Xerox VersaLink B405 Security Target And Compliance Document (March 2018).pdf

It outlines the security features, functionalities, and safeguards designed to protect sensitive data within the device and its operational environment.

Key Features & Focus:

Data Encryption: The MFP employs flash memory data encryption (TSFCIPHER) for secure storage of user data.
User Authentication: Robust authentication mechanisms (TSFUSERAUTH), including store print and faxbox access, ensure only authorized users can access sensitive functions.
Security Management: System administrators gain centralized control over security settings through TSFFMT, enabling policy enforcement and audit logging.
Network Protection: Measures like TSFNETPROT safeguard data during transmission within internal networks.
Comprehensive Audit Logging: TSF_FAU logs security-related events for auditing and incident response.

Target Environment:

The security target assumes a general operational environment as depicted in Figure 1, encompassing:

Network Connectivity: The MFP connects to internal networks and potentially external resources.
User Access: Various user roles (e.g., employees, guests) interact with the MFP through different functionalities.
Data Flow: Data flows between the MFP, network devices, and end-user systems.

Scope & Boundaries:

The TOE (Trusted Operating Environment) logically encompasses:

Hardware: The physical hardware of the Xerox VersaLink B405 MFP itself.
Software: Firmware, drivers, and applications directly controlling the MFP's functionality.

Physically, the scope includes:

MFP Units: Individual devices within the deployed fleet.
Network Infrastructure: Internal networks and connected devices interacting with the MFPs.

Security Objectives:

The primary security objectives are to:

Protect Data Confidentiality: Ensure sensitive data stored or transmitted by the MFP remains confidential.
Maintain Data Integrity: Safeguard against unauthorized modification of data processed by the MFP.
Ensure Data Availability: Provide reliable access to authorized users while preventing unauthorized access.
Prevent Unauthorized Access: Restrict access to MFP functionalities and sensitive data only to authenticated users.
Detect and Respond to Security Incidents: Implement mechanisms for identifying and mitigating security breaches.

Threats & Assumptions:

The target document identifies potential threats, including:

Unauthorized Access: Malicious actors attempting to gain unauthorized access to MFP functionalities or data.
Data Loss/Corruption: Intentional or accidental data destruction or corruption.
Malware Infections: Introduction of malicious software through network connections or removable media.

Assumptions include:

Reliable power supply and physical security for the MFPs within the defined environment.
Robust network security measures protecting internal networks from external threats.
* Effective user authentication and access control mechanisms in place outside the MFP.