Why Printers Should Be Included in Cybersecurity Measures

In June 2021, a major zero-day vulnerability was discovered in the Windows print spooler. The vulnerability existed in a program that administrators use for remotely installing printer drivers. It enabled any user who provided valid authentication credentials—not just trusted, permitted sysadmins—to access the company’s network via the printer. Upon entry, the intruder could do some damage to an organization’s network and systems.

The vulnerability, aptly named PrintNightmare, was indeed a nightmare for sysadmins and IT teams. Aside from the risk of the vulnerability, the immediate fix was to stop the print spooler service, which also stopped users from printing. Needless to say, PrintNightmare caused chaos in organizations’ network and printing operations. It also revealed that a company’s printers can serve as a portal for hackers to gain access to a company’s network and systems.

The printer vulnerability issue escalated rapidly. Initially, it was believed that the vulnerability could be exploited only on Windows servers. However, it later turned out to allow attacks against any Windows machine running the print spooler.

The exploit existed within a tool sysadmins use to install new printer drivers to the print server. Attackers bypassed the printer driver's authentication, ultimately granting that person access to a company’s network. Upon entry, the attacker could:

• Access sensitive information

• Program, change, or delete data

• Create new accounts with full user rights

• Take over domain controllers and potentially compromise an organization’s network

The PrintNightmare issue has been resolved for the most part. However, that doesn’t mean that IT staff can put printer security nightmares behind them. Around May of 2025, hackers discovered that they could enlist the help of a company’s printers to gain access to Windows systems using the Microsoft 365 feature called Direct Send. This enables devices such as printers and scanners to send emails without any authentication. Hackers caught on to the feature and used it to spoof internal users and deliver phishing emails, all without needing to compromise an account.

For decades, printers have evolved from dot-matrix to inkjet to laser technology. These devices all shared a common trait, which was simply to print documents. The linear progression of printer technology primarily focused on speed, efficiency, convenience, and print resolution.

The multifunctional device included technology that combined printing, copying, scanning, and fax capabilities. These devices eliminated the need for multiple machines and they took up much less space than their single-function predecessors.

Over time, printers became smart, wireless devices with built-in storage, operating systems, network connectivity, and remote accessibility. Users can send print jobs from on-site and remote locations using computers, tablets, or smartphones to a printer using a shared driver or print server. 

In organizations, printers often lack the same robust security measures that apply to a company’s computers, servers, network, and firewalls. They are rarely monitored, so hackers can easily use them as an entry point to a company’s network. For example, someone can exploit a printer’s wireless capabilities by connecting their own devices to the printer’s WiFi or network connection. The following are a few of the issues hackers can inflict on companies.

Distributed Denial of Service (DDoS)

Cyber attackers can render a company’s systems unusable with a Distributed Denial of Service (DDoS) attack. Essentially, the unauthorized user can take control of system functions and do things like overload printers with print jobs. Hackers can disrupt day-to-day operations by flooding the company’s network server with traffic. The requests are illegitimate, but they still mislead the server when it attempts to authorize the requestor. Meanwhile, legitimate users are unable to access systems and network resources due to the traffic overload.

Remote Access Trojan

Remote Access Trojan (RAT) infections act like a digital spy. It can give the attacker full access to a computer, without anyone in the company knowing. The intruder can see files, read messages, and control peripherals, like a computer’s webcam or microphone.

Social Engineering Attacks

After gaining access to a company’s network, hackers can gather data on its employees, operations, and business relationships. This information can be used to manipulate employees or partners into revealing confidential information or performing actions that jeopardize security.

Printer Functionality as an Attacker's Ally

Printers with scanning capabilities that can transfer data via email or removable media increase security risks. Attackers who compromise a networked printer could insert themselves into everything a printer does. For example, if the content stored in a printer isn’t encrypted, sensitive data (financial reports, confidential client information, contracts, etc.) can be stolen. Hackers can also infect the printer with malware, either from a storage device or the network, and access data from old print jobs.

Hackers have also been known to use compromised printers as part of botnets (a collection of internet-connected devices infected with malware). Once the botnets are in position, the attacker uses them to:

• Infect devices

• Send commands to the bots

• Set up the bots to infect other devices

• Carry out data theft

• Activate DDoS attacks

The threat landscape continues to evolve, so remaining vigilant and up to date with security measures that keep pace with technology trends is critical. The good news is that it’s possible and relatively easy to implement printer risk management strategies to prevent network infiltration via printing devices.

Employ Multifactor Authentication (MFA)

Multifactor authentication is a layered approach to limiting access to authorized users. The system requires a user to present a combination of two or more credentials to verify the person’s identity for login.

By way of a step-by-step process, users have a primary credential (e.g., a username and password). Upon entering that information, the system prompts the user for an additional verification element (e.g., push notification, one-time code, smart card, biometric scan).

MFA increases security because even if one credential becomes compromised, unauthorized users will be unable to meet the second authentication requirement and will not be able to access the targeted computing device, network, or database. Consider implementing MFA for accessing printer functions, particularly for sensitive operations such as viewing confidential scans or releasing secure print jobs.

Adopt a Zero Trust Security Posture

Zero Trust is derived from the concept of “never trust, always verify.” Zero Trust is not a single architecture. According to the National Institute of Standards and Technology (NIST), it is a set of guiding principles for workflow, system design, and operations designed to improve an organization’s security posture. It functions as an end-to-end approach to enterprise resource and data security that includes both human and non-human entities, credentials, access management, operations, endpoints, hosting environments, and the interconnected infrastructure.

Implementing Zero Trust requires adherence to several fundamental principles:

• Principle of Least Privilege (PoLP). Restricts access rights to only what’s necessary for a specific role, reducing the potential damage of compromised credentials.

• Microsegmentation. Divides networks into smaller, controlled zones to prevent lateral movement by attackers.

• Eliminate default trust. No device or user is inherently safe until proven otherwise. Applying the Zero Trust concept turns a potentially vulnerable printing environment into a tightly controlled ecosystem.

Implement Print Security Best Practices

Print management security is a critical best practice for every organization, regardless of the industry. Using a combination of tools, strategies, and protocols, it protects sensitive data throughout input, transmission, and output.

Secure Release Printing

Vasion’s Secure Release Printing is a print management feature that holds print jobs on the end user’s workstation until they are ready to release them using the following security processes at the printer.

1. The user sends a document from a computer or mobile device to a designated print queue.

2. The print job is held in the queue until the authorized user is at the printer.

3. The user unlocks the print job using one of the following methods:

• Entering a unique numerical (PIN) code

• Swiping an assigned security badge or access card

• Scanning a QR code

Once authenticated, the printer’s interface displays the user’s pending print jobs. The user can then select the documents they want to print and release them. Also, users can choose to delete print jobs they no longer need, and the company can choose to automatically delete unreleased jobs after a specified period.

Keep Security Training Current

Deliver cybersecurity training frequently, such as every quarter, focusing on areas like sharing login credentials, printing protocols, phishing, and data handling. This training helps ensure employees not only keep their training current but also retain and apply the knowledge.

Encrypt Data

Employing encryption protocols protects data both in transit and at rest, ensuring sensitive information remains unreadable to unauthorized individuals. Popular encryption processes include:

• Transport Layer Security (TLS)/Secure Sockets Layer (SSL). Encrypts data between devices and printers during transmission.

• Data-at-rest encryption. Encrypts data stored on the printer’s hard drive or memory.

• Encrypted communication protocols. Secure communication protocols like HTTPS or SNMPv3 for secure data transmission.

• VPN for remote printing. Establishing a virtual private network (VPN) connection for encrypted and secure remote printing.

• Access controls for stored data. Access controls that limit access privileges to stored data to only the personnel who require the information for work purposes.

Vasion provides the security infrastructure necessary to protect sensitive information while maintaining operational efficiency. Its comprehensive, up-to-date encryption technology protects documents from creation through delivery.

Install Firmware Updates and Patches

Printers connected to a network can serve as unsecured gateways to your confidential business data. Upgrading your printer ensures you get the latest features and fixes. Failing to install firmware updates can expose potential security vulnerabilities because, often, the updates that get overlooked include patches that address new risks and security gaps.

Typically, as vendors become aware of vulnerabilities in their products, they issue patches to fix those vulnerabilities. Always apply updates and patches to your printers to keep them and the network protected.

Conduct Regular Print Audits

Regular, comprehensive print security audits enable your organization to evaluate what types of documents and data are being printed. This activity can uncover a variety of issues, including unauthorized print devices in your network and potential security risks in your current printing processes. One common practice is staff leaving confidential documents unattended on the printer, creating opportunities for exposing sensitive information.

A comprehensive print audit involves observing printing habits, analyzing device configurations, and reviewing user access permissions. This detailed analysis enables organizations to understand the true scope of their printing environment, as well as any printing-related security vulnerabilities. Once these weaknesses are identified, companies can implement targeted policies and technologies to mitigate the risks.

One challenge with maintaining printer security is the lack of visibility into who is printing what and when. Without this information, it is difficult to track sensitive documents and identify potential security breaches. Print audits address this issue by providing enhanced visibility into all print-related activity across the organization.

This granular level of detail creates an auditable trail for all printed documents. In the event of a security incident or data leak, the audit log provides the origin and flow of information. Furthermore, enhanced visibility helps identify unusual printing patterns or high-risk users, enabling proactive intervention to prevent potential security breaches before they occur.

Establishing print security policies is a good start to printing and document security. However, enforcing the policies is crucial to ensure ongoing printer security measures. Print audits play a vital role in enforcing established security protocols.

To complete print audits:

1. Embed routine audits into the organization’s culture and best practices.

2. Conduct quarterly security assessments.

3. Regularly review access logs for suspicious activities.

4. Ensure printer security measures align with the company’s relevant standards and regulations.

Print audits are valuable for enhancing the organization’s printer security. By identifying unsecured practices, enhancing visibility, enforcing policies, optimizing access controls, and facilitating continuous improvement, print audits provide a comprehensive framework for mitigating printing-related security risks and safeguarding sensitive information.

Printers are an integral part of an organization’s attack surface. Implementing strong security measures across the printing infrastructure is critical to preventing breaches. This includes establishing robust security protocols for employees, maintaining visibility and control of all printers, and ensuring safe, secure decommissioning when devices reach end-of-life.

The Vasion serverless print architecture eliminates that attack surface, removes legacy print servers, and applies Zero Trust principles directly to physical document output. And customers using the Vasion platform report a reduction of print-related helpdesk tickets by up to 95%. Schedule a demo today.