What should a secure printing strategy consider?


Printing may rarely be discussed in a cyber context, but while the prevalence of connected printers and multifunction printers (MFPs) improves convenience and productivity, it also poses security risks, both technological and physical. From managing and securing paper in digital processes to securing the devices themselves, businesses need to make sure they have a print security strategy in place.

As printers evolved and their functionality expanded, it became common to encounter printing devices in the workplace that were connected to the Internet, sensitive networks, or both.

Printers are often overlooked in security audits because they are often not seen as the complex computers they are. Additionally, many printers are prone to crash when scanning, and so the risk of disruption usually results in only a cursory examination, even when these devices are in the course of an assessment.

This approach can give the impression that printers pose no risk to an organization, a false sense of security, because year after year we see security research presented that identifies serious vulnerabilities and gaping holes in it. the security of these systems.

Before we look at how we can reduce the risks that printers and printing can pose to an organization, we need to look at the common risks:

  • A compromised printer connected to the Internet could provide an entry point for an attacker into internal networks.
  • A a compromised network connected printer could allow an attacker to persist within a network, most likely unnoticed.
  • A the compromised printer can disclose sensitive data to an attacker, such as documents being printed.
  • Printed documents can be sensitive and stolen if they are not physically secured or destroyed.
  • A physically and technically insecure printer may allow installation of malware updates, for example through exposed USB ports.

While not exhaustive, these are some of the primary risks that a potentially vulnerable printer or printing process could present to an organization. A secure printing strategy must take into account the points that reduce the risks mentioned above, as well as the risk posed by those who use the printer and manage the printed documents.

In view of the above risks, there are a number of ways in which mitigation can help reduce the possibility of successful attacks.

Inventory and monitoring

Monitoring and inventorying security is the first step in understanding the basic security posture of printers in an organization. It is crucial to know which firmware version is being used, whether a default configuration (and therefore a default password) is in place or whether anomalies are present.

Make sure the printer firmware is up to date and the configuration is hardened

While you cannot protect yourself against unknown vulnerabilities, businesses can reduce the risk of exploitation by ensuring that a hardened configuration and the latest firmware are used. In order of priority, organizations should ensure:

  • AAuthentication is enabled with a unique, strong password other than the default.
  • TThe device’s firmware is the most recent and regularly updated.
  • All unnecessary services and features are disabled.
  • Document caching settings are disabled where possible.
  • FeConditions such as sending documents by email or uploading to sharing portals are appropriately restricted to only allow sending to trusted domains and authorized suppliers.

These steps can help prevent attacks such as credential theft in the event that credentials are stored on a device, where, for example, previous attacks have seen LDAP credentials extracted. by forcing the printer to authenticate with malicious devices controlled by an attacker.

Isolate your printers if possible

While it may not be practical to completely isolate your printers at the network level, care should be taken to ensure that all printers can only access user workstations and, in addition, that Printer management interfaces can only be accessed from systems designated by management.

This helps prevent lateral movement to sensitive systems in the event a connected printer is compromised, as well as preventing unauthorized users from accessing printer management interfaces.

Regularly monitor the paper output and print area of ​​your printer

Regular examination of the printer location should be performed to ensure that no sensitive documents are left unattended. Where possible, clearly labeled bins and shredding devices should be present near the printing station, and employees should be encouraged to use them for the disposal of secure documents.

Implement secure pull / FollowMe printing

Secure Pull and FollowMe printing is a way to ensure that documents are not published and printed until the authorized user has authenticated with the device. This is a safe way to ensure that printed documents do not fall into the wrong hands before the user reaches the printer.

Ensure printers are included within the scope of penetration testing

Printers tend to be excluded from penetration testing scopes because they are either ignored by the organization or viewed as fragile by the vendor – for example, security scanning can cause them to crash and, therefore, they are often implicitly not reliably evaluated.

Printers should be included in the scope of penetration testing with explicit checks for common configuration errors and a plan of action in case these devices are disrupted (such as testing outside of peak periods and the presence of one person to restart devices if necessary).

Train users to ensure document security

User education is an important part of security and steps should be taken to ensure that printer users understand data privacy, protective markings, and best practices for handling sensitive documents.

Ensure safe decommissioning

Whenever possible, printer hard drives should be encrypted when supported, as well as securely erased before a device is scrapped. This can help prevent data recovery efforts in the event that a printer is stolen or obtained by a malicious individual.

Implementing these measures can dramatically reduce the likelihood of successful attacks and can also help detect potential attacks or entry points before they are exploited by attackers.

Josh Foote is a cybersecurity expert at PA Consulting.


Comments are closed.