HP Commercial LaserJet Printers and MFPs - Imaging and Printing Security Best Practices
Chapter 2 HP LaserJet and Color LaserJet MFP Security Checklist 5
Chapter 2: Threat Model
This section explains the types of security risks involved with operating MFPs in enterprise
environments.
As technology improves, malicious people (hackers) continue to find new ways to exploit networks.
They are beginning to target MFPs and other network peripherals to misuse resources or to gain
access to networks or the internet. Predicting the actions of a hacker is difficult, but HP is dedicated
to research in this area. This checklist represents some of HP's efforts to ensure that you can use HP
MFPs with confidence; however, you should continue to be ware and always remain vigilant. Use
other techniques with this checklist to help ensure that your network is resistant to compromise.
NOTE:
This is not a comprehensive treatment of these issues. This chapter is
only an introduction to the types of threats known to affect network
MFPs.
The Microsoft STRIDE model provides a valuable outline to categorize these known types of threats:
Spoofing identity
Tampering with data
Repudiation
Information disclosure
Denial of service
Elevation of privilege
The following sections explain how each type of threat relates to MFPs:
Spoofing Identity
Spoofing identity is masquerading as someone else to fool others or to get unauthorized access.
Here are some ways spoofing identity can relate to MFPs:
Placing another person's email address in the From address field of an email message.
Example: Someone could place the address of a co-worker in the From address field and
send embarrassing or malicious messages to others as though the co-worker wrote them.
Using another person's email credentials to log in to the email server to gain access to
address books
Using another person's email credentials to have free use of an email service
Using another person's email credentials to view that person’s email messages
Using another person's log on credentials for access to use MFPs or networks
Using another person's log on credentials for administrative access to MFPs