified by default.

[Release]

Select an item to be released from Access Lock during authentication failure.

[Release Time Settings]

If necessary, change the time that elapses before an access lock state in the Administrator Setting mode is canceled.

If a predetermined time has elapsed after the machine was restarted, an access lock state is canceled.

[5] minutes is specified by default.

To check how to access files in the Secure Document User Box ([Confidential Document Access Method])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Confidential Document Access Method]

Specify how to enter an ID and a password when accessing to a file in the Secure Print User Box. This function is forced determined in conjunction with [Prohibited Functions When Authentication Error].

Settings

Description

[Mode 1]

Displays all files when the ID and password specified in the printer driver are entered. Select a desired file and print it.

[Mode 1] is specified by default.

[Mode 2]

Displays all files when the ID specified in the printer driver are entered. To print, select your desired file, then enter the appropriate password for each file.

To prohibit a user from directly entering a destination ([Manual Destination Input])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Manual Destination Input]

Select whether to allow the user to directly enter destinations.

Settings

Description

[Allow All]

Allows the direct input of destinations.

[Allow All] is specified by default.

[Individual Allowance]

Select whether to allow direct input for each function.

[Restrict]

Prohibits the direct input of destinations. Hides [Direct Input] in the main screen in fax/scan mode.

To prohibit fax transmission or network fax transmission ([Restrict Fax TX])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Restrict Fax TX]

Select whether to restrict fax transmissions.

If [ON] (Restrict) is selected, the fax functions no longer appear in the fax/scan mode.

[OFF] (Allow) is specified by default.

To hide personal information such as addresses or file names on the [Job List] screen ([Personal Data Security Settings])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Personal Data Security Settings]

Specify whether to hide personal information, such as destination and file name, in [In Progress.] and [Log] on the [Job List] screen.

Settings

Description

[Job History]

Specify whether to hide personal information, such as destination and file name, in [Job History] in the [Job List] screen.

The default is [No] (without user authentication/account track) or [Yes] (with user authentication/account track).

[Display Settings]

When you have selected [Yes], select items you want to hide.

  • [Mode 1]: Destination, file name, and user box name

  • [Mode 2]: Destination, file name, and user box name, and user name

[Public User]/[User Authentication]/[Authentication Track]

Select how to display items you specified in [Display Settings] per Public User, User Authentication, and Authentication Track.

  • [Mode 1]: Hide all display items.

  • [Mode 2]: Hide only display items other than for login user/login account.

  • [Mode 3]: Hide only display items other than for a public user, login user/public user, and login account.

  • [Mode 4]: Show all display items.

[Current Job]

Specify whether to hide personal information, such as destination and file name, in [In Progress] in the [Job List] screen.

The default is [No] (without user authentication/account track) or [Yes] (with user authentication/account track).

[Display Settings]

When you have selected [Yes], select items you want to hide.

  • [Mode 1]: Destination, file name, and user box name

  • [Mode 2]: Destination, file name, and user box name, and user name

[Public User]/[User Authentication]/[Authentication Track]

Select how to display items you specified in [Display Settings] per Public User, User Authentication, and Authentication Track.

  • [Mode 1]: Hide all display items.

  • [Mode 2]: Hide only display items other than for login user/login account.

  • [Mode 3]: Hide only display items other than for a public user, login user/public user, and login account.

  • [Mode 4]: Show all display items.

  • When logged in as an administrator or user box administrator, all personal information is displayed regardless of the settings.

To hide personal information such as addresses or file names on MIB information ([Hide Personal Information (MIB)])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Hide Personal Information (MIB)]

Specify whether or not to display the file name, destination, and User Box name and number of the MIB information.

[ON] (hide) is specified by default.

To hide the activity log for Scan, Fax TX and RX ([Display Activity Log])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Display Activity Log]

Select whether to show the activity log on Scan, Fax TX and RX.

If [OFF] is selected, [Comm. List] does not appear on the [Job List] screen.

[ON] (display) is specified by default.

To initialize job history, network settings, copy program, and destination information ([Initialize])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Initialize]

Initializes the settings in [Job History], [Copy Program], [Network Settings], and [Address Reg.].

Select items you want to initialize, then tap [OK].

To prohibit access to the Web page contents saved on the hard disk of this machine ([Web browser contents access])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Security Details]
          • [Web browser contents access]

Specify whether to allow an access to the Web page contents being saved on the hard disk of the MFP.

For details, contact your service representative.

[Allow] is specified by default.

To enable the enhanced security mode and enhance the security of data management ([Enhanced Security Mode])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Enhanced Security Mode]

Select whether to enable the Enhanced Security Mode.

If you enable the Enhanced Security Mode, the various security functions are forcibly configured. This allows you to ensure higher-level security of data management. For details, contact your service representative.

To enable the enhanced security mode, the following settings must have been configured.

Setting items in Administrator Settings

Settings to forcibly changed

[User Authentication/Account Track] - [General Settings] - [User Authentication]

Set to [Authenticate].

[Security Settings] - [Administrator Password]

Set a password complying with password rules.

[Security Settings] - [HDD Settings] - [HDD Encryption Setting]

Enable the HDD Encryption.

In Web Connection, register the certificate.

For details, refer to Here.

[Image Controller Setting]

[Management Function Choice]

[CE Password]

[CE Authentication]

[HDD]

These items must be configured by your service representative. For details, contact your service representative.

If you enable the Enhanced Security Mode, the following settings are forcibly changed.

Setting items in Administrator Settings

Settings to forcibly changed

[System Settings] - [Restrict User Access] - [Restrict Access to Job Settings] - [Registering and Changing Addresses]

Set to [Restrict].

[User Authentication/Account Track] - [General Settings] - [Public User Access]

Set to [Restrict].

[User Authentication/Account Track] - [User Authentication Settings] - [Administrative Settings] - [User Name List]

Set to [OFF].

[User Authentication/Account Track] - [Print without Authentication]

Set to [Restrict].

[User Authentication/Account Track] - [User/Account Common Setting] - [Counter Remote Control]

Set to [Restrict].

[User Authentication/Account Track] - [Print Simple Auth.] - [Authentication Setting]

Set to [Restrict].

[Network Settings] - [FTP Settings] - [FTP Server Settings]

Set to [OFF].

[Network Settings] - [E-mail Settings] - [S/MIME Communication Settings]

  • [Automatically Obtain Certificates] is set to [No].

  • [3DES] is set if [E-Mail Text Encryption Method] has been set to one of [RC2-40], [RC2-64], [RC2-128], and [DES].

[Network Settings] - [SNMP Settings] - [SNMP v1/v2c Settings] - [Write Setting]

Set to [Invalid].

[Network Settings] - [SNMP Settings] - [SNMP v3 Settings]

[Security Level] for read and write allowed users is set to [auth-password/priv-password].

The Security Level can be changed to [auth-password].

[Network Settings] - [TCP Socket Settings] - [TCP Socket] - [Use SSL/TLS]

Set to [ON].

[Network Settings] - [WebDAV Settings] - [WebDAV Server Settings] - [SSL Setting]

Set to [SSL Only].

[Network Settings] - [Web Browser Setting]

Set to [Invalid].

[Network Settings]-[Remote Panel Settings]

  • [Client Settings]: Set to [OFF].

  • [Server Setting]: Set to [OFF].

[System Connection] - [OpenAPI Settings] - [SSL/Port Settings] - [SSL Setting]

Set to [SSL Only].

[Security Settings] - [User Box Administrator Setting]

Set to [Restrict].

[Security Settings] - [Security Details] - [Password Rules]

Set to [Enable].

If [Enable] cannot be selected for the Password Rules, you cannot enable the Enhanced Security Mode.

[Security Settings] - [Security Details] - [Prohibited Functions When Authentication Error]

  • [Prohibited Functions When Authentication Error] is set to [Mode 2] and [No. of Tries] is set to [3]. No. of tries can be changed in the range between [1] and [3].

  • [Release Time Settings]: Limited to [5] minutes. This value cannot be less than five minutes.

[Security Settings] - [Security Details] - [Confidential Document Access Method]

Set to [Mode 2].

[Security Settings] - [Security Details] - [Print Data Capture]

Set to [Restrict].

[Security Settings] - [Security Details] - [Hide Personal Information (MIB)]

Set to [ON].

[Security Settings] - [Security Details] - [Initialize]

If you select [Network Settings] and start it, the Enhanced Security Mode is canceled

[Remote Access Setting] - [Import/Export User Data]

Set to [Restrict].

[Maintenance] - [Import/Export] in Web Connection

The password must be configured.

[Security] - [PKI Settings] - [Device Certificate Setting] in Web Connection

[Remove Certificate] is hidden.

[Security] - [PKI Settings] - [SSL Setting] in Web Connection

  • [Mode using SSL/TLS]: Set to [Admin. Mode and User Mode].

  • [Encryption Strength]: If it has been set to [AES-256, 3DES-168, RC4-128, DES-56, RC4-40] or [AES-256, 3DES-168, RC4-128], it is changed to [AES-256, 3DES-168].

[Security] - [PKI Settings] - [Protocol Setting] in Web Connection

[Protocol 1]: [SSL], [Protocol 2]: The certificate is registered in the [http Server].

Remote Diagnosis System

Some functions may be disabled. For details, contact your service representative.

[Security Settings] - [Image Log Transfer Settings]

Set to [OFF].

Preview Secure Document User Box

Only the list is displayed before the password authentication is performed.

  • If you change a setting that has been forcibly changed when the Enhanced Security Mode was enabled, a confirmation dialog box may possibly appear and the Enhanced Security Mode may be canceled.

  • A setting that has been forcibly changed when the Enhanced Security Mode was enabled will not be changed if you disable the Enhanced Security Mode.

  • Once the password rules have been enabled, an item for which a password that do not comply with the rules has been configured will result in authentication failure.

To check the used area, entire area, and free space on the hard disk ([Check HDD Capacity])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [Check HDD Capacity]

Enables you to check the used space, total space and available space on the hard disk.

To automatically overwrite data stored on the hard disk or in the memory ([Overwrite HDD Data])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [Overwrite HDD Data]

This machine temporarily stores image data on the hard disk or in the memory during scanning and printing. When the stored data are no longer needed, you can delete them by overwriting with certain data.

Settings

Description

[Yes]/[No]

Specify whether to automatically delete data stored on the hard disk or in the memory by overwriting.

[No] is specified by default.

[Overwrite Method]

Select the method for deleting data stored on the hard disk or memory by overwriting.

  • [Mode 1]: Overwrites with 0x00.

  • [Mode 2]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with letter "A" (0x61) - Verifies

[Mode 1] is specified by default.

[Encryption Priority]/[Overwrite Priority]

When setting [Overwrite HDD Data] with [HDD Encryption Setting] in combination, select the preferred option for deleting data stored on the hard disk.

  • [Encryption Priority]: Overwrites data using a method different from [Mode 1] and [Mode 2] of [Overwrite Method]. To set [Overwrite HDD Data], select [Encryption Priority].

  • [Overwrite Priority]: Overwrites data using the method specified at [Overwrite Method].

When changing this setting, you need to formatting the hard disk after restarting this machine. Before you attempt to change the setting, be aware that data may be deleted.

[Encryption Priority] is specified by default.

To automatically overwrite all data stored in the entire area on the hard disk ([Overwrite All Data])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [Overwrite All Data]

When disposing of this machine or returning it to a leasing business, use this function to delete all data saved on the hard disk by overwriting. This function also resets all passwords to the factory settings.

Prior to performing this operation, contact your service representative.

To perform delete by overwriting, select [HDD Overwrite Method] and tap [Delete].

  • [Mode 1]: Overwrites with 0x00.

  • [Mode 2]: Overwrites with single-byte random numbers - overwrites with single-byte random numbers - overwrites with 0x00.

  • [Mode 3]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with single-byte random numbers - Verifies.

  • [Mode 4]: Overwrites with single-byte random numbers - Overwrites with 0x00 - Overwrites with 0xff.

  • [Mode 5]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff.

  • [Mode 6]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with random numbers.

  • [Mode 7]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0xaa.

  • [Mode 8]: Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0x00 - Overwrites with 0xff - Overwrites with 0xaa - Verifies.

[Mode 1] is specified by default.

To lock the hard disk with a password in order to protect the stored data ([HDD Lock Password])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [HDD Lock Password]

Protects saved data by locking the hard disk using a password.

To encrypt the data on the hard disk, enter an encryption passphrase (in 20 characters, case sensitive).

Be sure to keep the password you have entered carefully so that you do not forget them. Should the password be lost, it takes a major recovery work to restore it.

If a password is already set, you can change or cancel it.

To format the hard disk ([Format HDD])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [Format HDD]

Formats the hard disk.

Retrieve any data needed from the hard disk beforehand.

Formatting the hard disk causes the following types of data to be deleted.

  • Program

  • Address Book

  • Authentication method setting

  • User authentication setting

  • Account track setting

  • User Box

  • User Box setting

  • Documents in User Boxes

  • Confidential User Box setting

  • Bulletin Board User Box setting

To encrypt data on the hard disk for protection purposes ([HDD Encryption Setting])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [HDD Settings]
          • [HDD Encryption Setting]

Encrypts all data saved on the hard disk for protection purposes.

To lock the hard disk with a password, enter a password to lock it (in 20 characters, case sensitive).

Be sure to keep the encryption passphrase you have entered carefully so that you do not forget them.

To forcibly apply stamps to original data when printing or sending the data ([Apply Stamps])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Stamp Settings]
          • [Apply Stamps]

Select whether to force application of stamps to original data when printing and sending a fax. To apply a stamp, configure the type and print position.

Users are not allowed to manually change or cancel the settings for the stamp function. You can explicitly indicate the sender identification by adding the user name or company name. Also, you can use the copy security function to suppress unauthorized copy operation.

For both [Printing] and [Sending], [Do Not Apply] is specified by default.

To delete the registered stamps ([Delete Registered Stamp])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [Stamp Settings]
          • [Delete Registered Stamp]

Deletes stamps registered for Stamp, Copy Protect and Stamp Repeat.

To enable the FIPS mode ([FIPS Settings])

To display:
  • [Utility]
    • [Administrator Settings]
      • [Security Settings]
        • [FIPS Settings]

Specify whether to enable the FIPS (Federal Information Processing Standardization) Mode.

FIPS defines security requirements for cryptographic modules. These standards are adopted by many organizations, including U.S. federal government agencies. Enabling the FIPS Mode makes the functions of the machine conform to the FIPS.

[Invalid] is specified by default.

To prohibit the registration of the OpenAPI application ([OpenAPI Certification Management Setting])

To display:
  • [Utility]
    • [Administrator Settings]
      • [OpenAPI Certification Management Setting]

Specify a restriction code to prevent an OpenAPI connection application from being registered on this machine.

For details, contact your service representative.