Although stolen laptops and computer-savvy hackers are frequently the focus of school security discussions, information retained when sensitive documents are photocopied poses another very real, although often overlooked, security threat for schools and colleges—and for the employees and students whose personal information could be at risk.
The hard drives in digital copiers record all images that are copied using the machine. While copier security risks have been known for a number of years, CBS News shined its spotlight on the danger with an April 19 news report. eSchool News first reported on the issue in 2007 (see “Latest data security risk for schools: Copiers“).
The CBS investigative team purchased three previously-owned copiers and accessed sensitive information on all three hard drives, including one that contained scanned records from a public high school.
The St. Petersburg Times reported that Florida’s Pinellas County libraries are set to review all library copy machines and hard drives in light of the CBS report.
John Juntunen told CBS News that the industry has been slow to react and identify a solution to the security risk. Juntunen’s company, Digital Copier Security, developed INFOSweep, software that erases hard drive data on digital copiers.
The majority of copier manufacturers offer a data security kit to accompany their machines, but the kit is not a standard part of the equipment—and many schools opt not to purchase it.
“Sharp has been offering [a data security kit] for 10 years, and in those 10 years, we still don’t have more than 15 percent of machines leave here with a data security kit,” said Mike Marusic, vice president of marketing and services for the Sharp Imaging and Information Company of America.
“At the end of the day, many people choose to save the money. If it’s included standard, the [copier] prices go too high,” he said.
Awareness is critical to prevention, especially in schools—where students’ Social Security numbers, sensitive financial information, and personal histories are printed on documents that are likely to be photocopied.
A recent LinkedIn.com survey hosted by Sharp revealed that of 817 business owners and corporate executives, nearly 65 percent said they were not aware or sure that their copiers contained hard drives with sensitive information.
“My advice to all schools would be to invest in a data security kit, because it is valuable,” Marusic said.
Schools whose slashed budgets might not permit an upgrade to a new copier with a data security kit, or even the purchase of a data security kit alone, do have a few other options to tighten security when it comes to vulnerable photocopy machines.
When schools end a copier lease, administrators should request the hard drives from the machines, or ask their school’s copier dealer to provide verification that the hard drives were cleared before leaving the building.
“In a lot of cases, schools buy under state contracts, so they buy off a pricing sheet,” Marusic said. “If data security was not bid [for] in the first place, there’s zero chance of them actually getting it, because it’s not an approved product for purchase.”
When searching for new copiers, schools should include a data security requirement on all future requests for proposals, he said.
MAC filtering, which uses a unique address assigned to each device’s network card, is another option open to schools.
IT administrators assign certain devices to each copier, preventing unauthorized access. IT staff also are alerted when an unauthorized user attempts to gain access to the copy machine.
A third method, known as authentication, limits access to the copier on a walk-up basis. Authorized users will type in a code or use a swipe card to gain access to the copier. Marusic said the feature is usually standard on most machines but is rarely activated.
“We can continue to alert people, especially in schools … [that] you want to protect your school … from providing that kind of access to your machine,” Marusic said.
Links:
Sharp Imaging and Information Company of America.
Note to readers:
Don’t forget to visit the Securing Your School from the Inside Out resource center. Today’s technology-rich schools face a growing number of threats to physical security as well as network security. Protecting student information and sensitive data and preserving students’ peace of mind in classrooms and on campus can be a daunting task. Go to:
Securing Your Campus from the Inside Out
- As workers seek guidance on AI use, employers value skilled graduates - December 9, 2024
- Community colleges meet demand for skills-based pathways - December 4, 2024
- Leveraging AI is helping institutions meet goals - November 29, 2024