Printers, copiers, and other multi-function network devices can pose a security risk if not properly configured. Similar to your everyday computer, many of these devices will have operating systems which allow network connectivity and mechanisms for storage. Consequently, these devices are subject to the security standards and procedures and departments will be held responsible from the initial deployment of each device through to the point the device is either transferred to new ownership or disposal occurs.
While IT support makes every effort to mitigate risk by hardening such devices (as outlined below), the potential risk associated with a compromised printing device could still result in data leakage from logs or data recovery from internal drives. For this reason, using multi-function network devices in conjunction with sensitive data should be a considered factor and limited to necessity.
To secure multi-function network devices:
Use Private Addresses:
Move printers to private addresses restricting access to those physically on campus or to those making use of the VPN.
Follow Hardening Guidelines:
(This list is not exhaustive and may be updated as needed.)
- Set a secure administrator password. (Refrain from using default credentials. Remember the longer the better, while using a combination of case, number, and special.)
- Update firmware. (Just as software updates are a continuous effort, ensuring firmware is up-to-date whenever possible is important to help mitigate risk.)
- Use HTTPS to manage printers across web interface. (Do not use plain HTTP.)
- Disable any unneeded/unused services or protocols. (Whether used for management, communications, or printing the available protocols will likely exceed those that are actually being used by your department. Please disable those not in use.)
- If using SNMP, ensure it is SNMPv3 for encryption and refrain from using the default community string.
- Set Access Control Lists (ACLs) whenever possible. (Restricting access to specific subnets or machines involves additional management by support but when implemented allows added security.)
- Encrypt the internal HDD when available.
- Configure generic service accounts with secure passwords for various features (i.e. print-to-file).
- Logging should be enabled for auditing purposes.
- Utilize a PIN/Password/Passphrase to restrict access to the configuration menu