Is Your Printer A Gateway For Hackers? Five Tips for a Secure Printer

HP Inc. has security protections embedded in its printers ( e.g. , LaserJet and PageWide Enterprise printers), such as run-time intrusion detection and a firmware vetting process called whitelisting, Eileen Griffee, industry consultant at HP Inc., says.

Despite the protections, Griffee recommends law firms also use security software and services. “Law firms that do not take steps to secure their print infrastructure, like they do for PC endpoints, are at risk for an expensive, disruptive data breach,” she says. “[L]aw firms should be working with their print vendors to ensure that their printers include embedded security to prevent malicious intrusion, along with securing data streams and hardcopy documents.”

HP provides security software, including JetAdvantage Security Manager, as well as services.

Law firms aren't going paperless anytime soon, says Selby. “Mitigating the risks associated with MFPs should be an important part of every firm's cybersecurity plan.”

Selby shared a few tips on how printers can be secured at law firms:

1. Keep Printers on Security's Radar

Printers should be treated as part of a firm's IT infrastructure, included in its cybersecurity plan, and placed behind its firewall, Selby says.

2. Unused Features, Passwords and Updates

Unused Features: “(A)lthough modern MFPs may offer hundreds of security setting options, firms need to disable unused features and activate them with proper security enabled,” Selby says.

Passwords: “Default administrator names, passwords, and wireless service set identifiers (SSIDs) must be changed and secured.”

Updates: “Scanning configurations should be standardized for all MFPs,” Selby says. “Installation of security updates should be included within the firm's cybersecurity protocols.”

3. Monitor Activity, Avoid Unsecured Printers

“Firms should also maintain an audit trail of all MFP activity, including all copy, print, scan, e-mail, and fax jobs,” Selby says.

“Improperly configured and unprotected MFPs can provide a point of entry by hackers into the firm's network, so there should be a zero tolerance policy with regard to the use of MFPs that are not maintained as part of the firm's IT infrastructure.”

4. Encryption, Tossing Old Data

“Firms also need to protect communications between other devices and MFPs,” Selby says. “Data transmitted to and from MFPs should be encrypted. Users should be authenticated and firms should consider restricting the destinations to which MFPs can email or fax data. The data stored on MFPs creates additional security risks, both at the time the firm is actively using the MFP and when it is taken out of service. If an active MFP is not properly secured behind the firm's firewall, the data stored on its hard drive is vulnerable to hackers. Firms should consider encryption for that stored data. In addition, care should be taken to ensure that all stored data is removed at the time the MFP is retired.”

5. Limit Access

“In addition to these steps, firms also must remember to secure the actual printing processes,” Selby concludes. “At a minimum, firms should limit physical access to printers and enforce a 'clean printer' policy, so that printed documents in an MFP output tray are not left sitting unprotected. In certain situations, controls can be put in place to require user authorization at the MFP itself before the print job is completed.”

Mark Gerlach writes for our ALM sibling, Legaltech News.