Xerox AltaLink C8045 User Manual

Xerox® Security Guide for Office Class Products: AltaLink®  VersaLink®
November 2018 Page 22
Fail Secure Vs Fail Safe
AltaLink® and VersaLink® products are designed to fail secure.
When a security control is compromised, the control is no longer trustworthy, and a system is at risk of
further compromise. In such a scenario, security products may either fail safe [open] or fail secure
[closed].
An example from physical security is a door. If power is lost the door may either:
 Unlock and ‘fail safe’ to an open state (likely for safety reasons such as in a public building).
 Lock and ‘fail secure’ for security reasons (such as a bank vault).
Pre-Boot Security
BIOS
The BIOS used in AltaLink® and VersaLink® products is embedded and cannot be accessed directly.
Unlike devices such as Desktop and Laptop computers that have a BIOS that can be accessed via a
keystroke on startup, the BIOS of AltaLink® and VersaLink® products is not accessible.
Many devices can be cleared to factory defaults (including passwords and security settings) by
depressing a reset button using a paperclip or similar method. For security reasons, AltaLink® and
VersaLink® products do not offer such a method to clear or reset the BIOS. (Note that configuration
settings may be reset to factory defaults by an authorized administrator, however this does not impact
BIOS settings).
BIOS updates are applied by device firmware updates. Firmware is protected from tampering by use of
digital signatures (discussed later in this section).
The BIOS is designed to fail secure. An integrity check is performed immediately when power is applied.
If verification is successful, the system proceeds with OS kernel boot. If the integrity check fails, the
system will fail secure.
Embedded Encryption
AES encryption is used to protect the system, user data, and configuration (including security settings)
from being retrieved or modified. Each device uses its own unique key that is securely generated.
Encryption is enabled by default. Media encryption and sanitization are discussed in Section 3 User Data
Protection.
Boot Process Security
Firmware Integrity
Unlike open operating systems such as servers and user workstations in which software may be installed
by users, Xerox products are based on embedded systems and the contents are managed by Xerox. The
only means of modifying the contents of a device is by applying a firmware update package.
Firmware updates use a special format and each firmware update is digitally signed to protect the
integrity of the contents. Firmware that is corrupt or has been illicitly modified will be rejected. This
security control cannot be disabled.
AltaLink® and VersaLink® products include a built-in firmware software validation. This is a file integrity
monitor that compares the security hashes of currently installed firmware to a secured whitelist that was
installed when the signed firmware was installed.

Xerox AltaLink C8045 Specifications

General

Print Resolution	Up to 1200 x 2400 dpi
Monthly Duty Cycle	Up to 200, 000 pages
Standard Paper Capacity	1, 140 sheets
Duplex Printing	Automatic
Functions	Print, Copy, Scan, Fax
Memory	4 GB
DADF Capacity	130 sheets
Scan Resolution	Up to 600 x 600 dpi
Fax	Optional
Type	Color Multifunction Printer
Maximum Scan Size	11.7 x 17 inches
Fax Modem Speed	33.6 Kbps
Operating System Compatibility	Windows, macOS, Linux
Print Speed	Up to 45 ppm
Connectivity	Ethernet, USB
Supported Paper Sizes	A3, A4, A5, B4, B5
Hard Drive	320 GB
Document Handler	DADF
Paper Weight	60 to 256 gsm
Output Destinations	Email, Network, USB
Copy Speed	Up to 45 ppm color / Up to 45 ppm black-and-white
Network Connectivity	Ethernet 10/100/1000 Base-T