Print security is becoming an increasingly important issue for businesses today. Because of growing cyber threats and increased legislation around privacy and data security, companies and organizations need to focus on strategies for securing their printing functions.
According to InfoTrends, there are approximately 30 million printers and multifunction printing devices currently in use in the U.S. and Western Europe. Since the majority of these are connected to some kind of network, they’re just as susceptible to malware and hacker attacks as computers are.
After all, they often handle sensitive documents and information, and they have the potential to provide hackers with an access route to computers on the network. Besides the fact that documents often lie unprotected in printer output trays long after the jobs have been completed, printers store information in memory that can be recalled or intercepted inappropriately. They need to be managed and protected, just like the rest of an organization’s IT infrastructure.
Every industry is concerned about print security.
Take healthcare, for example, where the sensitive nature of medical data—and the importance of maintaining patient privacy and confidentiality—make secure printing and scanning crucial for general practices, hospitals and clinics. Health institutions face stiff penalties for failure to comply with the requirements of the Healthcare Privacy and Portability Act of 1996 (HIPAA).
In K-12 education, school staff need secure print solutions for all kinds of confidential information—from health records and psychological assessments to grade reports and test results to court orders and other legal documents related to students.
Print security is also of critical importance to the public sector, which like healthcare, handles a wealth of private information and is subject to strict regulations regarding information sharing and storage.
Likewise, small and midsize businesses need secure printing and scanning solutions to safeguard business-critical information and close loopholes that hackers may exploit for network access. Depending on the nature of the business, companies may also need to protect sensitive data belonging to their customers, such credit-card numbers and other financial information.
There are different kinds of printer threats.
Companies may not realize it, but there are actually many risks involved with printing and copying. These include:
Document theft or snooping: A person can simply walk up to a printer and pick up a document that someone else has printed.
Unauthorized setting changes: If a printer’s settings and controls aren't secure, someone can mistakenly or intentionally alter and re-route print jobs, open saved copies of documents, or reset the printer to its factory defaults—wiping out all of the settings.
Recovering saved copies from internal storage: If a printer has an internal drive, it can store print jobs, scans, copies and faxes. If someone steals the printer, or if it’s discarded or retired before the data is properly erased, someone can recover the saved documents.
Interference of network printer traffic: Hackers can eavesdrop on the traffic of your network, and capture documents that are sent from the network computers to the networked printers.
Printer hacking on the network or through the Internet: A person on the network can hack into a network-connected printer fairly easily, especially if it’s an older model without updated security features or password protection.
If a printer is accessible via the Internet, the field of potential hackers is virtually limitless. Attackers could send bizarre print jobs to the printer, use it to transmit faxes, change its LCD readout, alter its settings, launch denial-of-service (DoS) attacks to lock it up, or retrieve saved copies of documents. Cybercriminals might even install malware on the printer itself to control it remotely or gain access to it.
Best practices for printing security.
How can your customers—whatever industry they’re in—ensure that their printing is secure? What advice can you offer them as their trusted business advisor and IT partner? Here are some steps that you can suggest they follow:
1) Secure the printers.
Increasing the physical security of printers can help prevent document theft or snooping, unauthorized access to stored documents, and misuse of the printer's Ethernet or USB connections.
Printers should be placed in an open area to discourage employees, freelancers and guests from fooling with their settings. Situating them in a somewhat visible open area that’s accessible to most users may be a better idea than sticking them in a separate room or office where they can’t be monitored as closely. Ideally, companies should consider designating separate printers for management and sensitive departments, and keep those machines secure from other employees.
Physical ports should be disabled to prevent unauthorized use, and there should be controlled access to pre-printed security paper, such as checks and prescriptions, to present theft or unauthorized use.
To help eliminate security breaches and also reduce printing costs, authentication and authorization should be required for access to device settings and functions. HP suggests deploying options like PIN authentication, LDAP authentication and smart cards for this purpose. Some printers also have built-in access control software.
If a printer is being retired or returned when a lease is up, data should be removed so it’s not left in the device’s memory. To prevent data breaches, make sure that the device’s hard disk is erased, destroyed or removed before it’s retired.
Finally, hard copies of documents shouldn’t be neglected, and sensitive papers should be shredded when they’re no longer needed.
2) Secure the data.
Sensitive data is vulnerable as it passes through the network (or cyberspace) to the printer—and when it sits in the printer memory or storage. That’s why print jobs should be encrypted to protect data in transit in case they’re intercepted.
To protect data before it reaches the device tray, users should be required to authenticate themselves to the printers before any pages will print. Then, once the printing is completed, the document—and even data about the completed job—should not be stored on the printer.
3) Protect the printed documents.
It’s all too common in an office to go to pick up a printout and find multiple documents left in the printer tray or sitting near it. These documents can be viewed or carried off by anyone, creating a security risk.
There is a way this can be prevented. If a printer has the capability, activate pull or push printing to reduce unclaimed documents. Users print to a secure network, authenticate themselves and then retrieve jobs as necessary.
4) Monitor and manage the print environment.
There are tools and utilities that can help track and record print jobs to monitor usage and audit printing practices—to help companies identify workers who may be abusing their print privileges or ignoring company security policies. These tools can also pinpoint specific areas where companies can reduce print jobs and save money.
5) Update and upgrade printers
Advise your customers to keep their printers’ firmware and drivers up to date. Often updates add new or improved security features, patch known security holes, and fix other problems.
By taking the proper steps, your customers can help ensure the security of their printers and copiers, so printing function remains a business asset and not a liability.