A MFD device does not have a mechanism to lock and prevent access to the hard drive.
An XCCDF Rule
Description
If the hard disk drive of a MFD can be removed from the MFD the data on the drive can be recovered and read. This can lead to a compromise of sensitive data. The IAO will ensure the device has a mechanism to lock and prevent access to the hard disk.
| Property | Value |
|---|---|
| Responsibility | Information Assurance Officer |
| IA Controls | PECF-1, PECF-2 |
- ID
- SV-7030r1_rule
- Version
- MFD08.001
- Severity
- Medium
- Updated
Remediation Templates
A Manual Procedure
If the lock is not locked, lock it.
If there is no lock see if the vendor makes one and if so acquire it an lock the drive.
If the vendor does not supply a lock, acquire an aftermarket lock that will secure the drive so that it cannot be accessed. Even a drive that cannot be removed but the connectors can be removed is vulnerable.