Security White Paper Spire CXP6000 and CXP5000 Ver. 4.0

Transcription

1 Spire CXP6000 and CXP5000 Ver. 4.0 June 24, Creo Inc. The products mentioned in this document are trademarks or service marks of Creo Inc. and may be registered in certain jurisdictions. Other company and brand, product and service names are for identification purposes only and may be trademarks or registered trademarks of their respective holders. Data subject to change without notice.

2 Table of Contents 1 Overview 3 2 Feature Summary 4 3 Basic Workflow PDL files RTP files 7 4 Network Network Environments Network Protocols Network Types Remote Access Network Ports 8 5 Software Description 9 6 Device Description CPU Memory Storage devices Network Cards Physical Ports Additional HW 10 7 Identification and Authorization Users and User Rights Potential Threats 11 8 Access Control Local DFE access Remote Access 12 9 Data Security User Data (job data) Data Exchange Virus Check System Integrity Protection Accountability (audit trails)

3 1 Overview The purpose of this document is to describe the various access and security attributes of the Spire product line, specifically for the CXP6000 and CXP version 4.0 and the potential threats to these attributes. Security relates to a collection of methods for access and integrity protection that a system provides in order to manage which users can access the system, and what features or data they can view or change. Security threats are issues that relate to hampering the integrity of the system, hampering the integrity of job data, compromising secured feature access, or allowing unauthorized data access. The Spire DFE relies mostly on the security of the Windows operating system to provide these capabilities. When describing security one has to address the following issues: Identification and authorization Access control (local and remote) Data Security System integrity Accountability (auditing) This document is divided into two major parts: Part 1: A description of the product, network environment, software and hardware components. (Sections 2-6) Part 2: A description of the capabilities according to the above categories. (Sections 7-12) The Spire is a product line of color servers (DFE s) based on client/server architecture, printing to a variety of digital printers/copiers (output devices). The DFE receives input as a PDL file and according to a job ticket (which is a set of parameters programmed by the client) produces an RTP (ready-to-print format) equivalent. The RTP format is then printed on the output device. The DFE controls the printer during the print process. The DFE server concurrently handles multiple clients and multiple processes. The DFE is usually connected to the local area network (LAN), either in a Windows (Workgroup or Domain), Novell, or Macintosh network environment

4 2 Feature Summary Spire is the production color server that provides Advanced-printing technology for color digital printers. Productivity Automated customizable workflow Gallop - Rip while print technology High performance RIP, based on Adobe CPSI RIP Many Post RIP changes do not require re-processing Last minute color corrections Independent printer calibration PDF2Go Export Ready-To-Print (RTP) files to PDF Job Batching Post RIP imposition - 4 -

5 Image Quality Patented Scitex Trapping Anti-aliasing algorithms Smooth scale (improves low quality images) Black and Postscript overprint Gray component removal (GCR) Full ICC profile support Spot color dictionary and editor Professional color calibration Creo high quality color emulations. Workflow Professional imposition engine by Ultimate Technologies. Dynamic imposition structure view provided Automatic Picture Replacement (APR) Enhanced Job Viewer and Editor Accept a variety of input format including GA formats (Brisque jobs, CT/LW, TIFF-IT, TIFF) Page Exceptions Remote Tools Variable Information The most comprehensive VI solution in the market. Element based RIP, RIP once use many. The HW builds pages during print time. Support for all industry VI file formats: VPS, Xerox VIPP and PPML Cache elements across print runs, and different jobs. Viewing of single elements. VI preview, both pre-rip and post RIP. Only solution for on-the-fly imposition VI. Connectivity Support for most corporate network environments (Windows, Novell, Macintosh) TCP/IP, IPX/SPX, Netbios and AppleTalk protocols Support for both Ethernet and token ring networks Support for LPR/LPD printing from Unix SNMP services Web Services RemoteAdmin Service - 5 -

6 3 Basic Workflow 3.1 PDL files PDL (Page Description Language) files are the first step in the workflow. They serve as the input to the DFE. There are many file formats that the DFE can accept: Postscript (Versions 1,2,3), EPS, PDF, TIFF, TIFF-IT, VPS, VIPP, PPML, Brisque Job, CT/LW and DCS Job Submission There are several ways in which the user can submit a PDL file to the DFE: a. Printing from an application (spooling), either from an application running on a remote machine, or from a local application. b. Using the import mechanism, pointing to a file in a visible network/local path. (The file can reside also on a floppy/cd/mo peripheral) c. Using a 3 rd party downloader. d. Retrieve a previously archived job. The job is spooled or imported to the DFE server, and awaits the next step according to the job ticket. The PDL is stored on the user disk Process a. The job is translated from PDL format into the compressed Creo Ready-to-Print (RTP) format using a set of predefined parameters (the Job Ticket). b. RTP files reside on print-ready image disks. c. The PDL is kept with the RTP format, but resides on the user disk. d. The RTP job can be archived as windows cabinet format Print a. The images are ready and reside on the image disks b. During print, the images are decompressed and pages are assembled on-the-fly using Creo page assembly boards. c. The unscreened image data stream, and a print control stream are both sent to the printer

7 3.1.4 Reprint The job RTP files are stored unless deleted by the user, or deleted by the job preference. The job can be printed again without any reprocessing. Job ticket parameters can be edited, which might require the DFE to re-process the job. RTP elements will be re-created to suite the new job ticket if re-processing is required. 3.2 RTP files Creo Ready-to-print format can be retrieved from an archive, and then printed, or reprocessed and printed. The location of the archived file can be any valid file path, local or remote

8 4 Network 4.1 Network Environments The DFE supports the following network environments: Windows Network (Workgroup or Domain) Novell Network AppleTalk network 4.2 Network Protocols The DFE supports the following network protocols: TCP/IP IPX/SPX NetBEUI AppleTalk 4.3 Network Types Ethernet 4.4 Remote Access Remote access to the DFE can be done using a windows network client, a Novell client, a RAS client, an SNMP client, a Web Browser, the Remote Admin client or an FTP client. More information on remote access is in section Network Ports Well known ports Port Application Service Protocol Description 21 FTP services FTP TCP File Transfer Protocol 80 Web services HTTP TCP Connection to the Spire WebCenter/WebViewer 135 RPC epmap TCP/UDP DCE endpoint resolution 137 System Netbios-ns TCP/UDP NETBIOS Name Service 138 System Netbios-dgm TCP/UDP NETBIOS Datagram Service 139 System Netbios-ssn TCP/UDP NETBIOS Session Service 161 SNMP SNMP UDP SNMP protocol 427 System svrloc TCP/UDP Server Location 515 tcpsvcs Printer TCP/UDP Spooler 5900 RemoteAdmin RemoteAdmin TCP Remote administration of the DFE Other ports Ports are ports that are not well defined or known. In general, some of these ports are used by the operating system for spooling purposes and are dynamic. The windows spooling process creates sockets using these ports, and they change according to the print activity of the DFE

9 5 Software Description The Spire product line is based on the Microsoft Windows 2000 (Service Pack 3) operating system Professional version. Spire added-value software consists mainly of CREO developed software modules and a number of 3 rd party drivers and utilities Services supported by the Spire Platform: FTP Server Web Server SNMP service - RAS Remote Access Service Macintosh print/file Access (3 rd party service ExtremeZ ) LPR/LPD Printing (Unix) Windows file sharing Remote Administration 3 rd Party applications running on the server: Ultimate techno-graphics Imposition Module Adobe CPSI Java Virtual Machine Novell Network Client (optional) Adobe Acrobat Various device drivers (network board drivers, and so forth) Proxy Server (pending on product configuration) 3 rd party anti-virus application (pending on product configuration and self purchase of anti-virus application) The Spire platform DOES NOT include the following: Rlogin / Telnet /POP3 SMTP IMAP4 (143) - 9 -

10 6 Device Description The DFE is based on a 3 rd party computer platform using standard 3 rd party components and Creo proprietary interface boards and covers. 6.1 CPU Dual Intel Xeon 2.8 GHz with 533 MHz FSB for the CXP6000 Single CPU Intel Xeon 2.8 GHz with 533 MHz FSB for the CXP Memory a. SYSTEM MEMORY: 512 MB residing on motherboard for CXP6000 and CXP5000 b. PRINTING MEMORY: 384 MB residing on each I/F board for CXP6000 and CXP Storage devices a. System disk & user disk (partition of a single physical disk) a. 36 GB for CXP6000 b. 36 GB for CXP5000 b. Image disks a. 2 x 36 GB SCSI for CXP6000 b. 2 x 80 GB SATA for CXP5000 c. CD/DVD ROM CD = 48x DVD = 16x for CXP6000 and CXP5000 d. 3.5 Floppy drive (1.44MB) for CXP6000 e. An optional SCSI storage device can be connected for CXP6000 and CXP Network Cards a. 10/100/1000 Ethernet Network Interface Board 6.5 Physical Ports Port Usage Parallel port For future hardware keys 2 x serial ports Densitometer and modems 2 x USB ports Will be supported in future, for any USB peripheral (disk, mouse) 2 x PS2 Keyboard / Mouse 6.6 Additional HW X-Rite densitometer (DTP34) for CXP6000 and CXP

11 7 Identification and Authorization The DFE uses the windows identification procedure for remote job submitters, connecting a windows security recognized user with a specific job. Access to the DFE does not apply any identification procedure, and there is no user differentiation. 7.1 Users and User Rights Currently there is only one type of user role on the DFE itself, and that is the DFE administrator. An administrator has access to 100% of DFE functionality along with the user rights of an NT administrator. There is no change to any users or groups in the local security database. Other users belonging to different NT user groups cannot operate the DFE. 7.2 Potential Threats When using the DFE locally, if the DFE is unattended, unauthorized personnel can use the DFE without any security mechanism blocking them. Both feature access and data security can be compromised. The DFE is not pre-configured with an auto lock mechanism What can you do? Customers should not openly give out the username and password for the DFE, and should either secure the physical location of an unattended server, or lock the system when leaving the DFE unattended. Also physical locks for the CD-ROM and floppy are available on the open market. Customers can also purchase a smart card system, which enables access only to specific personnel using personalized physical media. 8 Access Control 8.1 Windows 2000 access control a. The DFE requires an administrator login to the windows operating system in order to operate the system. b. The administrator user referred to is the default local administrator defined by Windows 2000, which is member of the local administrators group. c. All DFE functionality is available to this user. d. Access to operating system functions is as defined by the built in user group Administrators Potential Threats Usage of local peripherals can be used to load software that can compromise the security and integrity of the DFE. This can be done without the knowledge of the user. For example, an auto run CD can launch a virus-infected application, or running any executable that is infected with a smart virus can cause damage to the integrity of the DFE system, or the any existing job. For unauthorized feature or data access see section What can you do? Customers should run virus scans on all media for devices attached to the DFE (floppy, CD ROM, MO). It is recommended to disable the guest account for local access

12 8.2 Spire Color Server access control This Spire Color server distinguish between three possible access levels on the Spire CXP6000 and CXP5000 color servers: Administrator User that has the highest access level and privileges to all Spire color server options Operator User that can fully operate the Spire application, but can t edit any of the Administration items in the Settings window Guest Temporary user that can only submit a job using an existing virtual printer. By default, the Spire color server is set to Auto Log On. This option enables to operate the Spire color server as an administrator. 8.3 Remote Access Windows Sharing Shared Volumes Remote users are required to be login when a remote sharing session is requested; there are two folders that are open to sharing by default: a. Utilities folder (client download of system utility applications) b. Shared Volume (mainly used for client upload of high-resolution files) Both of these volumes are accessible from windows and Macintosh clients. The permissions are Read/Write/Change to everyone. The DFE administrator can create higher levels of security for these volumes without hampering DFE operation Potential Threats Many viruses enter a system using a guest account into shared volumes What can you do? Change the security permissions of the shared volumes to something other then the default guest account. Change the security permission of the utilities folder to read only. Disable the guest account entirely. Remove the everyone account from shared folder permissions. Note that when re-installing the windows operating system, these operations will need to be repeated RAS Remote Access Server Used mainly for diagnostic purposes. The customer has to purchase a modem separately, connect a phone line, and give this phone number to the support team. This connection can be encrypted and authenticated as provided by Windows The RAS service is running by default but can be stopped by the administrator without hampering normal DFE operation Potential Threats Remote access service can be a problem since it opens the DFE to users outside of the company LAN What can you do? Define which specific users can dial in, and verify that a password is required to login. Connect the modem only before usage, and disconnect immediately afterwards. Do not give out the phone number for the modem

13 Verify that the service requires Microsoft authentication and enable the Require data encryption checkbox in the RAS properties page SNMP The DFE provides the windows SNMP service, without adding additional information or control regarding DFE status or features. The SNMP service disabled and not required for normal DFE features Potential Threats Intruder access through the SNMP port should you enable this service What can you do? Don t enable this Win2000 service Web Services The web server is running by default, and allows viewing the DFE s queues, storage folder, and alerts. The DFE administrator can stop the web services without hampering the DFE operation. Remote client and/or Web client access to the DFE features will be disabled if this service is disabled Remote Administration The DFE supports a special client for remote administration (RemoteAdmin), for remote control of the DFE for administrative purposes. This connection is single user and password protected. The DFE administrator can disable or enable this service FTP The File Transfer Protocol server is running by default. Anonymous users allowed. The DFE administrator can stop the FTP service without hampering the DFE operation Job Submission TCP/IP Printing (LPR/LPD) Netbios Printing PAP/AppleTalk printing Potential Threats In general, any additional network service as listed above adds another remote access point to the DFE that in potential can allow an intruder to either damage the integrity of the system, or extract classified data. The DFE is not installed with any intruder detection system, or a firewall What can you do? Customers should shutdown any unnecessary network services (RAS, SNMP, FTP, HTTP) or protocols (NetBEUI, AppleTalk, IPX\SPX), and then start these services or protocols only when needed. 9 Data Security Data security refers to methods of protection various client data on the wire or on the computer system itself. There are several facets of data security, some relate to how to verify which users have access only to their own data, other facets relate to protecting client data overall

14 9.1 User Data (job data) User data is protected as any other data on the DFE, by limiting local and remote access to the DFE. The owner of job data is the administrator. There is no discrimination between specific clients. Any user who approaches the DFE can view all current jobs Ready to print data Every job that has been successfully processed has RTP data associated with it. This data is saved on fast image disks that are defined as a windows stripe set. The file system format for the image disks is a proprietary Creo file system format. This file format is not accessible to the general public Format of drives CREO supplies a special Utility called: Format Image Drives that will erase the database tables and the proprietary RTP files stored on the stripe disk array. During normal production work, it is necessary to run this utility to clean these non-system disks. This routine only affects the proprietary DISKS ONLY. If a new Postscript file is ripped and new data is written to this cleaned partition this will create a NEW proprietary data base table that will make it impossible to recreate the previous database to restore the old proprietary file system data Potential Threats As described previously, the local DFE access is open to everyone if unattended. Unauthorized personnel can view/extract-classified jobs if no operator is attending the DFE What can you do? The operator of the DFE should lock the system when leaving the unit unattended Wiping Deleted files The Spire is supplied with a disk wipe tool, Normally, when a file is deleted, the file s dictionary entry is removed but data still remains on the disk. The Disk Wipe utility enables to clear previously deleted files. Disk Wipe eliminates the contents of all deleted files by scanning all of the empty sectors on the disk and replacing them with zeros. Nonempty sectors are left untouched. The Disk Wipe utility affects the user disk and printer disks. 9.2 Data Exchange Data exchange refers to the exchange of data between secured computers. The DFE is not configured with any special tools to encrypt data on the wire. Windows 2000 has such capabilities, which are not enabled by default Potential Threats Job data being transferred on the wire is not encrypted. Unauthorized personnel with certain tools or snoopers can collect live data being sent to the DFE What can you do? Define data encryption (IPSEC) on both ends of the transfer segment if possible. This may not be possible in all network configurations and client operating system types. 9.3 Virus Check Pending on product configuration and purchase of a 3 rd party anti-virus application, the DFE can run virus checks on incoming files. Creo does recommend McAfee VirusScan software and can provide a Win2000 installation and configuration for this application. Always be current with your virus definitions supplied by the virus product you choose

15 9.3.1 Potential Threats Viruses can affect system integrity and data integrity, and can penetrate the system either from an attached device such as a floppy, MO, or CD-ROM. Viruses can hamper the integrity of the system as well as data integrity What can you do? Install an Anti-Virus application on the Spire DFE. The most secure type of anti-virus application is the on-access type. The DFE will be validated while running a virus-scan application from a leading vendor of such applications. Customers will need to purchase this software separately from the anti-virus vendor, install and configure as defined in a technical document from the Spire Team

16 10 System Integrity Protection System integrity protection refers to protecting the system from malicious attacks, or unintentional breaks by the systems users. Resources Description Owner Protected Application files Exe, DLL, and other files which make up Administrator No by default the DFE application Client data files PDL, RTP, and other files which make up the client job Administrator No by default, this should not be changed Registry entries Administrator No by default Pipes, processes Administrator No by default Printers Administrator can print, manage the printer, and manage documents Administrator No by default 11 Accountability (audit trails) Windows 2000 provides security-auditing capabilities; the DFE factory settings do not audit by default. Specific DFE events are not recorded in the system audit log