10 steps to secure your print processes

The Federal Trade Commission's recent report, “Copier Data Security: A Guide for Businesses,” makes a succinct, yet powerful, statement sure to get the attention of any organization: “Digital copiers are computers,” and organizations should incorporate these devices into their information security plans.

Digital copiers, also known as multifunction printers (MFPs – office machines that have the ability to print, scan, copy and fax) have hard drives, embedded firmware and the ability to communicate with other systems on the network. They are susceptible to the same security vulnerabilities that a computer is, and without the proper security measures in place, the MFP poses a significant risk of sensitive information exposure.

Networked MFPs are now commonplace in the workplace environment, with office workers using them daily to print, scan and fax documents over the network; in many instances these documents contain sensitive information. To prevent damaging data breaches, government organizations must control and protect both the physical and electronic access points on their MFPs.

The following are 10 specific steps that agencies must consider to secure MFPs, based on common scenarios that exist in most environments.

1. Require user authentication. There is no MFP more unsecure than one that allows anonymous usage; such devices are susceptible to various forms of abuse and can make tracing the source of a data breach or leak virtually impossible. Authentication enables the auditing, reporting and tracking of user activity as well as various other security features.

2. Restrict access based on user authorization. Just because a user has authenticated into the system, doesn’t mean he should have access to every function. At the MFPs, restricting access ensures that users only have access to those resources on the network that they normally do.

3. Centrally audit all network activity. Compliance security standards require most organizations to implement procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports. Centrally building an audit trail of all copy, print, scan, email and fax activity at every networked MFP will bring use of these devices into compliance.

4. Encrypt data to/from MFPs. In order to ensure data security, all data transmitted to and from an MFP should be encrypted. Government agencies must leverage encryption technology that meets specific security guidelines defined by Federal Information Processing Standard Publication 140-2.

5. Implement pull printing. In order to avoid exposing documents to risks when printed, secure printing requires that users authenticate at the device before documents are released. The device must print only those documents that are associated with the authenticated user, and the print job must not be stored on the device prior to printing.

6. Implement rules-based printing. Rules-based printing controls output by analyzing print jobs before release, based on a set of established rules, to determine how they are printed. Organizations with established print policies, such as the U.S. Army Directive 2013-26 “Armywide Management of Printing and Copying Devices” or the General Services Administration PrintWise program, can enforce these policies with the implementation of rules-based printing functionality.

7. Enforce trusted destinations. Once necessary measures have been taken to restrict access to network functions of an MFP through authentication and authorization controls, agencies must ensure the devices are configured to properly prevent documents from being scanned or faxed to any destinations that may risk sensitive data exposure. A common “high risk” scenario is a networked MFP that is configured for “scan-to-email” and outbound analog faxing without controls in place to validate the email address or fax number of the recipient.

8. Monitor and control PII activity. Most government organizations have policies in place to protect personally identifiable information (PII) and other sensitive content. For example, the Department of Homeland Security issued its “Handbook for Safeguarding Sensitive Personally Identifiable Information” outlining mandatory guidelines for all employees to follow to protect PII within and outside of the organization. Similarly, the Navy published a “Users Guide to PII” containing compliance requirements and protective measures to safeguard Navy and Marine Corps. Agencies should leverage software to systematically enforce the PII policies they have enacted. Without a solution in place, organizations must rely on employees manually following protocol, leaving no room for user error.

9. Standardize and integrate network scanning. One common problem with traditionally configured office MFPs is that no two devices within an organization are setup the same way for document scanning. In a typical scenario, each MFP is manually mapped to a network file share with no standardization throughout the organization. Through standardization, administrators can centrally control network folder scanning with a single configuration. Also important is integration support for all of the major commercial off-the-shelf document systems to enable direct and secure scanning.

10. Securing print processes. To prevent damaging data breaches, government organizations must control and protect both the physical and electronic access points on their MFPs. The penalties, settlements and costs for failing to safeguard sensitive information are increasing, and there are simply too many touch points that create risk in sharing information. Most of these involve the technologies that organizations are counting on – especially networked MFPs that copy, print, scan, fax and email.

Agencies must act to enable the compliant exchange of sensitive information and PII by adding a layer of security and control to paper-based and electronic processes. They need an approach that transparently applies automated security techniques – which cannot be circumvented –  that authenticate users, control access to workflows, encrypt data, validate network destinations, monitor and control all documents containing PII and build and maintain an audit trail of all user activity. By adopting this approach, government organizations can minimize the manual work and decisions that introduce human error, mitigate the risk of non-compliance and help avoid the damaging costs of sensitive data exposure.