Most security discussions focus on issues such as firewalls, endpoint security, identity management and cloud security. Just as vital is protecting the information supporting daily operations and business decision-making.
Keep in mind today’s office equipment processes sensitive business information. Such information is stored on the equipment, transmitted over networks, processed in the cloud and emailed to others. It often includes employee records, contracts, financial information, health information, legal information and company intellectual property. Yet most organizations view information processing in the office through the lens of the software tools that employees use to do their jobs rather than through the lens of the information-handling devices themselves. As a result, organizations treat employee data, contracts, financial records, health care information, legal documents and intellectual property solely as operational tools to support employees.
That approach creates unnecessary risk. Information-handling devices, including printers, must be included in the organization’s overall security infrastructure. As a certified information systems security professional (CISSP) who works in the office technology space, I see organizations spend significant time securing the typical information-generating devices (laptops, servers and mobile devices). Then, organizations ignore the huge array of other information-handling devices that also sit in the office environment.
All devices that receive, store, process and send information must be part of your organization’s security program. Unfortunately, many document security processes make printing and sharing more complicated than necessary. Implementing simple security measures such as authentication to print or share a scanned document to or from cloud services like SharePoint or Google Workspace, for example, should not be that difficult. Office equipment security is one of the fastest ways to improve the overall security posture of a business. The devices are already in place, and the information is already flowing through them.
Are these devices getting the attention they deserve? The following seven principles provide a practical roadmap for evaluating, improving and securing today’s office environment.
Securing the Office Playbook
- Every document has a lifecycle
- Start with risk, not technology
- Security begins with architecture
- Control access to sensitive functions
- Keep firmware current
- Build security awareness into daily operations
- Five actions you can take this week
1. Every document has a lifecycle
Information rarely stays in one place. To illustrate the risks associated with managing contracts, consider the lifecycle of a typical business document: creation, storage, printing, scanning, distribution, retention and eventual deletion. That process seems routine until you look at it through a security lens.
As shown in the image, each step in the document lifecycle introduces potential exposure. None of these potential vulnerabilities require sophisticated means of attack to compromise. The key is to ensure that security follows the information throughout its lifecycle and is not limited to one device or technology.
Start with risk, not technology
Before you start to evaluate any security controls, start with the following questions:
- What information moves through this device?
- Who can access that information?
- Where is the device located?
- Does the device store information internally?
- How is data protected while in transit?
- What happens when the device reaches end-of-life?
For example, human resources department multifunction printers (MFPs) process highly sensitive information related to employees’ salaries, performance appraisals and benefits. Meanwhile, a multifunction printer in a warehouse processes much less sensitive reports for inventory and for shipping. Although the devices may look similar, the risks associated with them are very different. Understanding the information being processed by a device determines the appropriate security controls.
Small Business Example: Accounting Firm
For this project, the multifunction printer was situated near the reception area of a 15-person tax and accounting firm. Documents often remain unattended for 20-30 minutes after printing.
The risk was obvious: tax returns and other sensitive client information could sit unattended near the entryway for extended periods. A device with secure print release provided the solution. The technology’s secure print release functionality now requires the financial professionals to enter a personal identification number (PIN) or badge authentication to print client information. The installation was straightforward and completed within a few hours with minimal investment.
The results were immediate and included:
- No unattended client documents
- Reduced paper waste
- Improved confidentiality
- Better audit readiness
Treat office equipment like any other information asset
Office equipment (such as printers, copiers, scanners and fax devices) is often not managed in the same way as other information assets like laptops, servers or mobile phones. That should change.
Every multifunction device must have:
- A designated owner
- Asset inventory records
- Security configuration standards
- Firmware tracking
- Maintenance records
- End-of-life procedures
An accurate inventory provides visibility to ensure vulnerabilities, verify compliance and react in case of an incident. During an audit, the first question is often: “How many devices manage sensitive information?” Organizations should be able to answer that immediately.
2. Security begins with architecture Strong security starts with good design. Lots of organizations still place MFPs on their primary business network with little or no restrictions. A better approach is segmentation.
Secure document workflow architecture
By segmenting users, endpoints and management systems within a secure document workflow architecture, organizations can improve visibility and control. Security baselines should also be standardized.
Every device deployed should include:
- Updated firmware
- Changed default credentials
- Encryption enabled
- Secure protocols configured
- Unused services disabled
- Audit logging activated
Protect data in motion
Modern office devices communicate constantly. Typical connections include:
- Email servers
- Active directory
- Cloud repositories
- Document management systems
- Print management platforms
- Mobile devices
Every connection creates a potential attack path and needs protection. Whether it’s a scan-to-email workflow, cloud repository connections or print management platforms.
Use secure communication whenever possible. Recommended controls include:
- Hypertext transfer protocol secure (HTTPS) administration
- Secure lightweight directory access protocol (LDAP)
- Transport layer security (TLS) encryption
- Encrypted scan-to-email services
Organizations often focus on stored information while overlooking data in transit. Both deserve equal attention.
Control access to sensitive functions
A security program is only as strong as its access controls. When sensitive information is exposed, the potential for harm to the organization increases significantly. Authentication includes:
- PIN codes
- Badge readers
- Smart cards
- Directory-based authentication
- Multi-factor authentication
Authentication equals accountability. It provides a record of who used the device, printed a document or changed a security option. You may also use this information to investigate any misuse or unauthorized access, as well as to prove compliance with regulations. The value of access controls becomes clear when sensitive documents are sent to the wrong device or released to the wrong person.
Small Business Example: Law Firm
A small law practice with five attorneys regularly printed contracts, settlement agreements and client correspondence. An employee accidentally sent a confidential document to a printer located in a shared workspace.
Fortunately, by utilizing a device with print management functionality, the document was retrieved in time to avoid damage. The solution resolved this through a secure find-me printing solution. Using this function, print jobs are held in a secure print queue until the user authenticates at the printer where he or she wants to release the print project. The result was immediate.
The legal professionals could print from any device while reducing the risk of confidential documents being released at the wrong printer. Sometimes the best security improvements are the ones that employees don’t even notice!
Monitor devices like any other endpoint
Many organizations already monitor their networks and endpoints. Office equipment must be part of that strategy.
Useful data sources include:
- Authentication logs
- Print activity records
- Administrative changes
- Device alerts
- Configuration modifications
These records establish accountability and support investigations. For example, activity logs enable organizations to track when sensitive financial documents are printed, who released them, and when it occurred.
Monitoring does not prevent every incident, but it improves an organization’s ability to detect, investigate and respond when one occurs. The same visibility organizations expect from laptops, servers and other endpoints should extend to multifunction devices.
Keep firmware current
Most attacks occur through known vulnerabilities as they are easier to exploit than unknown ones. Outdated firmware creates unnecessary exposure. Unfortunately, device updates are often performed only after a problem or failure occurs. A stronger approach is routine maintenance and review.
Regularly evaluate:
- Firmware versions
- Security advisories
- Vendor notifications
- Configuration compliance
Small Business Example: Medical Practice
A community medical clinic regularly printed patient forms, insurance documents and referrals from an MFP located behind the reception desk. It appeared secure because it was behind the clinic’s front desk. A security review revealed otherwise.
A security review revealed several issues:
- Default administrator credentials remained active
- Firmware had not been updated in more than three years
- Scan-to-email functions were not encrypted
None of those findings required significant investment to correct. The clinic changed the administrator password, updated the firmware, enabled encryption of scanned documents sent via email and restricted administrative access to the MFP. The fixes were all completed within one business day and the risk reduction was substantial. Many security improvements are simple and low-cost.
Physical security still matters
Cybersecurity often receives most of the attention; however, physical security plays an important role in protecting sensitive information.
Simple controls can significantly reduce risk:
- Place devices in controlled access areas
- Restrict visitor access when appropriate
- Secure administrative interfaces
- Implement secure print release
- Protect sensitive output
An MFP in a public hallway presents significantly more risk than the same device in a controlled-access area. Physical security and information security should work together.
Build security awareness into daily operations
Technology alone cannot protect information. Employee behavior remains a critical component of security. Training should focus on practical actions:
- Retrieve printed documents promptly
- Verify scan recipients before sending
- Report unusual device behavior
- Avoid sharing credentials
- Follow approved workflows
Simple is best when implementing security awareness. It is most effective when linked to employees’ daily work and explained in a way that is relevant to them. Employees are more likely to remember simple, practical security measures than a large amount of technical information.
Final Thoughts
Multifunctional printers process potentially sensitive information daily, including employee records, client information, patient data, financial records and other proprietary information.
As a cybersecurity professional, I believe you should treat office technology the same as any other connected system: inventory, monitor, secure, maintain and review. Performing these basic steps will put an organization in a position to protect information and support business operations.
Gerry Gerhardt
Gerry Gerhardt is a Regional Solutions Consultant specializing in regulatory and compliance solutions. With expertise in technical support, problem-solving, and process improvement, he helps organizations navigate complex requirements and operate more efficiently. He recently earned both the CC and CISSP certifications, further strengthening his cybersecurity expertise.