To subscribe to our COVID-19 feed, click here and sign-up!
With so many areas across the world now operating under “stay at home” orders, millions of traditionally office-based employees are adapting to life working from home for the first time. The challenges of finding sufficient work space, blocking out the noise from TVs blaring, children playing, dogs barking, online meetings crashing due to the lack of home bandwidth, and other distractions are already becoming all too commonplace. However, there is another, invisible and silent challenge that employers should be very conscious of: data security.
Recent legislation measures introduced by governments across the globe have forced businesses to take much more seriously the safeguarding of our personal data, with the threat of serious punitive fines for those who breach the rules. Companies have reacted by spending huge sums upgrading network infrastructure, purchasing equipment with far more advanced security measures, and training staff to be much more vigilant about the need to protect information.
COVID-19 has, in a matter of weeks, thrown a wrench in the works, with senior executives now having to grapple with how to keep the cogs of business moving while safeguarding sensitive data that could now be flowing across inadequately protected home networks, with contracts, invoices, application forms, and medical records now potentially being printed and scanned on home office printers and MFPs that only weeks before had done nothing more challenging that print the kids homework or an e-ticket.
So, are employees putting corporate information at risk by working from home? They very well could be…if a hacker knows whom to target.
Are Home Printers a Weak Link?
In our testing of office MFPs, we found models that earned our Security Validation Testing seal for device penetration offered excellent protection against the device being used as a conduit to the network for malware and hackers. But the typical printers most employees use at home do not offer the same sophisticated security features as higher-end office models. This is largely offset by the fact that home printers, while lacking the security-conscious firmware found in the best office machines typically do not have the underlying architecture required for a hacker to load malware and launch an attack.
If a hacker does make it onto your home network, he is much more likely to select a computer to host a bot, network sniffer, or other malware than a printer. But assuming your computers are properly protected with a firewall and anti-malware programs, a higher-end printer that is connected to the Internet and home network could be the point-of-entry a hacker is looking for. However, this puts your personal information—online banking logins, or a ransomware attack that holds your personal files hostage—more at risk than your corporate information, since there is no direct conduit from your home network to your company’s network.
That said, a determined hacker could focus on individuals from a targeted company and use this work-from-home wave to either collect data and documents now traversing an employee’s home network (outside the safe confines of a corporate network), or to collect the user’s Remote Desktop Protocol credentials and subsequently gain access to the corporate network. And if the hacker does enter the home network but cannot get onto your PC, he could still potentially intercept the print and scan data streams and see potentially sensitive documents. Some higher-end home office printers offer the option of encrypted printing and scanning, a security measure safeguarding the data stream as it travels from PC to printer; however, the vast majority of home printers will offer no encrypted protection.
The Hacks Are Coming from inside the House
Security experts at Context Information Security, a UK-based cybersecurity consulting and testing firm (now part of Accenture), note that a big security threat on the home network is the WiFi and ever-growing cacophony of IoT devices we now attach to our network in blissful ignorance. With UPnP allowing some IoT devices to effectively punch through the firewall, plus the generally poor security of mass-market IoT products (default factory credentials, no attention to security throughout the device lifecycle) these are the biggest threat home networks face. In addition, given that these devices are all indexed on Shodan (a search engine for all ports on the Internet) it’s very easy for attackers to set up mass attacks against vulnerable devices, capture unprotected print, scan data streams, or worse.
The remedy is for the new work-from-home army to practice proper network hygiene. Change the default passwords of networking gear and any IoT devices that connect to your wired or wireless network to secure passwords. And if you do have a more sophisticated printer that supports advanced networking and communications protocols, be sure to work with your IT department to ascertain the settings they recommend, such as enabling the latest TLS protocol, turning off SNMP v1/v2, disabling Port 9100 and FTP, and ensuring SSL communication is turned on.
To subscribe to our COVID-19 feed, click here and sign-up!
Related Reading
COVID-19: The Impact on Our Industry and the New Style of Work
The Office Scanner Industry Responds to the COVID_19 Outbreak
Caught in COVID019’s Crosshairs: Testimonials of Commercial Printers