Presenter: In this lesson
we're going to talk about securing print devices.
This can be done either using user authentication,
audit logs, secured prints or badging.
Now, first we have user authentication.
User authentication means
we're going to set permissions to each printer,
and require you to log in with a username or password
or other authentication mechanism
to prove you have access rights to use that printer.
For example, each printer has the ability
to set up permissions based on the users and the groups
in a Windows domain.
Each group or user can be assigned various permissions,
just the ability to only print to the printer
or the ability to print and manage the printer.
For example,
your users might only be able to print to the printer.
On the other hand, your administrators
could print to that printer, manage the printer
and even delete documents
from the print spooler or print queue
to be able to clear out the stuck print job in there.
This is important as an administrator
because only users can stop their own print jobs,
but an administrator can stop everybody's print jobs.
Now, it's important when setting up permissions
to always follow the principle of lease privilege.
By following this principle,
this means that users will only be able to print
and administrators will have access over the entire thing,
such as printing and deleting.
In addition to this, not all users on your network
need to be able to print to every single printer
in your network.
For example, if somebody works in accounting,
they should probably only be printing
to the accounting printer.
Why?
Because we don't want them to accidentally print
to the wrong printer
and send a bunch of corporate accounting information,
which is considered confidential,
over to the sales department,
and then they would have access to the numbers in accounting
that they shouldn't have access to.
This is really important
when you're dealing with confidential information.
You want to make sure the print jobs
are going to the right place,
and only the right people have access to them.
This brings us to our second area of concern,
which is known as audit logs.
An audit log is a record of all the jobs
that have been sent and printed out
through a particular device.
For example, if somebody in accounting
did print out something,
and it went to the sales floor,
we would want to know who did it
so we can train them on how to not make that mistake again.
Or maybe somebody is printing out
hundreds and thousands of documents,
and you want to figure out why.
Is there a legitimate business reason for this?
Or are they trying to steal your corporate information,
and give it to your competitor down the street?
All of these are good reasons
for looking at your audit logs
so you can figure out, on each printer,
who sent documents there, which documents they sent,
and what time of day they were sending those documents.
If you're using a centralized log server,
you can also configure your network printers
to send their audit logs to that centralized server
so your cybersecurity analyst can look at that data as well
as part of their overall SIEM,
which is also known
as the system information and event management system.
The third area you need to consider
is known as secured prints.
Now, a secured print is a device that's held on the printer
until the user authenticates
directly with that print device.
So if you're working in a large office building,
and there's one large printer for the entire floor,
you don't want to be able to print out something sensitive,
like corporate accounting data or sales figures
or customer contact details and things like that
to a printer that's all the way down the hall,
and have it immediately print out
because somebody else could have grabbed it
before you got to the printer.
So a lot of large office printers
will support a function known as "secured print".
With secured print,
that job is going to be held at the print device,
and it's not going to print out until you get there.
Once you get to the printer,
you'll authenticate with it using a unique pin
or maybe your username and password,
or you might use a badging system.
Now, in a lot of environments,
employees are given an RFID badge,
which is a radio frequency identification badge.
Normally, in secured environments,
you'll wear this identification badge
on the upper part of your body,
generally somewhere between your neck and your waist.
This badge then has a radio frequency ID chip inside of it,
and when you get to the printer,
you touch your badge to the printer,
and the printer will then print out your documents.
Now, one of the great things
about using a secured print or badging
is the fact that your printouts are going to remain safe
until you get there.
The one bad thing about this
is they're not going to start printing until you get there.
And this can actually waste a lot of time
if you're printing out very large documents.
For example, in one of my previous positions,
I would routinely have to print out things
that were 100, 200 or 300 pages
on one of these large printers,
but they wouldn't start printing
until I used my badge and my pin,
and so I would have to badge and pin,
and then sit there for five minutes
while it was printing out all of my documents.
The good news is most of these printers are now very fast,
and they can print anywhere between 20 and 50 pages
per minute.
But that is still quite a bit of time
that you're going to be sitting there
if you're printing out several hundred pages,
or there's a line of other employees in front of you,
and you have to wait your turn.
So remember, when it comes to securing print devices,
there are four main ways of doing this.
This includes your user authentication,
your audit logs, your secured prints, and badging.