Securely printing/scanning at home.

Jump to latest Follow Reply
Muted (0)
C

Cornholio

Ars Scholae Palatinae
812
  • #1
    Context:
    Our network is very tightly locked down. We dont currently allow users to plug in USB devices (other than KB/Mouse/Headset). We also dont currently allow them to access their local network (we have always on VPN, and all network access is blocked until the VPN is connected). And we have various security software in place to protect data exfiltration and data loss prevention based on the content of the data. Any documents leaving our network are scanned for a number of key words and phrases and anything that meets certain criteria is blocked.

    The Problem:
    We are merging some "less secure" parts of our parent company into our core network, and many of the new users make use of home printing/scanning facilities. We need to find a way to securely enable this without opening up any holes in our perimeter.

    One concern is if we allowed access via USB or Wifi, is there a tool or mechanism (windows standard, or 3rd party) that would allow us to monitor/control whats printed based on content and block as required?

    Currently out filtering is managed within O365, on our firewall, and web proxy. Obviously none of these systems are involved when printing directly to a local network / usb device.

    Similarly, if the printer is an MFP, we need a way to allow scanning functions.

    Does anyone have any suggestions?
     
    C

    Cornholio

    Ars Scholae Palatinae
    812
  • #4
    koala said:
    I really wonder how companies that adopt those policies deal with "smartphone taking a picture of a laptop screen". You may think that's a less dangerous vector than being able to write gigabytes to an USB drive- and you'd be right... but it's ceratinly probably more dangerous (faster) than printing...
    Click to expand...

    We are mostly trying to prevent malicious ingress (someone supplying you with a USB stick with a virus on it). But also accidental data-egress. People emailing things to the wrong person, or copying data to places they shouldn't without thinking. We allow people to deliberately override some of the protections under certain circumstances to allow them to work but even if we didnt, there will always be ways around it if you assume the person in front of the machine is being intentionally malicious.

    The restrictions are mostly put in place on us by the data owners (external customers who have specific requirements for data handling), but that said most of these limitations are just sensible in this day and age. I don't think we have been "truly" vulnerable to any of the zero-days in recent years because we have multi-layered "defense in depth". AV, Execution policies, DLP, Port blocking, drive encryption, Firewalls, etc etc. One or more of the protections can be compromised and the rest keep the system secure.

    As for limiting printing. Its not that we dont want people to print. If they are in the office they can print whatever they want. Its that we dont want people plugging random USB printers they got from shipped from china with integrated malware. If we could mandate everyone used only one specific make/model of printer, purchased from a reputable source, we could whitelist it. But I dont think that's an option in this case.
     
    C

    Cornholio

    Ars Scholae Palatinae
    812
  • #5
    dcook32p said:
    We use something by YSoft, but I'm not sure how it works or what caveats it has.

    https://www.ysoft.com/en

    It's not my department, thankfully. But maybe that will give you a starting point.
    Click to expand...

    Thanks for this, that looks really interesting.

    We do already use universal printing at one of our drop in offices, so this might be exactly what we need. The only downside is they dont seem to have any distribution in the UK. But its a good place to start.
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply