Xerox VersaLink B7030 - For Optimized Performance of the Security Features

Xerox
®
VersaLink
®
B7025/B7030/B7035 Multifunction Printer
Security Function Supplementary Guide
9
For Optimized Performance of the Security
Features
The management organization needs to follow the instructions below:
 Assign appropriate personnel as machine and system administrators, provide training, and ensure proper
oversight.
 Train users about the machine operation and precautions according to the policies of their organization and the
product guidance.

The machine needs to be placed in a secure or monitored area where the machine is protected from
unmanaged physical access.
 If the machine is on the internal network that connects to external networks, configure the network properly to
block any unauthorized external access.
 Users and administrators need to set password and Pre-Shared Key according to the following rules for the client
PC and the machine’s setup.
- Do not use an easily guessable password.
-
A password needs to contain both numeric and alphabetic characters.
 Administrators need to set the account policies on the remote authentication server as follows.
- Set password policy to 9 or more characters.
-
Set account lockout policy to 5 times.
 Administrators need to remove the user accounts when users leave their organization.
 Users and administrators need to manage and operate the machine so that their user IDs and passwords
may not be disclosed to another person.
 The users need to set the Secure Print for Job Type on printer driver.
 For secure operation, all of the remote trusted IT products that communicate with the machine must implement
the communication protocol in accordance with industry standard practice with respect to RFC/other standard
compliance (TLS, IPSec, S/MIME) and must work as advertised.
1) TLS
For the TLS client (Web browser) and the TLS server that communicate with the machine, select a data
encryption suite from the following:
-
TLS_RSA_WITH_AES_128_CBC_SHA
-
TLS_RSA_WITH_AES_256_CBC_SHA
-
TLS_RSA_WITH_AES_128_CBC_SHA256
-
TLS_RSA_WITH_AES_256_CBC_SHA256
2) S/MIME
For the machine and E-mail clients, select an Encryption Method/Message Digest Algorithm from the following:
-
3Key Triple-DES/168bit, AES/128bit, AES/192bit, AES/256bit
-
SHA1, SHA256
3) IPSec
For the IPSec host that communicates with the machine, select an Encryption Method/Message Digest
Algorithm from the following:
-
AES (128bit)/SHA1/SHA256/SHA384/SHA512
-
3Key Triple-DES (168bit)/SHA1/SHA256/SHA384/SHA512