Many owners think of the office printer as a box that makes paper. Many modern copiers and multifunction printers are small computers with their own operating system, a network connection, a web-based admin page and, in many cases, a storage drive that keeps copies of what passes through the machine. That makes them easy to forget when someone reviews security. Here is what I check when I set one up or inherit one.
Change the administrator password
Many multifunction printers ship with a default administrator password, and those defaults are widely documented online for each model. Log in to the printer’s web page, usually by typing its IP address into a browser, and replace the admin password with a unique one stored in your password manager. Change any default user PINs too. If nobody on staff knows the new password, write it down and keep it with your other business records.
Find out what it stores
Check whether the device has a built-in drive and whether it keeps scanned or copied images. Many copiers do. Look for a setting that clears stored jobs automatically and turn it on. When a copier is leased or being replaced, ask the provider how the drive will be wiped or removed before the machine leaves your office. Put that answer in writing, because a copier can hold months of scanned pages.
Lock down scan-to-email
Scan-to-email and scan-to-folder features need credentials to send mail or write to a shared folder. Create a dedicated service account with only the access it needs, rather than using the personal mailbox of the owner or the office manager. Send scans to one folder or address that a specific person checks every day. Signed forms and tax documents that land in a personal inbox are an avoidable leak.
Turn off what nobody uses
Printers often ship with network services switched on that no office uses, such as older file-sharing, FTP or remote web services. Go through the network section of the admin page and disable anything you cannot name. Fewer open services means fewer ways in, and it costs nothing to turn them back on if a specific need appears later.
Keep it off the guest network
The printer belongs on your office network, not the network you give to visitors. If guests need to print, give them a method that does not expose the device or your shared folders to their connection. Ask whoever manages your router how the guest network is separated from the rest of your systems, and check that the printer cannot be reached from it.
Keep the firmware current
Printers receive firmware updates like any other connected device. Check the manufacturer’s support page for your model every few months, or whenever the admin page shows an update notice. Turn on automatic updates if the model offers them and you trust the vendor’s schedule. An outdated printer is one of the easiest devices to forget.
Use secure release for sensitive jobs
For payroll reports, client files or anything with personal details, use a secure print release feature if the printer supports one. The job waits at the device until the person who sent it enters a PIN or taps a badge. That keeps a payroll report from sitting in the output tray while a visitor walks past, and it also cuts down on paper that someone printed and forgot to collect.
Review who can reach it
Look at the users and devices the printer allows. If the device supports user accounts, remove former employees and any shared logins nobody recognizes. Many offices never revisit this list after the first setup, which means a former assistant’s login can keep working for years. Pair this review with your offboarding routine so a departing person’s print access is removed on their last day, along with their other accounts.
Record the settings
Once the changes are made, write down where the admin page lives, which service account handles scanning, the date of the last firmware check and the lease end date if there is one. Keep that note with your equipment list, so the settings do not disappear when the person who set them up moves on. If you want a second set of eyes, the managed IT team at DirecTech Connect reviews these settings for businesses across Middle Tennessee, and the password manager habit is the best place to store the admin login.
Danielle Lemons is Vice President of Operations at DirecTech Connect, a Nashville provider of business phone systems, managed IT services, websites and digital marketing. More about Danielle.
Read more of Danielle’s writing, or see her profile at DirecTech Connect.
