Ensure management and print access is restricted to authorised networks

中等級 2人工審核printer

說明

An IP access control list (or management VLAN) limits who can reach the EWS, SNMP and raw print ports, reducing exposure to network attacks and to accidental Internet exposure.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking > Access Control List / IP Filter (Xerox: Connectivity > IP Filtering; Ricoh: Access Control): only the print server(s), management stations and user subnets are allowed, management (EWS/SNMP) limited to the admin subnet; the device is not reachable from the Internet (no NAT/port-forward, verify in external attack-surface scans); direct-to-device printing is limited if a print server is used.

修補方式

修補方法: 操作指南或基礎設施修補檔

EWS: configure the IP access control list / IP filter to allow only print servers and admin subnets for management; place printers in a dedicated VLAN with firewall rules; remove any Internet exposure.

屬性

作業系統: 不限
標籤: printernetworkaccess-control
參考資料: CIS Multi-Function Device Benchmark v1.0.0 - Restrict network access to the device (verify section number for your release)