Tag:

HP Print Security

HP offers a portfolio of products to solve enterprise print security problems

by Philip Sellers March 31, 2017

In the enterprise space, many of the free vendor tools simply don’t scale and address the wide range of security issues around printing. Enterprises have to deal with compliance and regulations, the potential for audits, and most nagging is finding the time to address printing security. While the security of the PC, servers, networking, and storage are the forefront of the security strategy in enterprise environments, printing is not one that typically has human capital and attention allocated.

Enterprise customers facing the task of securing, particularly without additional staffing, must turn to automation to solve the problem. While ignorance is bliss, now that you’re aware of the significantly lacking security of your printing fleet, you have to do something to shore things up. Fortuntely, HP has a solid set of offerings for its print customers – a set of offerings that really sets it apart from its competition.

HP uses the JetAdvantage Security Solutions suite as branding for its solutions that address many of the pain points for enterprises looking to manage printer fleets on large scale. Inside of the suite, there are three major components that help enterprise lock down their original IoT devices — printers.

HP Access Control
HP JetAdvantage Security Manager
HP JetAdvantage Secure Print

HP JetAdvantage Private Print

On-Premises Solutions

Authenticating Users

The first step is knowing who… HP Access Control is foundation of enhanced security, when looking at data security. At its core, it is about establishing authentication at the device for users and so it is the foundational product of the suite. With authentication, you tie a user interaction at the device to print jobs. This should eliminate misprints and secure documents being routed or left on a printer by accident.

Access Control also solves the problem of the “print and sprint” – running to a shared printer to retrieve a sensitive document.Most company acknowledge that it is far more cost effective to buy bigger and more capable printers and share them across a wider pool of users. But shared printing leave the doorway open for a paystub or customer data being left in the print tray where it can be picked up by an unauthorized user. Once authentication is established, you can leverage Access Control to setup release printing or pull printing – where the job doesn’t actually print until a user releases it at the printer. This is a walk-up technology that allows better data security.

It prevents the absent minded user from leaving data lying around the office. It can be leveraged to add and address scanning and routing and by adding the aptly named Capture and Route product from HP, you can use the known user to intelligently send documents to locations, shortcutting manual steps and routing by the user.

Securing Devices

While much of the configuration management that the JetAdvantage Security Suite can be accomplished with HP’s free Web Jetadmin tool, this tool falls short of reporting and ensuring compliance of desired configurations.

HP JetAdvantage Security Manager fills in the next layer of config management for your HP printers. It is best described as a tool like System Center Configuration Manager for your printer fleet. Like SCCM, it not only allows you to deploy configuration, but also audit and report on the system configuration to demonstrate compliance. The tool goes out and helps you to discover and then apply a baseline profile to each printing device, but to do that you must first find your printers. Security Manager is able to run discoveries against your environment and collection a list of devices and their current state. From there, it can make recommendations in the assess-only mode and for companies that want a white-glove service, Security Manager can also remediate any of the printers that do not match their baseline or recommendations. Like any good config management tool, it is packaged with reports and dashboards to give a quick look into the fleet and the current running state of the printing environment.

One of the other big features for Security Manager is the ability to administer certificates. Most administrators are accustomed to the untrusted certificates that come pre-installed and simply clicking through the browser prompts. Security Manager can workflow and handle the deployment and upkeep of trusted certificates across your printing fleet, making sure that anyone tampering with software would not pass the muster if they tampered with a device. Certificate management on printers is generally cumbersome and time consuming, taking 10 to 15 minutes per device for experienced admins. Security Manager can automate that process quickly and completely.

Cloud Solutions

HP has been working hard to bring print capabilities to the cloud and to its devices. It has developed HP JetAdvantage On Demand as an app store, of sorts, to enable new applications on your HP printers. These apps are cloud-based, so there is nothing that you need to install or maintain on-premises. These solutions are great for small to medium businesses.

HP JetAdvantage Secure Print is essentially HP Access Control running from the cloud. It is a fee-based SaaS solution to enable pull printing in your environment. With Secure Print, you have a cloud queue or a local workstation queue where jobs are held until you walk up to a printer and release them. The primary difference between Secure Print and Access Control is the location where it is installed and who maintains it. With Secure Print, HP maintains the software and you simply consume it.

Secure Print supports for both HP and non-HP printers. HP printers offer more integration and possibilities, but any third party can be enabled with a simple QR code and mobile app to enable job releases at a particular device.

HP JetAdvantage Private Print is a free service, with features much like Secure Print, except it is only for HP devices. While the free service does not have feature parity with Secure Print, it does offer a lot of capabilities and puts secure printing within reach for many SMB customers.

Also within the data security segment, JetAdvantage Insights offers analytics and insight to your printing environment. You get all the basics you would expect from printing analytics – who printed, how often, page counts, which printers have heavier load, etc. Insights can be deployed with agents on each workstation and at each printer in order to gain full visibility of the print landscape. Once deployed, administrators can monitor for attacks, monitor for device failures and watch passive data loss and corruption.

HP is also busy bringing other apps into its JetAdvantage On Demand portfolio, so keep you eye them for more capabilities in the coming months.

Disclaimer: HP, Inc., invited me to their Palo Alto headquarters and paid all expenses associated with this educational trip. This blog post is a result of that trip and the information shared, however, the information I have written in this post is solely written by me without any editorial input from HP.

March 31, 2017 0 comment

5 Tips to Secure your Printer fleet for free

by Philip Sellers January 27, 2017

written by Philip Sellers

So, you’re sufficiently concerned about security for your printing environment. What can you do to immediately improve your situation? And secondly, how much is it going to cost you? Let’s take a look at some general tips that you can accomplish with no additional expense.

Tip 1: Check for patches to your firmware and BIOS and patch your printers software.

This may seem like an obvious one, but the fact remains that a majority of companies do not have a regular patching plan for their printers. When talking with them about their servers and workstations, there are plans and procedures for patching and maintaining that software. When you talk with them about other infrastructure, like networking and storage, there is an awareness and proactivity to patch and upgrade these devices – for features and to rid themselves of bugs. But its not so for printers.

While on the topic, you should also ensure that you get your patches and upgrades directly from the vendor’s website. Third party sites could host modified firmware and BIOS that has malicious code. Relatively few printers checksum or validate their code before running it. It may be a good idea to audit and check the code running on your printers to ensure it is authentic and it has not been tampered with.

Tip 2: Disable any services that you do not require on the devices.

Just like companies have build standards for servers, networking and storage, your printers should also have a standard build profile. This profile should remove any unnecessary services and leave only the ones that are truly required by the company. For instance, did you know Telnet and FTP are often enabled on printers by default? When was the last time you needed to Telnet or FTP to a printer? Should you allow HTTP or only HTTPS? Develop a build document for standardizing your printer fleet. Disable any service that is not used or needed to avoid open doorways for malicious activity.

Tip 3: Change those default passwords!

This really should be second nature, but again, most companies do not have a build standard and therefore default passwords exist in the wild – in the wild and even connected directly to public IP addresses. So, the first line of defense is to change known passwords so that if your printer is ever made accessible, it is not an easy target with a known password. Also, adhere to your normal password policies for complexity and length to ensure a good password is installed on all of your devices.

Tip 4: Monitor your devices – tap into logs and/or SNMP

You should use SNMP to setup alerting from the device and also allow secure polling of the device from management software. While there have been a few known vulnerabilities in printers via SNMP, patching should allow you to safely implement SNMP for your printer fleet. SNMP should be configured to forward traps to your Security Information Event Management (SIEM) software and also to allow SIEM to poll and retrieve information from the device. The traps should alert you to conditions, and although capabilities my vary by vendor and printer, you should be able to find out when new code is loaded, when toner is running low and other useful conditions.

Secondly, if you have the ability to reach in and obtain the logs of the printer, this is valuable information from a forensics and analysis standpoint. The logs should have records for any new code added, any reboot requested, and should lead you with information about source IP and the account used for any of these operations. During my event with HP last week, the question was asked – “If a printer was used to compromise your network, would you know?” Monitoring is the only way to know.

Tip 5: Investigate printer specific monitoring and management software

Most printer vendors give away free monitoring and management software as a value-add to their customers. This software often becomes ‘shelf-ware’ and never gets implemented. That’s a critical mistake. The management software may be a big help in accomplishing all 4 of the prior tips. Rather than having to manually reconfigure and secure each printer, a free vendor software, such as HP’s Web Jetadmin, may be available for your use.

Ok, what next?

So, after implementing these tips, you can go further and deeper to secure your printing fleet. In HP’s case, they have a full suite of software under the JetAdvantage branding to help enterprises combat and ensure that their printer fleet is secure. For more information about those products, see http://www.hp.com/go/jetadvantage and check out my next blog post.

January 27, 2017 0 comment

Datacenter Storage

Are printers putting your network at risk?

by Philip Sellers January 27, 2017

written by Philip Sellers

Only a small percentage of companies think of printers when it comes to securing their network, leaving them vulnerable and susceptible to attacks. Print security? Is that really such a thing? Last week, I spent the day today with HP in Palo Alto, CA, learning about secure printing solutions within their portfolio. Why HP? To me, printing has always been synonymous with HP, even moreso after company split into two companies in 2015. The new HP, Inc., is focused specifically on printing and personal systems and it has one of the largest install bases of its printers in the world.

In many ways, printers were the original thing of IoT. Printers have been network connected for a couple decades now, but the fact that they have been stable and largely ‘just work’ allows people to take them for granted. That leaves printers unpatched and unsecured on networks, which could be a gateway for malicious activity. Add to the mix that printers are also unmonitored and you have a winning combination for hackers to play.

Printers have changed in recent years to keep up with the mobile revolution – adding WiFi, their own email addresses, connections to cloud services, and even apps inside of them – and the build-out of printers software has increased attack surface and the number of potential vulnerabilities. WiFi and wired connectivity on the same device makes it possible to bridge a network. WIRED posted a story almost 18 months ago that outlined hackers creatively using drones to fly phones and connect wirelessly to printers in an office building, then bridging the network, and injecting code for a backdoor onto the network while bypassing the company’s firewalls.

At the HP event, hacker Michael Calce, aka MafiaBoy, spoke with our group of bloggers. Calce was the infamous hacker who took down CNN and Yahoo in 2000 using a distributed denial of service (DDOS) attack. It was unlike anything the Internet had seen before and Calce was only 15. Some years later, Calce switched sides and became a security consultant – advising and providing penetration test services to customers.

Calce spoke for a long time about the mindset of a hacker. “Hackers don’t think the same as regular people,” he reiterated multiple times during his presentation and during discussions throughout the day. The mindset of a hacker is first to understand how you are going to use technology, but then to find ways to circumvent and utilize it for their own purposes. During his first years of hacking, it was all about ‘look at me’ and showing off. Today, however, the goal of hacking is all about monetary gain and these hackers have found funding from sponsor states and free reign to do their bidding. In short, they’re incented.

The main piece of advice from Calce for companies to to educate their employees. According to him, employees are the weakest link and without fail, social engineering and spear phishing are his go-to methods for infiltrating companies during pen-tests. Education programs can come in many shapes and forms, but the primary intent is awareness and changing employee behavior to be more cautious about attachments, documents, and links they receive.

Most hackers, according to Calce, are not coming through your front door or your back door. He likened it to bank robbers – they aren’t breaking into your bank through the doorways, they are coming in through creative ways – cutting through walls or under floors. And the same is true for your network. Hackers are looking for opportunistic ways to get in through easier methods that are not protected. Printers and other connected devices are easy targets for those attacks since they are not secured like other parts of the network.

Printers are an endpoint, just like your PC, Servers, storage and network equipment. So, what are you to do? I’ve got 5 ways you can improve your printer security for free. Check out my next blog post.

Disclaimer: HP, Inc., invited me to this blogger tech day and paid for my travel and hotel accommodations. This blog post, however, is my own views and opinions based on the information that was presented. HP did not review or advise what to say or how to say it – these are my own words.

January 27, 2017 0 comment