hey everyone welcome back to Tech Talk I'm Julia Beauchamp I am here with
computer world executive editor Ken Mingis as well as CSO senior writer JM
Porup we are streaming live on the CSO LinkedIn as well as YouTube and today we
are talking about printers the overlooked security threat in your
enterprise it's more likely than you think thank you so much for coming in JM
or for me really appreciate it so like we like I said printers can be sort of
an overlooked security threat when you first think of them you think okay they
print stuff they copy stuff they fax stuff which I have used one time but
there's more to printer security than meets the eye indeed
so printers are typically deployed with with internet connections to very
sensitive parts of the enterprise and tend to print very sensitive documents
but unlike the printers of say 20 years ago which printed and maybe copied if
you were lucky the modern printer is a web server FTP server fax machine fax
server has deploys web applications that often don't pass the top ten criteria
and it's essentially a fully functioning server in your enterprise that anybody
can walk up to and stick a USB stick into and the security standards are
typically not very high from the deployment and maintenance of these
devices and given the the sensitive nature of documents that tend to get
printed our sense is that enterprises need to pay a little bit more attention
to the security of their printers you know it's interesting JM one of the
things I was wondering in looking at your last story it seems like there's a
lot of confusion about how these things should be managed and who should be
basically responsible for making sure that printers are you know patched in a
timely manner that you know that someone's basically paying attention to
the security is that one of the issues here yeah no I think that there's very
much an organizational issue at play because most printers are deployed and
managed by outsourced third parties who you know all they do is install and
maintain printers on outsourced basis for their customers and there's intense
competition for for lowest price and fastest response time but typically
those contracts don't specify security based on my research it would appear
that many security manufacturers are doing okay in terms of deploying
security features however because there are financial and organizational
incentives to just make it work as cheaply in fact that fast as possible
those security settings are not being turned on and because in a large
organization where does the buck stop becomes a serious question
and it seems to me that printers are often overlooked by CISOs or CISOs in
terms of who is ultimately responsible for the security of those devices it
makes sense yeah it figures it to be something because I think printers are
so sort of innocuous and also ubiquitous you don't really think of them as an
attack vector that can you know open your company up to attacks are there
specific kinds of attacks that printers are vulnerable to or are they just as
you know vulnerable to everything that you know can can can basically attack
any any connected device well in many cases printers are running insecure web
applications that are easy to exploit remotely also a thing to consider is
that your modern printer stores everything to a very very large hard
drive before printing and are typically not securely deleted so there have been
instances where for instance health care organizations have been fined by
regulatory bodies for disposing of printers that still contained you know
the sensitive medical records of you know thousands and thousands of people
so thinking about you know the physical security as well as the internet
connected security of printers is something that shouldn't very much be on
the minds of a security administrator or a c-style so I'm wondering what is if
printers are often an overload security threat and it's sort of debated
whether or not this responsibility falls on the shoulders of the CSR the SI so
what are the steps that CSO's or CSO should be taking in order to ensure that
their printers are safe I mean I imagine they're already making sure that all of
their their networks are safe making sure to educate employees about proper
proper security techniques what should be going on in terms of printers well
every organization is organized a little bit differently in many but not all
cases there is a CIO who is responsible for the the purchasing and deployment of
IT resources and it's important that whoever is in charge of security the CSO
or CSO or a security manager depending on their job title you know raise these
issues with the CIO to ensure that for instance you know a great place to start
is procurement you know when you negotiate with a managed printer service
provider your contract should stipulate you know bare minimum security
requirements and you know that's the beginning of solving this problem you
know your procurement should not just specify price and maintenance time it
should also specify minimum security concerns and and then beyond that the
question internally is you know who is auditing the performance from a security
perspective of your managed print services provider and ultimately where
does the buck stop who is ultimately responsible for the security of those
devices yeah you know it's interesting and I was looking back at some of the
the previous coverage this year that you've done and others have done at CSO
and one of the statistics that jumped out at me that was surprising just to
sort of you know indicate how how serious a problem this is is that there
was an IDC survey or earlier this year that found that 35% of all security
breaches in office were traced back to an unsecured printer or morti
multifunction device which just indicates that this is you know is
clearly something that hackers are attacking because obviously 35% of these
things are you know coming in on the printer then this is a serious serious
vulnerability is there any sense that companies are aware of this now or
becoming more aware that of this problem
little by little I would say that my impression my very unscientific
impression is that by and large this problem continues to be overlooked by a
majority of organizations some some verticals are particularly badly
affected and they have begun to to move forward specifically health care because
there are many enterprises that are going more and more paperless where you
just don't need to print stuff out because why would you but there are
verticals where paper is a critical and non-negotiable part of the interaction
with a client or a patient and that includes health care where things have
to get printed out sensitive things have to get printed out prescriptions
diagnostic reports the list goes on and on you know and these things almost
Cinelli get printed out and healthcare security has a poor track record in
terms of information security but a growing awareness I feel that it would
be fair to say and many healthcare organizations are much more aware of
these issues than they were even two or three or four years ago and and thinking
about their printers as part of that overall problem
I think there's starting to be a little bit of traction at least in that
vertical interesting and just again to all of our viewers as a reminder we're
streaming live on the CSO LinkedIn page as well as our Tech Talk YouTube channel
if you have any questions please feel free to leave a comment below we'll get
to them towards the end of our broadcast and jam I have a question for you
following up on your on you saying that health care is more susceptible to
having maybe not necessarily hacked printers but printers are by and large
part of a daily are used daily in the healthcare industry how does that
obviously they're handling a lot of sensitive data but they're also handling
data that needs to be that is patient data so there for me
to be protected by HIPAA how is how can is HIPAA tied to this is there are there
sort of breed are there any sort of HIPAA breaches as a result of misuse of
or poor printer security yes I know that there have been fines under HIPAA in the
multi-million dollar range to healthcare organizations for failing to perform due
diligence and securing their their printers I don't have HIPAA right in
front of me however there are numerous requirements under HIPAA that say things
like you know you must perform minimum due diligence and securing stuff usually
in that kind of generic language to not specify specific controls but you know
if you are a hypocrite entity then you must perform at least minimum due
diligence and securing pH I and if you're not doing so then you are you
know exposing yourself not just to regulatory fines but also damage to your
infrastructure and potential loss or damage of pH I you know in thinking
about the the various ways that printers can be attacked
I wonder given the fact that so much of the workforce now is more of a mobile
workforce if people are using tablets or phones and they're trying to print out
documents to a corporate printer is is there another layer of vulnerability
sort of in the mobile sphere that companies need to be aware of - oh yeah
that opens a whole nother can of worms that's what we're here for
yeah a can of opening worms session so BYOD remains a controversial and
enterprise security because it offers some cost savings and and some definite
efficiency returns in terms of not having to buy you know tens of thousands
of phones or laptops for your employees but it also inevitably brings with it
additional security risk because if an employee brings in an infected phone or
an infected laptop that then tries to exploit the corporate network because
you're in you are now inside the corporate network then that raises a
whole host of Trustee shoes and security issues and and
certainly if you if you're an employee who unwittingly and without any amount
you know bad intention brings an effective phone bring into the office
and tries to print from that phone and malware on that phone tries to exploit a
printer that's absolutely a reasonable and possible hypothetical which I I feel
confident in asserting has already happened yeah even if we don't know
about it I'm sure it has mm-hmm now I have more of a question about when old
printers old devices sort of aged out and enterprises are looking at getting
something new what about ensuring that the data that
was stored on that previous printer is completely wiped do you that possible is
that happening and is that a concern oh it's absolutely a concern and secure
disposal of of printer hard drives is critical there have been HIPPA fines for
health care enterprises that have disposed of printers with you know
unencrypted hard drives full of sensitive information I mean first of
all the hard drive should be encrypted anyway but they should be securely
disposed of before you know printers typically have a two to three year life
cycle and are replaced as part of a managed print services contract and and
that contract should explicitly require secure deletion and destruction of any
hard drives or other sensitive storage media on the printer good point I wonder
are there you know in your research and in the stories that you've written hit
have you found that any of the the printer makers seem to be more sort of
leaning into security than others I mean I know that there was a story on CSO
that said HP for instance had started some sort of private bug try bug bounty
program last year with like $10,000 and awards if you could you know crack the
printers are we seeing that that the printer manufacturers themselves are
obviously they're aware of it are they doing things proactively to sort of get
ahead of the problem my impression is that printer manufacturers are actually
not the main source of trouble here I mean can we criticize them for some
security issues yes but I feel that even the the many security feature most
printers today ship with fairly sophisticated security features already
built into the printer but because of the the low margin issue of dealing with
managed print service providers even those tools already being shipped by the
printer manufacturers are not being turned on and deployed properly so can
printer manufacturers continue to do better absolutely I don't feel in this
particular case that they are the source of most of the issues which are you know
you know turn on the security features that the device shipped with and
maintain them and deploy them in a secure manner
oh and that falls on the the enterprise and their management service provider
more so than the manufacturer yeah I think now would be a good time to turn
to our audience to see if we have any questions from our viewers on CSO
LinkedIn or on our Tech Talk channel Michelle yeah lots of comments one
person Matthew lemmers likes JM we like him too
he pointed out what's already been talked about as a storage so he says IP
office equipment everyone thinks that their mundane am sorry and benign but
they should also discuss copiers with storage that never get wiped and then
also somebody says that they need to be wiped from time to time not just that
disposal or at the end so some just some comments there another person with a
comment saying we've seen many Network Devices printers security cameras etc
used to infiltrate networks in pen tests yeah that makes sense you know those are
all it's interesting that goes back to the point that you made at the very
start that that printers just like any other connected device are going to be
vulnerable and of course that's true with webcams and or surveillance cameras
or any anything that's connected is vulnerable and that's something that you
know you have to remember when it comes to the most common thing in the office
the printer that it's as vulnerable as anything else
but everyone's always grumbling over and one of the one of the viewers did bring
up a very interesting valuable point it is important to wipe these devices from
time to time if you have a printer or copier deployed for three years and that
giant hard just just accumulates sensitive documents over three years
then any exploitation over that three-year period gives you access to
every sensitive document basically ever prayer on that device so a regular
maintenance of secure deletion and wiping of those jars is in fact a highly
recommended security control indeed that's a great tip and we do have a
question also um so I'm just gonna read it says eliminating printing replaced by
document scanning still leaves multifunction devices open to compromise
any specific recommendations for the digital office working to eliminate
printing as much as possible did you hear that Jim I don't have enough
information to give a well-informed opinion on that IIIi think you know
there is a move in many industries to move away from paper and understandably
so why why would you print out if everyone has a tablet I mean you know
it's a fair point but there are industries that remain stuck and paper
and will remain stuck in paper for the foreseeable future such as health care I
do not see hospitals or healthcare moving completely away from paper
anytime soon and that remains the case for other verticals as well in terms of
you know document scanning I I would need to take a closer look to give you
an inform depending on that yeah that makes perfect sense and I would imagine
that document scanning mobile document scanning is then opens you up to a whole
other realm of security threats so you know there's no one salute perfect
solution I was just gonna ask to sort of sum up Jamie you know if you had to
offer advice to companies that are you know maybe now becoming more aware that
this is an issue maybe the the top two or three things that companies maybe
three things that companies should be doing or should plan to do to try to
button up these things as best as possible yeah absolutely I mean I think
the number one thing is if you're going to use a managed print service provider
there's nothing wrong with doing that by the way then your next refresh cycle you
should absolutely sit down with your CSO or CSO or security manager and include
security requirements in your procurement RFP because that that is you
know like 80 percent of it right there if your management service provider has
no contractual or financial incentive to keep your network secure then you know
they're not going to because why would they they're operating on a very thin
margin that there's no profit in doing so it's going to cost you more but it's
going to save you money in the long run and and the second thing to do is you
know CIOs and CISOs need to sit down and iron out where does the buck stop who is
ultimately responsible for printer security as part of the broader
enterprise network and you know give that person the authority to act to
secure those devices good that's great advice and of course the usual is always
keep the employees trained you know on security which is true about every
measure of security anyway Jam a lot of great information here and I think this
is you know going to raise awareness I hope among companies and employees
that their printer is is as vulnerable as other devices so thank you so much
for all the information it's always a pleasure I can't thank you for having me
on thanks for being here thanks Juliette for being here as a reminder um we're
streaming on LinkedIn live CSO page today in youtube if you like what you're
seeing please follow the CSO LinkedIn page please subscribe to our YouTube
channel coming up next week we'll be back with Preston growler who's going to
be answering some questions about Windows 10 that's on Tuesday November
12th in the meantime thanks for watching