Presidential Executive Order 14028 of May 12, 2021, directed the U.S. federal government to modernize its cybersecurity efforts to counter what the order called “persistent and increasingly sophisticated malicious cyber campaigns.” At the center of the enhanced efforts the order prescribed were steps that would move the government’s cybersecurity approach toward Zero Trust architecture.
The adoption of the Zero Trust framework quickly became evident to IT practitioners in the corporate world, especially as the expansion of remote work models pushed the threat landscape into uncharted territory. It sparked a reshaping of security controls, impacting almost every component that played a role in modern, tech-driven workflows.
Remarkably, print systems were often overlooked as companies applied Zero Trust security principles. While security was strengthened for key endpoints like laptops and mobile devices, printers, one of the most common endpoints in the office, were left vulnerable.
Security vulnerabilities that arise when printers are neglected
It’s not challenging for IT professionals to envision scenarios in which a print system’s outdated security protocols can lead to problems. Imagine, for example, a busy and distracted employee sends a job that contains private data to the print queue at the end of the workday, then forgets about it as they rush out the door to pick up their child from after-school care. Consequently, a sensitive document ends up sitting on the printer unprotected, creating the possibility that it could fall into the wrong hands and become a dangerous data breach.
In addition to output vulnerabilities like the one illustrated above, legacy printers often also have process vulnerabilities. Most printing protocols send unencrypted files through the network, which can make them a security and compliance risk. And print drivers are bi-directional, which conflicts with Zero Trust principles that emphasize minimal trust and tightly restricted device communication.
The elevated permissions at which print drivers and queues perform inside the operating system represent another process vulnerability. The PrintNightmare vulnerability identified in 2021, which had the potential to impact 1.3 billion devices worldwide, was tied to this type of issue. Fifty more print-related vulnerabilities have emerged since PrintNightmare.
Printers are endpoints that pose security risks ranging from weak audit trails to unencrypted data transmission to opportunities for unauthorized device access. But traditionally, they haven’t been secured with the same level of control as most other endpoints.
Costs companies incur when they fail to address printer security risks
Data breaches are the most obvious risk companies are seeking to address when they extend Zero Trust security to print workflows. Zero Trust principles align well with the security controls required by frameworks such as the Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and Payment Card Industry Data Security Standard (PCI DSS). When controls fail to keep sensitive information secure as stipulated by those and other legal frameworks, companies can face fines, lawsuits, and reputational damage that can lead to a loss of consumer trust.
Operational disruptions are another risk that strong print security aims to address. Successful attacks on print servers can halt workflows and stall office operations indefinitely. In addition to the drop in profitability caused by time loss, operational disruptions can require costly recovery efforts.
Companies that try to manage print security risks without taking steps to modernize print frameworks can also face ongoing costs associated with the impact to their return on attention. Printing is a highly specialized systems process with responsibility fragmented across the IT organization. Consequently, maintaining effective security in legacy systems is a persistent drain on IT resources that never ultimately leads to an improved security posture.
Zero Trust print environments require constant verification and secure communication
Before Zero Trust became the preferred approach, security efforts focused primarily on safeguarding perimeters. Those inside an organization were not considered a threat, while those on the outside had to prove they could be trusted.
Zero Trust, as the name implies, assumes no one is trustworthy. Consequently, all data sources and computing services are treated as resources that must be subject to constant verification. The first step to extending Zero Trust to print environments is to impose explicit access controls on every printer, print server, and document repository.
Central security policies must govern which users, devices, or services are permitted to interact with each printing endpoint, with access to resources granted only on a per-session basis. By requiring validation of users and print identities at each print attempt, companies prevent attackers from exploiting previously approved sessions or impersonating an authorized user. No one is permitted access based on past merit.
Ongoing monitoring ensures that validation and verification are effective and that the security and integrity of the overall system are intact. Monitoring, which should identify who is printing and track the status of print devices, can also catch anomalies that can indicate a breach has occurred. Monitoring print activity gives companies what they need to understand evolving threats and to adjust controls in ways that improve security posture.
Secure communication also plays a key role in eliminating unauthorized access to the print environment. Encrypting print jobs and management traffic end-to-end, regardless of whether the user and printer reside on the same subnet or in public cloud print services, prevents attackers from gaining access to administrative passwords and other critical security data.
Zero Trust print environments empower dynamic policies
The Zero Trust approach emerged in an era when cybersecurity experts were forced to admit they could no longer keep pace with hackers. Static security systems based on known threats were no longer effective against cybercriminals armed with AI-powered schemes. By taking a stance that assumes all activity is potentially hostile, Zero Trust allows defenses to evolve dynamically.
To keep print systems safe, security policies must dynamically adapt to threats based on the attributes of each request. Factors such as a user’s role in the organization and the printer location should be assessed as part of the print process. For example, a print request from an HR employee that involves sensitive payroll data can be restricted to high-security printers in locked rooms in order to prevent a breach.
Dynamic policies leverage authentication, which verifies the user or device identity, and authorization, which ensures users and devices have permission to print the specific document, to further inform policy decisions. Zero Trust platforms must verify that the network printer is the expected endpoint before releasing documents to network printers. Strict enforcement of dynamic policies can help safeguard print environments from attempts to exploit stale credentials or hijack unattended print queues.
Do cloud-based print platforms support Zero Trust security?
Many of the hurdles companies must overcome to improve the security of their print environments are hard-wired into legacy systems. For example, a Zero Trust approach requires that each device have a verifiably unique identity.
To overcome those hurdles, companies can consider shifting to cloud-based printing platforms. The following are features offered by some cloud-based platforms that make them better suited to Zero Trust architecture:
- Identity verification: Identity-based access, versus the location-based access that is central to most legacy systems, is one of the core architectural components of cloud-based print platforms. Every interaction starts with identity authentication and authorization.
- Access control: Legacy systems, which revolve around on-premises printing, operate under the assumption that anyone who can access the network and reach the printer is trusted. Cloud platforms start with identity verification and other authorizations needed to grant access control.
- Visibility: On-premises systems have information on print jobs, but it is typically fragmented to the degree that it doesn’t support the visibility needed for Zero Trust. Cloud-based platforms capture data on both the workflow and underlying telemetry of inflows, requests, and outflows, which empowers superior tracking and visibility.
Challenges companies face when shifting to Zero Trust printing
Shifting from traditional print security frameworks to a Zero Trust approach is a significant change that has the potential to affect every employee in a company. Consequently, companies should expect some resistance.
There will be employees who argue that the current print framework works fine and should be left as is. To help those employees embrace the necessary changes, companies must cast a clear vision of what the shift will accomplish, how it will address the vulnerabilities currently threatening the company, and the steps needed to stay secure.
Employees must understand there will be a day when the old security architecture will fail. Shifting to a new system before that day arrives will be easier on everyone and prevent failures that can threaten the future of the company.
Allowing key teams, such as security and cloud information systems, to participate in the planning process can help to get buy-in on new security initiatives. Hearing from peers who have already made the switch you are contemplating can also be helpful to dispel fears and gain insights on how to move forward efficiently.
Today’s companies face an unrelenting barrage of cybersecurity attacks. A Zero Trust approach to cybersecurity empowers companies to stand up to those threats and keep their systems and their reputation secure. But for Zero Trust to be effective, it must be applied to all of a company’s systems, including print. Those who continue to trust their print systems to outdated security protocols create a vulnerability that can easily be exploited by hackers.
Kevin Pickhardt
Kevin Pickhardt
Pharos
https://www.pharos.com