The Printer Is a Networked Computer With a Hard Drive
A modern multifunction device has a processor, memory, storage, a network stack, an embedded operating system and a web administration interface. It stores images of documents it has handled. It holds credentials for the file shares and mail servers it scans to. It frequently has an open management interface with the default password.
It is also, in most organisations, outside every process that governs computers: not inventoried, not patched, not monitored, not covered by the offboarding checklist.
The specific exposures
Default administrative credentials. The most common finding, and the one that enables everything else. Many devices ship with a well-known default and never have it changed.
Stored credentials. Scan-to-folder requires an account with write access to that folder. Scan-to-email requires SMTP credentials. These are stored on the device and, on many models, can be retrieved or reused by anyone with administrative access to it — which, given the point above, may be anyone on the network.
A frequent pattern: the scan account is a domain account with broader rights than it needs, because that was simplest. The printer then becomes a route to those rights.
Stored document images. Devices with a hard drive retain images of what they have printed, scanned, copied and faxed. On disposal or lease return, that drive leaves the building with the documents on it. This has caused real breaches and is entirely preventable.
Open services. Unauthenticated web interfaces, legacy printing protocols, SNMP with default community strings, FTP and Telnet enabled by default on older devices.
Firmware that is never updated. Vulnerabilities in printer firmware are published regularly. Patching rates are very low because nobody owns it.
Documents sitting in the output tray. The least technical and most common disclosure: payroll, medical records and legal documents left where anyone walking past can read them.
The controls, in order of value
1. Change default credentials, everywhere
Including devices nobody remembers. Scan your network for printer management interfaces and check each one. This is an afternoon's work and removes the largest category of risk.
2. Put them on their own network segment
Printers rarely need to reach anything except print servers, a scan destination and a mail relay. They almost never need internet access, and nothing on the internet needs to reach them.
A VLAN with explicit rules does two things: it limits what a compromised device can reach, and it prevents the device being reached from outside.
3. Scope the scan accounts tightly
The account used for scan-to-folder should have write access to exactly that folder and nothing else. Not a domain administrator, not a general service account, not somebody's personal login — which is more common than it should be.
Where the device supports it, use a dedicated account per function with minimal rights.
4. Enable secure print release
Jobs held until the user authenticates at the device. This solves the output tray problem completely, and it reduces waste enough that it frequently pays for itself.
For any environment handling confidential documents — healthcare, legal, HR, finance — this should be the default rather than an option.
5. Encrypt and wipe storage
Enable drive encryption where the device supports it, and configure overwrite of stored job data.
For disposal or lease return, obtain written confirmation that the drive has been sanitised or removed. Build it into the lease contract — "the leasing company takes it away" is not a control, and at end of lease the device goes somewhere you do not control.
6. Patch firmware
Put devices on a schedule like anything else. Most vendors offer centralised fleet management that makes this manageable rather than a per-device chore.
7. Disable what you do not use
Turn off FTP, Telnet, unused print protocols, and unauthenticated SNMP. Restrict the management interface to an administrative network.
8. Log and monitor
Device logs showing who scanned what to where are useful for investigation and occasionally for detection. At minimum, know when a device's configuration changes.
The scan-to-email trap
Worth separate attention because it is so widely misconfigured. A device configured to send mail through your mail server, with credentials stored on it, is a mail relay available to anyone who can reach the device.
The common abuses are internal phishing — mail that genuinely originates from your infrastructure and passes your own authentication checks — and data exfiltration by scanning documents to an external address.
Restrict scan destinations to internal addresses or an approved list. If external scanning is needed, make it an exception with a reason.
The question that reframes it
Ask whoever manages your endpoints: is the printer in the asset inventory, is its firmware patched, when was its administrative password last changed, and what account does it use to scan?
In most organisations the honest answer to all four is unknown — for a device that has processed every confidential document in the building and holds credentials to the file shares where they live.
