Is Your Printer a Gateway to You Being Attacked?

Nowadays almost any device on a corporate network is Internet-enabled. Think about it. Printers, HVAC systems and cameras all pose certain risks to a network. We spend countless hours and dollars protecting the perimeter of our networks, end user machines and servers but what about the other possibly, vulnerable devices inside your walls. In the end, each one of those can, in one way or another, be a compromise point to an office or enterprise.

The most commonly protected security threats within a business’ walls are computers and servers as they pose the highest exposure risk to them. Then sometimes we think about Multi-functional Printers (MFPs). These devices allow us to print, scan and email and that’s where the risks come in. Most of those devices have the ability to store completed print jobs, scans and emails. Think of the great repository of sensitive and sometimes confidential information that resides within this box sitting in the office. To top that off, it may not be secured adequately, nor have proactive security measures, so the data can be accessed by anyone.

So, what are the common printer security risks?

They are trusted. Many companies implement printing devices into their network without thinking twice about logically separating them from the rest of the network. There are many services on those devices that are left “turned on” by default providing potential access for attackers. A compromised user workstation may not grant a hacker access to internal servers, but it may grant them access to a printer that has catalogs of sensitive information stored on it from previous completed jobs.

Default passwords. Many times, IT professionals leave the default credentials on MFP devices as it makes it easier to manage or there may be no authentication at all. This could allow an attacker to manipulate configurations, alter print jobs and even install malicious software on the device itself that could be used to attack the rest of the network thus compromising sensitive information and systems.

External Access. This is where the convenience factor comes in. Many organizations allow their employees to access printers both internally and externally from outside their office. By doing that, they don’t realize they may also be granting adversaries with same access as well. That’s when the unpredictable can happen. Weird print jobs, denial of service or even a malicious take over may not be too critical if it is isolated to the device alone. However, it could be devastating if it spreads beyond it.

Vulnerabilities. As with workstations, servers and other network equipment, printing devices also have vulnerabilities. News has just broken that HP OfficeJet all-in-one inkjet printers have a major vulnerability. Researchers have uncovered that the sending of a malicious fax to one of those devices can give adversaries full control of that device thus providing them with a pivot point into a network.

Cloud Printing. Printing that originates in a publicly accessible infrastructure such as the cloud could mean, at times, rendered jobs can and will be exposed to “man in the middle” attacks, thus providing hackers with access to the enterprise via printing channels.

Now that we know some common risks let’s talk about how dependent we are upon them.

We live in a very digital age but a majority of companies still rely heavily on paper. Convenience brings other risks into enterprises that I will not cover in this article. However, it should be asked: what happens to all the paper files containing sensitive information? Are they always being disposed of properly?

Printers are great if they work, but for many IT professionals they are a nightmare when they don’t function as intended. When there are certain functionally issues it is easy for security to become overlooked. All printer services are turned on for convenience, yet devices are often not properly regulated or updated because they seem to be working fine. Often, security patch updates are seen to be unnecessary, or are likely to add other unwanted problems.

What can we do better to help minimize the hidden and many times overlooked printer security threats inside our networks?

I suggest starting with the logical separation of the printing devices. The best way is to make sure each office printer functions on their own separated network segment. We can implement that by using virtual networks throughout the enterprise. In addition, there will also be a firewall or, even better, a Unified Threat Management appliance placed between those networks. Only allow certain communications required for printing, scanning and emailing. This will heavily minimize the exposure of the rest of the network in the event of a compromise.

Now that outgoing Internet access can be controlled on networks, all printers can be easily blocked from accessing the Internet. Most MFPs or printers never really need to have direct access to the Internet. Adversaries from outside of your building printers cannot access any footholds or possible malicious software on the printers if you block access to the Internet by default.

Let’s move on to proper protection of those devices. As discussed, convenience is the reason we allow anyone to print or access the devices for different reasons or business functions. However, we do need to keep security in the top of our mind in this age of the cyber-crime epidemic—for all devices, not just printers. Default passwords must always be changed. Employee’s awareness and printing behaviors should be clearly defined in an Acceptable Use Policy—probably one of the most important policies everyone should have describing the do’s and don’ts of the company’s information systems and networks.

I am a strong believer of not allowing cloud printing for businesses. There should be other secure means implemented if there is a need for employees to print when they are outside the office. Even then, the overall risk of remote access and printing should be thoroughly evaluated for security.

One newer function on most MFPs will now allow you to perform data scrubbing. This is a simple configuration that helps prevent easy access to sensitive information that may have been stored on the device itself. I strongly recommend, wherever possible, to configure nightly maintenance of those devices that will clear out all of the data accrued during the day. This helps mitigate the volume of sensitive information that may be accessible in an event of a compromise.

Today’s security threat landscape is not a matter of IF, but WHEN you will be compromised.

In order to fully protect your organization, you need to incorporate risk management of every device in it. It is not just the server, computers and other in-sight devices. It is critical to have a design of an enterprise that incorporates security on everything that touches the network and may have direct or indirect access to sensitive information. Printers and Internet of Things (IoT) devices, among others, all need to be assessed for risk that may pose a problem to the company and be properly managed through their respective lifecycles.