Security is Left Out of a Decision Till Too Late

Know what gets old really fast for a security manager? Read on.

By J.F. Rice

September 21, 2009 — Computerworld —

Do you know what gets old really fast for a security manager? It's being told that some decision has been made, that it's too late to modify it, that no one thought input from the security manager was needed, and that there's no budget to deal with the concerns he's raising at the eleventh hour. All of this has just happened to me -- again.

This time, the problem is MFDs -- multifunction devices that look like photocopiers on steroids. I found out that we had signed a contract to replace all of our printers with MFDs when workers showed up to haul away all our laser printers and then started wheeling in these new monstrosities.

Trouble Ticket

At issue: Company printers have been replaced by multifunction devices that have brains -- internal Windows computers.

Action plan: Find a way to get these new computers updated regularly, for starters.

I thought our old printers were fine, but apparently we can save a lot of money by using these new "smart" devices that can call for help when they run out of paper, need toner or get jammed. They are all network-connected and can print, scan, copy, fax, e-mail and do just about everything except the dishes. Sounds cool, right?

The problem is that they aren't really printers. They are network-connected computers with attached peripherals to perform numerous functions. I talked with the vendor and found out that these MFDs actually run Windows -- and a very old version at that. Suddenly, we've introduced a bunch of new Windows machines to our network. You might recall that I've expended significant effort this past year to get a handle on Windows patch management. These new devices change the equation.

I met with the project manager to learn more about what's going on and determine how to get some security controls and practices into the work plan. She wasn't very pleased to see me. "These are just printers," she told me. "Why do we need to worry about security?"

Now, there's a question that'll get you on my good side. In response, I switched to education mode. I explained how the "brain" of these devices is really a Windows computer, and therefore we would want to harden them according to our standards and find a way to update their underlying software every month, as well as lock them down. This was not a welcome revelation. "We don't have budget for that, nor do we have the time," she told me.

RESOURCE CENTER