1. Don Wright Director of Standards Lexmark International don@lexmark.com
P2600 Hardcopy Device and System Security April 2005 Working Group Meeting
Don Wright
Director of Standards
Lexmark International
5/2/2019

2. Agenda Items Tuesday/Wednesday, April 12-13 Welcome & Introductions
Update and Approve Agenda
Review and approve February Minutes
IEEE Patent Policy Review
Update on 2005 Meeting Plan and Schedule
Update on TCG
PP Registration
Review of Action Items from February Meeting
Other Topics
5/2/2019

3. Agenda Items Tuesday/Wednesday, April 12-13 (cont.)
Document Review: Section 1
Document Review: Section 2
Document Review: Section 3
Document Review: Section 4 - Ron Nevo/Brian Smithson
High Security PP
Enterprise PP
Status from Océ on other PPs
Status on merging section
Summarize and record action items
5/2/2019

4. Minutes from February Meeting
Minutes were published shortly after the meeting.
They are available at:
Any corrections or changes?
5/2/2019

5. Instructions for the WG Chair
At Each Meeting, the Working Group Chair shall:
Show slides #1 and #2 of this presentation
Advise the WG membership that:
The IEEE’s patent policy is consistent with the ANSI patent policy and is described in Clause 6 of the IEEE-SA Standards Board Bylaws;
Early disclosure of patents which may be essential for the use of standards under development is encouraged;
Disclosures made of such patents may not be exhaustive of all patents that may be essential for the use of standards under development, and that neither the IEEE, the WG, nor the WG Chairman ensure the accuracy or completeness of any disclosure or whether any disclosure is of a patent that, in fact, may be essential for the use of standards under development.
Instruct the WG Secretary to record in the minutes of the relevant WG meeting:
That the foregoing advice was provided and the two slides were shown;
That an opportunity was provided for WG members to identify or disclose patents that the WG member believes may be essential for the use of that standard;
Any responses that were given, specifically the patents and patent applications that were identified (if any) and by whom.
5/2/2019
(Not necessary to be shown)
Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

6. IEEE-SA Standards Board Bylaws on Patents in Standards
IEEE standards may include the known use of essential patents and patent applications provided the IEEE receives assurance from the patent holder or applicant with respect to patents whose infringement is, or in the case of patent applications, potential future infringement the applicant asserts will be, unavoidable in a compliant implementation of either mandatory or optional portions of the standard [essential patents]. This assurance shall be provided without coercion and prior to approval of the standard (or reaffirmation when a patent or patent application becomes known after initial approval of the standard). This assurance shall be a letter that is in the form of either:
a) A general disclaimer to the effect that the patentee will not enforce any of its present or future patent(s) whose use would be required to implement either mandatory or optional portions of the proposed IEEE standard against any person or entity complying with the standard; or
b) A statement that a license for such implementation will be made available without compensation or under reasonable rates, with reasonable terms and conditions that are demonstrably free of any unfair discrimination.
This assurance shall apply, at a minimum, from the date of the standard's approval to the date of the standard's withdrawal and is irrevocable during that period.
5/2/2019
Slide #1
Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

7. Inappropriate Topics for IEEE WG Meetings
Don’t discuss the validity/essentiality of patents/patent claims
Don’t discuss the cost of specific patent use
Don’t discuss licensing terms or conditions
Don’t discuss product pricing, territorial restrictions, or market share
Don’t discuss ongoing litigation or threatened litigation
Don’t be silent if inappropriate topics are discussed… do formally object. If you have questions, contact the IEEE-SA Standards Board Patent Committee Administrator at or visit This slide set is available at
5/2/2019
Slide #2
Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

8. Officers Chair: Don Wright, Lexmark Vice Chair: Lee Farrell, Canon
Secretary/Lead Editor: Brian Smithson, Ricoh
Editors:
Jerry Thrasher
Ron Bergman
Ron Nevo
5/2/2019

9. 2005 Meeting Schedule
May Toronto, Canada (sponsored by Equitrac)
July SFO/San Jose (Apple) with PWG
Sept New Ricoh
Oct New Orleans with PWG
Dec San Diego
5/2/2019

10. Trusted Computing Group
Update
Last TCG Meeting was March 29 – April 1, 2005 in San Diego
Ricoh is now a member of the TCG
The TCG Hardcopy group met and discussed “use cases”
5/2/2019

11. Protection Profiles Registration
Note from Takanori Masui of Fuji Xerox to mailing list on April 1, 2005 asking about PP registration/certification.
Should we:
Get CC certification (this requires cost and evaluation supports)
Not get certification but register our PP under ISO/IEC 15292:2001 (
Not get certification and not register but spread our PP only as guidelines
Note: David Freas has replaced Daniel Mory at DAPS and he believes it may be possible for him to get NIAP to certify the High Security and Enterprise profiles based on US Military/DOD needs.
5/2/2019

12. Action Items for and before April Meeting
Update web site with this meetings contents - done
Slides
Minutes
Etc.
Update web site with Tokyo meeting details - done
Update web site with preliminary May Toronto meeting details - open
Update web site with meeting date changes - done
All editing actions from FLL meeting and still open items from Camas. - continuing
5/2/2019

13. Action Items from Previous Meetings
Section 1 updates (Don W)
Drawings update as per Florida meeting – Complete
Turn document over to Brian S - Complete
Section 1 updates (Brian S.)
Actions tied to merger of sections: (All below are open)
Update Bibliography
Add terms from section 2 (Proficient, Bespoke, etc.)
Reference mitigation techniques in sect 3 rather than use the ones from the NIST document.
Define Assets (from section 3)
Add acronyms from section 2 & 4
Add explanatory text talking about choosing a target security environment based on asset value rather than just the name of the environment. E.g. A SoHo environment may have high value assets and should use enterprise PP instead.
Section 2 updates (Tom H)
Cross check section 2 with original vulnerabilities list – Partially Complete
Section 4 team to verify which security environment’s PP are applicable to each threat (Section 4 team plus Tom H) -- Tentative
Decide if we want to include the security environment columns in final std -- Open
5/2/2019

14. Action Items from Previous Meetings
Section 3
Complete missing sections – Largely complete
Move asset section to section 1 – Open
Continue to work on actual recommendations for each threat. Align this section with section 2 threats. – Aligned and largely complete
Section 4
Updates as per Florida walk through – complete
Start drafting other Protection Profiles – ¾ complete
HS draft – almost complete
Enterprise - draft available
Soho assigned to Jean Clause of Océ – 1st draft available
Public assigned to Jean Clause of Océ - open
5/2/2019

15. Other Issues From Ron Nevo:
I would recommend discussion on how to categorize better the environments :
Primarily based on security level of the assets as we have today
Enterprise should include also corporate examples with different Infrastructures (complex/centralized as enterprise or simple as small corporate ) that may have same security requirements.
5/2/2019

16. Section 1: Intro Material
Review Draft
Better corporate enterprise example to be added
Section consider decision chart for selecting environment
Add text indicating the drawings are examples/concept charts. Not all components will be present in all implementations.
Telephone line connections to MFP/HC devices for remote maintenance, etc. in enterprise environment as well as in high security environment.
5/2/2019

17. Section 2: Threats Review Draft Updates as per meeting
Threat – unlocked operator panel
None of the other highlighted brain storm threats need to be addressed.
5/2/2019

18. Section 3: Best Practices
Review Draft
Change to High/Medium/Low risk
Everyone to detailed review of revised section 3 for Toronto meeting. There will be a test!
5/2/2019

19. Section 4: Protection Profiles
High Security
Which threats to include? Should be an outcome of the risk assessment (hi/med/low). Who?
Discussion item on assumptions about the network environment.
Enterprise
Changes per markup
SoHo
Not reviewed
Public - TBD
5/2/2019

20. Other PPs and Merger of sections
What is schedule?
Public PP: Jean Claude
Document Merger Status
Brian: Shooting for midway between now and Toronto meeting.
5/2/2019

21. Managing the Process Going Forward
Going forward we must manage the discussion and changes to the document.
For the following components of the standard, we will have no “random” discussions. All proposed changes MUST be on the reflector at least one week before the meeting including specific changes requested.
Sections 1 through 3
High Security Profile
Additions sections will be added to this list as they mature.
5/2/2019

22. Project Schedule
The PAR included estimates of the end-points of the schedule:
Sponsor Ballot: June Sept 2005
Submission to RevCom: Feb 2006
5/2/2019

23. Next Meeting Details May 19 - 20 – Toronto Canada
Where: Holiday Inn on King King St. West Toronto, Ontario M5V 1J9 Canada Tel: , TTY: , Fax:
Rooms: $179 CDN per night, single/double occupancy
Cost: Approximately $35 US per person per day (CASH ONLY) (This covers morning continental and afternoon snack.)
Internet: Internet access will be available in the meeting room Internet access is available for a fee in the sleeping rooms
You must bring CASH to cover the $35 per person per day meeting fee. We will have no way to take checks or credit cards.
5/2/2019

24. April Meeting Action Items
Risk Assessment (H/M/L) by threat by environment – who?
How valuable is the asset?
How difficult is it to execute the threat?
Sharp, Ricoh, Oce after meeting
5/2/2019

25. Mailing List and Web Site
Listserv run by the IEEE
An archive is available on the web site
Subscribe via a note to: containing the line: subscribe stds-2600
Only subscribers may send to the mailing list.
5/2/2019