Technical information

Network Security White Paper ver. G.1.2
Page 19 of 72
NOTE1: Please refer to the Appendix section entitle “SNMP settings” for details about SNMP settings.
NOTE2: We recommend using the maximum level of security possible. SNMP v3 should always be used
in cases where SNMP v1/v2 is not absolutely necessary. Utilities that do not support SNMP v3 will not
be able to get device status unless SNMP v1/v2 is enabled. Therefore, these utilities will not work
correctly if SNMP v1/v2 has been disabled. If your utility does not support SNMP v3 and only requires
‘get’ access to work (doesn’t make any changes to MFP settings), then we recommend security Level 2.
1-8 SNMP v3
1-8-1 Function Overview
SNMP v3 provides the same functions as SNMP v1/v2. SNMP v3 maintains higher security than SNMP
v1 and v2 because SNMP v3 has the following features:
User Authentication
Data Encryption
1-8-2 Potential Threats and Recommended Precautions
Destruction, Corruption and Modification of the File System
SNMP only permits write-access to network parameters. Access to the file system or kernel is not
allowed.
Theft of Username and Password
Interception of network packets: When using SNMP v3, the password is hashed using SHA1 or MD5.
Brute force password crack: The RICOH network device can detect a high frequency of failed logins. If
the number of login attempts exceeds a configured threshold, the device will send an e-mail to the
administrator. All failed logins will be logged.
Possibility of Unauthorized Parties Intercepting Device Information
Interception of network packets: The products do not respond with important information such as
administrator password even if the SNMP client sends a get request for this information. Therefore
security risk is low. In addition the products encrypt other parameters. (Please refer to the Appendix
section entitle “SNMP settings”).
Possibility of Successful DOS (Denial of Service) Attacks
The RICOH network device can detect a high frequency of logins and delay responses to the user’s
login requests. The device will also send an e-mail to the administrator. The device will create a log and
a message showing that the device is currently under attack will be displayed in Web Image Monitor.