Published on January 29th, 2015 | by Louella Fernandes2
Closing the print security gap
By Louella Fernandes • on January 29th, 2015 • in Articles • 5,668 views • 2 Comments
Quocirca research reveals that enterprises place a low priority on print security, despite over 70% admitting that they have experienced a print-related data breach.
The loss of sensitive documents can have a huge impact on any business As well as the financial and legal consequences of data loss, the impact on a company’s reputation and loss of customer confidence can be enormous. And, as can be seen from stories in the news, some companies may never recover from a major data breach.
While many businesses look to safeguard their laptops, smartphones and tablets from external and internal threats, few pay the same strategic attention to protecting the print environment. Yet it remains a critical element of the IT infrastructure. Over 75% of enterprises in a recent Quocirca study indicating that print is critical or very important to their business activities.
As part of consolidation initiatives, more and more businesses have transitioned to the use of multifunction products (MFPs). While these bring convenience and improved productivity, the fact that these are most typically shared devices amongst many users also creates a security risk. Confidential or sensitive material can easily fall into the wrong hands when documents are left unprotected and uncollected in printer trays.
Some highlights of Quocirca’s research study illustrate how organisations that have conducted a security assessment and have implemented secure printing solutions are less likely to have suffered data breaches as a result of unsecured printing.
Data losses through print are commonplace: Overall, 70% indicated that they have suffered at least one data breach through unsecured printing in the past year. In fact the number could well be in excess of 70% with 20% indicating they did not know whether any data losses had occurred. The highest stated breaches were 84% of public sector respondents and 75% of retail respondents. This compares to 51% of financial service respondents.
Document security concerns are raised as organisations move to shared MFP environment: The top concern around print security is the need to control confidential or sensitive information printed to shared printers. Notably, organisations using a managed print service (MPS) are most concerned, rating this on average 4.1 out of 5 compared to 3.1 for non-MPS users. Interesting to note is that overall, MPS and non-MPS users show little difference in their experience of print related data breaches. This is due to the fact that there are still a significant number of organisations that are using MPS that have yet to deploy secure printing practices. Equally, secure printing solutions can be implemented regardless of whether an MPS is deployed or not. Certainly, the research shows that the incidence of data loss is lower as MPS users move two the second or third phases of their engagements, beyond hardware consolidation and towards implementation of workflow tools. It may also be that those lacking any MPS capability do not have the required visibility of data breaches – they could be happening without them knowing.
Pull printing adoption is increasing: Overall, 20% have already deployed some form of pull printing with a further 27% planning to implement in the next year. Those using MPS are most likely to have adopted pull printing – 33% of respondents using MPS are using pull printing compared to less than 10% of non-MPS users. Those having deployed pull printing are less likely to have experienced multiple data losses – 27% of those that have adopted pull printing have suffered more than one data loss compared to over half of those that are interested in or are considering deploying pull-printing.
Security assessments correlate with lower data loss. Overall, 60% that have completed a security assessment indicate that they have suffered no data losses. Security assessments are now becoming a more crucial part of the MPS assessment process and clearly organisations are benefiting from more secure printing practices. Security assessments are most popular amongst the financial services sector – 46% of financial sector respondents have completed a security assessment of their print environment with a further 51% indicating that an assessment is underway. This compares to just 7% of public sector and retail respondents that have conducted a security assessment, and correlates to the higher incidence of print-related data loss in these sectors.
Fortunately there are simple and effective ways of minimising the risk of an unsecured print environment.
Consider the following 5 steps:
1. Conduct a security assessment
For enterprises with a large and diverse printer fleet, it is advisable to use a third party provider to assess device, fleet and enterprise document security. This can evaluate all points of vulnerability across a heterogeneous fleet and provide a tailored security plan, for devices, user access and end of life/disposal. Managed print service (MPS) providers commonly offer this as part of their assessment services.
2. Protect the device.
Many MFPs come as standard with hard drive encryption and data overwrite features. Most also offer lockable and removable hard drives. Data overwriting ensures that the hard drive is clear of readable data when the device is disposed of. It works by overwriting the actual data with random and numerical characters. Residual data can be completely erased when the encrypted device and the hard disk drive are removed from the MFP.
3. Secure the network
MFP devices can make use of several protocols and communication methods to improve security. The most common way of encrypting print jobs is SSL (secure socket layer) makes it safe for sensitive documents to be printed via a wired or wireless network. Xerox, for instance, has taken MFP security a step further by including McAfee Embedded Control technology which uses application whitelisting technology to protect its devices from corrupt software and malware.
4. Control access
Implementing access controls through secure printing ensures only authorised users are able to access MFP device functionality. Also known as PIN and pull printing, print jobs can be saved electronically on the device, or on an external server, until the authorised user is ready to print them. The user provides a PIN code or uses an alternative authentication method such as a swipe card, proximity card or fingerprint. As well as printer vendor products there a range of third party products including Capella’s MegaTrack, Jetmobile‘s SecureJet, Equitrac’s Follow-You and Ringdale’s FollowMe, all of which are compatible with most MFP devices.
5. Monitor and audit
Print environments are often a complex and diverse mix of products and technologies, further complicating the task of understanding what is being printed, scanned and copied where and by whom. Enterprises should use centralised print management tools to monitor and track all MFP related usage. This can either be handled in-house or through an MPS provider.
There still remains a gaping hole in the print security of many organisations. Organisations must pay the same strategic priority to the print infrastructure as any other part of the IT infrastructure. Print security demands a layered approach dependent on business needs. With an integrated approach to print security that leverages the expertise of a third party provider, an organisation can ensure that it’s most valuable asset—corporate data—is protected.