Securing the home office: Printer security risks (and mitigations)

The drastic increase in working from home due to the COVID-19 pandemic has brought a traditional weak point within organizational networks to light – the printer. Instead of being simply a printing device, printers store, transmit and print sensitive data. Without using the appropriate level of security for this device, you’ll leave your home office vulnerable to attacks, data thievery and more. 

This article will detail securing your home office from the printer level. We will explore why printer security is important, printer security risks and best practices to mitigate these security risks. Having a home office with a printer does expose you to the risks associated with printers but with implementing a few mitigative measures, you will be on your way towards a more secure home office.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

Are printers a security risk?

Printer security truly matters, especially in this increasingly home office-oriented world. The short answer is yes, they are a security risk. For those not convinced of this, here is a high-level view on why printers pose a security risk.

• A survey of those working in corporate environments, which have a more cybersecurity-conscious approach towards printers than home offices, found that 50% of respondents have suffered some kind of printer-related data loss.
• Printers store sensitive information, including documents, domain credentials and other information valuable to attackers. Due to being a data storehouse for organizations, printers are an attractive first point of attack for attackers looking for a network foothold.
• In August 2019, a group of researchers identified 800,000 printers connected to the internet and it was found that they were able to get 450,000 of these printers to print out a page of information discussing printer security. This means 56% of internet-connected printers can be taken over by attackers.
• Some manufacturers open the door to more risk than others. For example, researchers have identified three vulnerabilities in Brother printers and nine vulnerabilities were found in Lexmark printers.

This shows that printers have the potential to be a clear security risk for both home offices and the organizational office. Below, we will delve into the risks associated with printers in home office settings.

Printer security risks

Printers have multiple security risks associated with them. From cloud-based printing to being a “sitting duck” of sorts by being laden with useful data if not secured, there are many ways in which printers can add risk to the home office environment. The root of these security issues is often the lack of security measures implemented by manufacturers. Below is a list of some of the most crucial security risks.

Printer accounting bypass

Printing without permission is a security threat in and of itself. Unless your organization has a remote work environment that uses print servers, most home networks use the print driver to determine who can print. Printer drivers are vendor-specific and can vary widely from one manufacturer to another.

Unauthorized configuration changes

This is when an unauthorized user (think attacker) has changed the printer configuration. Routing print jobs is a common use of this security risk.

Getting held for ransom

Ransomware does not only target end-user PCs but can impact printers as well. One ransomware, called HDDCryptor or Mamba, can shut down all printers on a network, whether it is in a home office environment or an organizational office environment.

Default credentials

Printers usually either have a password set as a factory default, very basic user credentials that can be hacked in two seconds or no password/credentials at all. Keeping these default credentials in place may be the easiest way for attackers to gain access to the printer. 

Unauthorized data recovery

Working from home can involve printing sensitive documents that are critical to organizations, such as printing pay stubs and other important documents for the employer. Researchers have known for years how easy it is to recover documents from printers. 

In one study, several $300 multifunction printers (in the ballpark of many home office printers) and documents such as pay stubs, building plans and domestic violence complaints were able to be stolen from them. Storing this data on the printer can be a violation of regulations such as HIPAA, which can result in fines in the millions of dollars.

Printer security risk mitigation

Despite the rather glaring security risks that printers can be, mitigation of home office printers is relatively easy. Below is a list of printer security best practices for mitigation:

• Staying up to date: Some printers have their own operating system. Printer operating systems have updates just like PCs and they must also be regularly updated. Some of these updates are security-related and are vital to keeping a home office printer secure.
• Change printer credentials regularly: Default credentials need to always be changed. Once secure credentials are set, they should be regularly changed, just like for a PC.
• Use 2FA: Aside from printer credentials or PINs, two-factor authentication (2FA) may be offered for the printer and if not, some third-party devices can provide this heightened security. 2FA is used after the user inputs their printer credentials.
• Turn off unused services: Unused or unnecessary services are another big attack point that can be used to hack a printer.
• Store data selectively: Despite all the security tips in the world, storing data such as credentials on a printer is done for convenience, ease of access and to provide full control. Ensure that only the most necessary data and credentials, such as storing the data of users who regularly use the printer only, and a solid data retention policy that only stores the data for a short amount of time is smart.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

Conclusion

The rise of the home office as the “new normal” place of employment comes with increased use of printers in the home office. Printers come with a substantial amount of security risks that can be used by attackers as a foot hold onto your network, setting you up for an even worse attack. 

Sources

• More Printers Could Mean Security Problems for Home-Bound Workers, Dark Reading
• Printer Vulnerabilities Leave Companies at Risk, Booz Allen Hamilton
• Is Your Printer Your Weak Security Link?, Business News Daily