Document Imaging Blog

MFPs and Network/Data Security

I wanted to pass along a link to a great article on MFPs and security in Computer Technology Review, written by Sharp's Vince Jannelli.  It is a very succint and well-written summary of security concerns around  MFPs and I agree with nearly everything in it.

However, I want to address the following statment that Vince made in relation to platform virus security:

"A proprietary platform is idea, since it won't be susceptible to viruses designed to attack more popular oprating systems available on personal computers."

I don't dispute the statement. But, it is important to weigh the trade offs between a proprietary platform and an open platform. While the risk of viral attack is lower because it is unlikely hackers will develop malicious code aimed at proprietary MFP platforms, the costs of managing those proprietary platforms are significant -- particularly for those companies that have mixed fleets (brands) of MFPs.

This problem is becoming more apparant as MFPs increasingly fall into the realm of IT and become increasingly integrated into business and IT infrastuctures. Some costs of proprietary platforms include:

• IT Training and Staffing costs
• Limited options fo 3rd party integrations (ISVs resist developing on proprietary  platforms unless that platform has a significant majority of marketshare)
• Integration code isn't portable to other platforms (what happens if you switch brands, or acquire a brand through M&A, etc.)

Furthermore, there are open platform solutions on the market today for MFPs that are secure and meet the criteria that Vince laid out for solutions: data security, access control, audit trails, network security, fax security and platform virus security. To read more about how these and other security concerns are addressed in an open platform, check out the white paper, Addressing Document Imaging Security Issues.

 

 

SharePoint and Document Imaging: Five Considerations

If you have -- or are planning to deploy -- SharePoint in your organization and are looking for a way to add paper-based information to the system (and why wouldn’t you!), here are five considerations to take into account when choosing a document imaging solution.

Consideration #1 – Paper connectivity should not require major IT involvement.
In many organizations, SharePoint projects are departmentalized and are outside of the domain of IT. In fact, according to AIIM’s 2008 State of the ECM Industry, only 42% of SharePoint projects have a formal plan that involved IT. Therefore, your capture integration with SharePoint should be virtually “plug and play” and should not require any modifications to the SharePoint server.

Consideration #2 – Are SharePoint project teams outside your firewall?
Do any of your SharePoint applications include non-employees, suppliers, outside counsel, consultants, customers, etc.? Do these individuals need to be able to access paper-based content within SharePoint?

Consideration #3 – Are hosted SharePoint services in your future?
Will your document imaging solution support a hosted environment?  Also consider image size of scanned documents. What file types are needed and supported? How is image compression handled? And ensure that encrypted transmission is supported.

Consideration #4 – Is real-time integration with SharePoint supported?
Does the capture solution recognize changes on the SharePoint site, such as updated or deleted folders and libraries? Does the document imaging solution provide an immediate confirmation of a successful scanning job? Does it support authenticated access to prevent information from being stored to unauthorized locations?

Consideration #5 – Is the document imaging application flexible and does it support multiple workflows?
Especially when scanning unstructured content (which makes up a large portion of content stored in SharePoint), the imaging application should allow the office worker scanning a document to browse destinations for the document within SharePoint, just like they were using their Web browser at their desk.  The application should also allow for pre-configured “QuickScan” jobs too, for easy execution of repetitive workflows. In addition, all SharePoint content types should also be supported so that paper content can be properly turned into electronic files.

What other considerations have you come up with when considering document imaging solutions for SharePoint?

If you would like more information on how to use SharePoint to help manage document-centric processes and how to include paper-based information into SharePoint, join us next Wednesday for the AIIM Webinar on the topic. Register for this free event here.

Moving Down the Paperless Trail

"It's cheaper, it's easier, it gives you and your employees more flexibility, your savvier competitors are doing it, and since it requires flexibility it gives small businesses an advantage over large ones."

Wow...that's a pretty compelling argument. What's it about? It's Slate.com's BizBox's description of "going electronic" in an article summarizing an interview that fellow blogger and eCopy employee, Bill Brikiatis, did with Forbes.

The full article provides lots of good information for companies to consider when working to reduce the amount of paper in their work environment, but here's a few high-level takeaways that BizBox called out to backup their statement above:

1. Electronic is faster
2. The transition away from paper requires institutional flexibility, and that gives small businesses a leg up over big ones
3. At this point, being primarily paper-based is inefficient, because everyone's already partly electronic-based
4. Don't forget security

All good arguments for why to move towards a paperless environment. Are you working on a paperless initiative? Tell us how you are going about it and how you are justifying your initiatives!

Protecting Security at Your Document Hub

Document imaging makes it possible to integrate paper documents with existing workflow processes and business applications, e.g. e-mail, fax, and electronic document management systems. But before introducing paper into electronic-based processes, you want to be sure that document imaging is safe and document integration secure.

Whenever shared office scanners and MFPs connect to a computer network, security is a primary concern. To help companies understand some of the security concerns, Ed Schmid, eCopy’s CEO, put together the following tips on security at MFPs for Business Week’s Tip of the Day.

a. User Authentication. MFPs can be set to require network passwords, a basic level of access control that prevents non-employees from using the MFP and ensures asset control.

b. Permissions Authentication. Require users to enter passwords to gain access to specific business applications from the MFP, just as if they were entering from a PC.

c. Document Encryption. Applying document encryption at the MFP helps safeguard confidential information before it is transmitted across the network.

d. Delete Temporary Files. Most MFPs automatically keep a record of files that have recently been scanned. If these temporary files are left on the MFP, sensitive information can be accessed by unauthorized users. Set up your device to delete these files automatically.

e. Activity Tracking. MFPs can be set up to create audit trails that can identify who sent what document, where, and at what time.

For the full Business Week article, click here.  Or, for more in depth information, download the white paper “Addressing Document Security Issues”.

Guarding against insider security threats

Alan Joch wrote an interesting post on the Printing & Imaging Blog this week about insider security breaches and steps companies are taking to protect their information. He suggests that companies investigate print logs – paying attention to what is printed, who is printing that information and when (during or after business hours, for example).

This is a good practice, especially for companies that deal with compliance and audit concerns, and should also be considered for scanned documents. It reminds me of a story a colleague shared recently about a customer of ours in the Securities industry. Being in the business of securities and trading – and therefore under the watchful eye of the SEC -- the company had concerns over who was sending what information, and where it was being sent. They wanted to allow employees to scan and e-mail documents from the MFP and therefore need to choose a document imaging solution that could meet those security requirements. This company recognized two core document tracking needs to address when it came to choosing their document imaging solution:

1) They needed to be able to track & log information such as the sender, time, date, # of pages and recipient for any document scanned and sent from the MFP
2) They needed to be able to log and store the actual content of the scanned document

Some document imaging solutions are able to address #1, and some can also address #2. However, this company also wanted the ability to encrypt scanned documents, a very common document imaging requirement. By adding encryption to the mix, the ability to log and store the actual content of scanned documents is a much more difficult task. But it is an important need to address. Think about it. An employee may very well think that they can go up to an MFP, scan a document, encrypt that document and send it via e-mail. Because it has been encrypted, they believe that no one could see what the contents were.

To my knowledge, eCopy ShareScan is the only imaging solution that can handle this requirement. Our document tracking feature, which is accessed through the administrative console, can be set to both log document scanning activity and send a copy of the scanned document to a storage location that has access dictated by network security policies. If the document has been encrypted during scanning, the copy sent to the storage location is stored unencrypted. The beauty of this is that is doesn’t restrict functionality such as encryption that is used for “good”, it just lets you track abuse.

So if there is a need for “Big Brother” in an organization, you should make sure that both the ability to log print and scan jobs is included. And make sure that there are no loopholes, such as encrypted documents, that can poke holes in these security measures.

Capture for Content Management Systems - EMC Announces Captiva eInput 2.0

EMC last week announced Captiva eInput 2.0, a Web-based distributed document capture solution designed to make the scanning and indexing of paper documents from remote offices faster and easier. This is the second announcement within a week from a large ECM system vendor that is focused on capture – further emphasizing the growing focus on document imaging within the ECM space.

Captiva eInput is an extension to the Captive InputAccel platform and basically allows employees in remote locations that do not have access to a centralized scanning location for scanning paper into InputAccel to scan a document to a Web interface, where it can then be indexed and routed to the InputAccel server for processing. It is a great application for a single worker using a desktop scanner attached to a personal computer.

However, what both of these recent announcements have not addressed is how to use shared scanning devices for distributed capture. Shared networked scanners and MFPs populate almost every office location with more than one or two employees. And having already made the investment in these devices, it does not always make financial or operational sense to also provide single-user scanning devices for capturing documents. Using an MFP or networked scanner to scan and distribute documents is easy and, by using a document imaging platform, can provide multiple distribution options for those documents vs. being tied to a single destination.

When considering how to use a shared scanning device, you should consider the following:

• Authentication at the scanning device is essential to ensure only authorized users have access to the network and applications
• Authentication should provide an audit trail of what was sent by whom
• Authentication should match existing corporate security policies
• Companies should look for features such as session logon; authenticated Scan and Mail; and activity logging

Workers today are found in many differing office environments and a distributed document capture solution should be implemented to address the needs of all of these environments. The capture suites that many ECM companies are putting together help address some of the environments and can easily be supplemented by third-party capture solutions to deliver a complete solution.

Document Imaging & Security

Document imaging makes it possible to integrate paper documents with existing electronic processes. But how do you ensure that the document imaging process is safe and the integration into the electronic processes is secure and meets information policy requirements and regulations such as Sarbanes Oxley?

Since paper documents frequently contain information that is confidential or sensitive in nature, the security of those documents must be assured, perhaps even more so that their paper originals.

To achieve this security in document imaging, three key areas must be addressed: users, documents, and devices.

Users: When using a shared device in a public area to scan documents, authentication is essential to ensure that only authorized users have access to the network. Authentication can also provide an audit trail of what was send and by whom. Authentication at a scanning device should match existing corporate security policies and users should look for features such as session logon; authenticated Scan and Mail and Scan and Fax that dynamically integrates with the corporate e-mail and fax applications; and activity logging. 

Documents: With document imaging solutions, encryption, secure deletion of temporary files and inbox security can help keep scanned documents visible only to those with proper authorization.

Devices: Security should be in place that limits the activities that can be performed at a shared scanning device. At a minimum, the document imaging system should provide the same level of network security as any desktop system on your network, including: restricted network access; auto logon and application startup; application lockdown; physical security of PCs; and eliminating any removable drives.

Stringent user, document and device security standards enable companies to extend their electronic security protection to paper documents, opening up the wealth of productivity benefits that can be achieved through document imaging.  Download the white paper Addressing Document Imaging Security Issues for more information.