MFDs must not allow scan to SMTP (email).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6804	MFD07.005	SV-7029r2_rule		Medium

Description
The SMTP engines found on the MFDs reviewed when writing the MFD STIG did not have robust enough security features supporting scan to email. Because of the lack of robust security, scan to email will be disabled on MFD devices. Failure to disable this feature could lead to an untraceable and possibly undetectable compromise of sensitive data. The SA will ensure MFDs do not allow scan to SMTP.

STIG	Date
Multifunction Device and Network Printers STIG	2017-12-07

Details

Check Text ( C-3019r2_chk )
The reviewer will, with the assistance from the SA, verify devices do not allow scan to SMTP. If scan to SMTP is enabled on the MFD, this is a finding. Note: With AO approval, strict usage policies, and user training, MFD scan to SMTP (email) is allowed if CAC/PKI authentication is implemented on the MFD. There must be a method implemented for non-repudiation and authenticated access. A USB/flash drive/thumb drive or any removable storage capability will not be installed.

Check Text ( C-3019r2_chk )

The reviewer will, with the assistance from the SA, verify devices do not allow scan to SMTP. If scan to SMTP is enabled on the MFD, this is a finding.

Note: With AO approval, strict usage policies, and user training, MFD scan to SMTP (email) is allowed if CAC/PKI authentication is implemented on the MFD. There must be a method implemented for non-repudiation and authenticated access. A USB/flash drive/thumb drive or any removable storage capability will not be installed.

Fix Text (F-6478r1_fix)
Disable the scan to SMTP (email) feature on all MFDs.