Main menu (IT)

Secure Printing

Best Practices for Secure Printing

If you print Level 1 data, the following are guidelines to follow to prevent unauthorized access or breaches:

1. Secure the Printers

Increasing the physical security of printers can help prevent document theft or snooping, unauthorized access to stored documents, and misuse of the printer's Ethernet or USB connections.

Printers should be placed in a restricted watched area to discourage employees or guests from changing the settings. Situating the printer in a restricted but visible area is preferred to placing the printer in a separate room or office where they can’t be monitored. Printers that are used to print Level 1 data should not be used by the entire department. Instead restrict access only to those authorized for Level 1 data.  

Physical ports should be disabled to prevent unauthorized use, and there should be controlled access to pre-printed security paper, such as checks and prescriptions, to present theft or unauthorized use.

To help eliminate security breaches and also reduce printing costs, authentication and authorization should be required for access to device settings and functions. Utilize options like PIN authentication, LDAP authentication and smart cards for this purpose. Some printers also have built-in access control software.

If a printer is being retired or returned when a lease is up, data should be removed so it’s not left in the device’s memory. To prevent data breaches, make sure that the device’s hard disk is erased, destroyed or removed before it’s retired.

Finally, hard copies of documents shouldn’t be neglected, and sensitive papers should be shredded when they’re no longer needed.

2. Secure the Data

Sensitive data is vulnerable as it passes through the network to the printer—and when it sits in the printer memory or storage. That’s why print jobs should be encrypted to protect data in transit in case they’re intercepted.

To protect data before it reaches the device tray, users should be required to authenticate themselves to the printers before any pages will print. Then, once the printing is completed, the document—and even data about the completed job—should not be stored on the printer.

3. Protect Printed Documents

It’s all too common in an office to go to pick up a printout and find multiple documents left in the printer tray or sitting near it. These documents can be viewed or carried off by anyone, creating a security risk. There is a way this can be prevented. If a printer has the capability, activate pull or push printing to reduce unclaimed documents. Users print to a secure network, authenticate themselves and then retrieve jobs as necessary.

4. Monitor and Manage Print Environment

There are tools and utilities that can help track and record print jobs to monitor usage and audit printing practices. Information Technology uses Printer Logic to help track and record print jobs to monitor usage.

5. Update and Upgrade Printers

Keep printers’ firmware and drivers up to date. Often updates add new or improved security features, patch known security holes, and fix other problems.

Most common printers on campus and where you can download patches:

Ricoh Printer Support 

Toshiba Printer Support 

Securing Your Multi-Purpose Printer


Multi-functional printers (MFPs) are security risks. We don't always see them as the full-fledged networked computers they really are. But hackers do - and they are finding them an attractive target. These printers, in the corner of the office and quietly going about their business of copying, printing, faxing and scanning, might not seem to pose any real security risk. But like any networked device, if not properly managed, they can expose sensitive campus data to unauthorized access and misuse. 

Networked printers provide a large out-of-the-box feature set with little to no default security. Most printers will allow a remote intruder full administrative access unless the printer administrator configures the device. Insecure printers on the internet or even just the campus network risk misuse and disclosure of user data (e.g. intruders obtain copies of your documents) and provide an opportunity for hackers to use the device as a platform to attack other systems (e.g. printers are commonly used as part of Denial of Service attacks). 

Administrative Actions


Printer configuration varies widely across manufacturers and models so we can provide only general guidance and minimum requirements. For instructions on performing any configuration specific to your particular device, please contact your vendor or consult your vendor's documentation.

Any networked device that does not meet the following basic standards poses a risk to the network (and the device users) and thus IT Security may remove it from the network for remediation.

  • Review the manufacturer recommendations for securely configuring your printer. Apply any manufacturer firmware updates required to secure the device and make any necessary configuration changes. Links to some common manufacturers are provided below.
  • Use a campus-only computer address so your printer is not available to the general internet. For systems that need a public internet computer address you need to register the device with Information Security. Please note that if there is a clear business need for a public IP that outweighs the risk, then the printer may remain on the public internet but the system must follow all steps described here, must have a knowledgeable system administrator who registers the device with Information Security, and who will be responsible for system updates.
  • Disable any unused remote access services
    • Most printers will have all protocols enabled by default.
    • TCP/IP will be needed for the printer to communicate on the network.
    • SNMP is needed mainly for device management monitoring, and communications.
    • Examples of unneeded protocols that should be disabled are SMB, Bonjour, FTP, IPP, Ethertalk IPX/SPX and NetWare, ApplleTalk.
  • Reset the default password. Use a strong password for any enabled remote access services.  Note that if the passwords are forgotten, there is a strong possibility they cannot be reset or retrieved without replacing the hardware.
  • Always use Secure Sockets Layer (SSL) for encrypted network transport using https when accessing your administrative interface. 
  • Use access control or a firewall: configure Access Control Lists (ACLs) which restrict use of the printer to defined set of client computers 
    • Restrict access to the printer via a specific range of IP Addresses.
    • Restrict to subnet, individual address, or use the print server address to require printing through it
  • Configure the syslog to a departmental monitoring server or if it is Level 1 work with Information Security to log centrally. We only need the authentication and use of any open remote control services, such as FTP. 
  • Secure your printer's hard drive by setting encryption on the hard drive
  • Place the printer where it can be supervised to prevent unauthorized physical access to the hard drive.
  • Upgrade and patch your printer. The CSUN standard is 30 days after a patch is released by the vendor.

Operating Your Printer

  • Do not store jobs on the printer any longer than necessary. Set the hard drive to erase print jobs, scans, and faxes once complete.

  • Use pull printing, swipe cards or departmental codes for any printer that prints Level 1 data. 

  • Remove and destroy hard drives when retiring machines



Links to vendor information below. This list is a starting point and not meant to be a comprehensive list. As stated above: for instructions on performing any configuration specific to your particular device, please contact your vendor or consult your vendor's documentation.



Finding Known Issues