Many businesses connect their printers to a network so that multiple employees can use them to print documents. If all-in-one printers are networked, employees can also use these devices to copy files, scan documents, and send faxes. Thus, using network printers makes good business sense since companies are able to purchase or lease fewer machines. However, network printers can be a liability if companies do little to secure them.
Security Vulnerabilities Abound
Using network printers can be risky. In 2017, researchers highlighted the risks when they tested the security of 20 common office network printers, including models from HP, Lexmark, Dell, and Brother. The researchers discovered that every model was susceptible to at least one type of attack, with many of the models prone to multiple attack methods.Using a simple toolkit they created, the researchers were able to:
- Obtain printer passwords and passwords used for communication protocols (e.g., FTP, POP3, SMTP), which they then used to access the network.
- Reset the printers to their factory defaults in order to bypass the machines’ protection mechanisms.
- Capture and manipulate users’ print jobs.
- Force printers to display a message and then go offline.
- Physically destroy the printers’ non-volatile random access memory.
These researchers were not the only ones to demonstrate the vulnerability of network printers in 2017. In an effort to raise awareness about the dangers of leaving printers exposed online without proper security precautions, a grey-hat hacker successfully accessed more than 150,000 printers. Once connected, he printed a page notifying the printer owners that their printers had been hacked.
Companies Are Doing Little to Secure Their Printers
Despite the vulnerabilities, many companies are not securing their network printers, according to a 2017 survey sponsored by HP. Spiceworks surveyed more than 300 IT decisionmakers working at small and midsize businesses worldwide. Only 41% said they secure their printers at the network level. Even worse, just 28% indicated that they protect their printers at the endpoint level. Since small and midsize businesses are popular targets for cybercriminals, it is especially important for these companies to be proactive and take measures to secure their network printers.
Ways You Can Secure Your Business’s Network Printers
You need to secure your business’s printers just like you secure the computers and other devices connected to your network. Here are some of the measures you can take:
- Change the printers’ default administrator login credentials.
- Periodically check for printer updates. Some printer manufacturers release firmware and software updates for their printers. If an update is available, you should install it as soon as possible.
- Monitor your printers. If your printers come with monitoring and alerting software, take advantage of it. If not, there are ways to set up monitoring and alerting systems.
- Make sure your printers are covered by a firewall and network security protocols.
- Implement a user authentication system to prevent unauthorized access and track usage.
- Disable the services and features that your employees do not use (e.g. Telnet, FTP, storing printing tasks).
- Take advantage of any security features your printers might have. Besides monitoring and alerting software, some printers offer features such as encrypted printing for sensitive documents.
- Isolate your printers on a local network that is separate from your computers and disable out-of-network communication.
The methods that will work best for your business will depend on your printers, your network environment, and printer usage. We can help you develop and implement the best security solution based on your company’s particular needs.
––––––––––––––––––––––––––––––––––––––––––––––
About CHIPS Computer Services
CHIPS Computer Services is an award winning Managed Services Provider specializing in help businesses increase efficiencies and profits by levering properly managed technology. To learn how CHIPS can help your business, email us at sales@chipscs.com to schedule no cost business technology assessment.
