I know they are becoming a depreciated technology, but lots of companies still have one or more fax machines, many...
of which have network connections to deliver messages to users. Some of them are multifunction IP devices with Bluetooth, wireless and Ethernet capabilities. These devices almost certainly represent an attack surface. Has anyone looked at the possibility of getting to a shell prompt with a specially crafted input through the dial-up connection? What are the best ways to secure these kinds of IP devices?
An enormous number of critical business processes use faxes or multifunction printers to communicate signatures or other critical communications. There have been many advances in digital signature laws and services, and this is an area where companies like DocuSign and Adobe are disrupting the market, along with introducing more secure solutions. As the submitter mentions, standalone fax machines are not a growing device market. More companies have been providing interfaces to send faxes, such as printers and email among other means, in order to create a transition from legacy systems to new systems.
IP devices connected to a network are computers and need to be secured. A fax machine with an IP address is very similar to an internet of things device that is connected to a network. Most attackers have focused on IP devices rather than on analog dial-up connections. For the IP devices, there have been some attacks that have allowed for remote code execution. Most attacks that could affect the dial-up connection aspect of a fax machine focus on SS7 hacks, but are unable to run code on endpoints via the analog connection.
To secure the IP devices, follow security guidance collected at HEISC Information Security Guide on copier and multifunction device security, as well as the NIST and device manufacturer guidance. The analog aspect has received less attention, but recommendations for interactive voice response systems could be used to detect attacks.
Learn how your enterprise can mitigate IVR security threats
Read how to prevent attacks on IoT devices
Find out how to secure the SS7 protocol from eavesdropping
Dig Deeper on Risk assessments, metrics and frameworks
Related Q&A from Nick Lewis
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading
Enterprises new to the cloud can write new security policies from scratch, but others with broad cloud usage may need an update. Consider these ... Continue Reading