> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/integrations/third-party-readers/idemia-morpho/configure/idemia-readers-morpho-how-to-enable-the-on-demand-security-state.md). # Enable On-Demand Security Enable and manage IDEMIA On-Demand Security with MBTB for secure reader communication. New readers (serial greater than **2242xxxxxxxxxx**) ship locked. Unsecure IP comms, the webserver, and USB scripts are all disabled out of the box. This Security by Default feature applies from: * SIGMA Lite and Lite+, firmware **4.12**. * SIGMA Wide, firmware **4.12**. * SIGMA Extreme, firmware **4.12**. * MorphoWave Compact/XP, firmware **2.9**. * MorphoWave SP, firmware **1.1**. * VisionPass, firmware **2.9**. You enable the readers by removing the terminal's security lock, as below. This also applies when **upgrading firmware** to the latest version. IDEMIA references (IDEMIA portal): [FAQ - Enforced Security firmware](https://biometricdevices.idemia.com/s/knowledge-base-search-results?term=%22FAQ%20-%20Enforced%20Security%20firmware%22), [Enforced Security – New Default Configuration](https://biometricdevices.idemia.com/s/global-search/0696700000UGoJKAA1?sharing=true) (tech bulletin), and [How to unlock the On-demand Security state](https://biometricdevices.idemia.com/s/knowledge-base-search-results?term=%22How%20to%20unlock%20the%20On-demand%20Security%20state%22). ### Firmware upgrade with enforced security If the reader was previously encrypted in Command Centre, it has those certificates stored, so it will not connect with the factory TLS configuration. In MBTB, use **Device Settings → Reset** and select 'TLS components' and 'Passphrases' **before** the upgrade. After the upgrade, connect with TLS Configuration Factory, then follow the procedure below to disable enforced security. Alternatively, upgrade first. The reader reboots with TLS certificates enabled, so you then re-enable encryption in Command Centre to reconnect and communicate with it. ### Enable On-Demand Security (MBTB 4.6.12+) Use **MBTB 4.6.12 or above**. Install it and open MBTB on your desktop. 1. Enter the reader IP and choose **TLS Configuration Factory**, then Connect. When the device is in the Enforced Security state, it shows "Enforced security enabled". 2. Go to Tools. Only one button is available in the **Diagnostic** section: choose **On-Dem. security on factory device**. This enables unsecured TCP on the default port **11010**. A notice appears. 3. Read the notice carefully, tick **I have read and agree** to agree, then select **Enable On-demand Security** to enable it. A message confirms the reader has been correctly unsecured. You can now connect to it on port 11010. 4. Go to **Network and Secure Communication** on the left-hand side, enter the IP, set TLS Configuration to **None**, then select **Connection** to connect. The Terminal Information security state changes. Use this configuration to communicate with the reader. If it fails after you select **Unsecure factory device**, a message says the terminal is not reachable (default IP address **192.168.1.10**, secured port **11011**). Check: * That port **11011** is open on your machine. * That there is no IP conflict on the default **192.168.1.10**. Disconnect your device and verify with a ping. Once the device is unlocked, continue the device configuration using the user guide. ### Differences in the default configuration Compared with existing terminals, new Morpho readers are configured by default with: * TLS for IP communication. * Webserver disabled. * USB script configuration disabled. TLS is a security protocol that biometric terminals use to protect communication between the device and the machine talking to it over Ethernet (TCP-IP). It ensures confidentiality and authenticity. TLS relies on a Certificate Authority that issues certificates to PCs and terminals. Certificates signed by the same single Certificate Authority trust each other and refuse others. Certificates have a validity period and need renewing. This change is also why readers on the 11-10-2022 firmware stay offline after an upgrade. See [IDEMIA reader cannot connect after the October 2022 firmware update](/knowledge-hub/products/integrations/third-party-readers/idemia-morpho/troubleshoot/idemia-morpho-firmware-11-10-2022-release-connection-issues.md). For encryption background, see [MA2G and MA5G communication modes](/knowledge-hub/products/integrations/third-party-readers/idemia-morpho/reference/idemia-readers-morpho-ma2g-vs-ma5g-modes.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/integrations/third-party-readers/idemia-morpho/configure/idemia-readers-morpho-how-to-enable-the-on-demand-security-state.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.