Ensure management and print access is restricted to authorised networks

Trung bìnhCấp 2Xem xét thủ côngprinter

Mô tả

An IP access control list (or management VLAN) limits who can reach the EWS, SNMP and raw print ports, reducing exposure to network attacks and to accidental Internet exposure.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking > Access Control List / IP Filter (Xerox: Connectivity > IP Filtering; Ricoh: Access Control): only the print server(s), management stations and user subnets are allowed, management (EWS/SNMP) limited to the admin subnet; the device is not reachable from the Internet (no NAT/port-forward, verify in external attack-surface scans); direct-to-device printing is limited if a print server is used.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

EWS: configure the IP access control list / IP filter to allow only print servers and admin subnets for management; place printers in a dedicated VLAN with firewall rules; remove any Internet exposure.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: printernetworkaccess-control
Tham chiếu: CIS Multi-Function Device Benchmark v1.0.0 - Restrict network access to the device (verify section number for your release)