The lease truck arrived at 9am. At 9:05, the office manager signed the paperwork and the copier — the big MFP that had scanned every invoice, contract, and salary letter for four years — rolled out the door with its hard drive intact.
Nobody had thought about the disk. Printers are the one computer in the office that everyone treats as furniture: nobody patches it, nobody owns it, and nobody asks what it keeps. But a modern multifunction printer is a Linux box with a web server, stored credentials, and a drive that has copied every page that ever went through it. This is the checklist we use to fix that in about an hour, then keep it honest in ten minutes a quarter.
The admin plane comes first. Log in to the printer's web admin. If the default password still works — and in half the offices we visit, it does — that is finding number one. Change it to a unique value in the password manager, and retire the sticker taped inside the tray lid. While you are in there: disable remote administration from the internet, and turn off the vendor's cloud-print service unless someone actually chose to use it.
Then move the printer out of the blast radius. A printer on the flat office network is the classic lateral-movement hop — compromise the printer, reach the file server. If the router supports a guest network or VLAN, put printers, cameras, and smart TVs on it. If the network is flat (most small offices), document that as a known risk and compensate: unique admin credentials, current firmware, wired only, and no stored credentials beyond what scanning genuinely needs.
Firmware on a calendar, not on a crisis. Twice a year, per device: check and install firmware. Printer vendors ship fixes slowly, but they do ship — including for the spooler and web-UI bugs that get printers added to botnets. And watch what an update silently switches ON: enabling the vendor's cloud service by default is the classic surprise. The person who owns the printer (every device needs a named owner, even the $99 inkjet) checks the admin screen after every update.
The credentials inside the printer outlive the people who set them. Scan-to-email is an email account with a password saved in the printer. When the person who configured it leaves, that password stays behind. Rotate the printer's SMTP or mailbox credential in the same pass as offboarding. Scan-to-folder should run on a scoped, write-only service account — not the admin account someone grabbed because it was faster.
The disk is the part that leaves the building. Enable disk encryption or data-overwrite if the device supports it, and enable secure print release so jobs print to the person standing at the tray. And before the lease truck arrives: run the vendor's wipe utility, photograph the confirmation screen, and file it with the lease paperwork. A lease return without a wipe is a quiet data-breach event — years of documents, gone to the refurbisher.
Then ten minutes a quarter keeps it true: firmware current? admin password still unique? device count on the network still explainable? no new cloud services? Four yes answers, and the printer leaves the risk register for another quarter — right next to the router check and the badge reconciliation.
The full checklist, including the inventory row and the lease-return wipe steps, is free on our ops-notes site:
Printer Security Checklist for Small Teams →
If you want the fill-in-the-blank versions (device inventory, quarterly walk sheet, incident-response plan), the Ops Starter Kit is $14, and the free one-page First 30 Minutes incident checklist is the place to start.
Top comments (0)