Printer Security Best Practices for Small Businesses

Secure a business printer by treating it like a server. Take it off the public internet, change every default password, turn off protocols you do not use, put it on its own network segment, keep the firmware patched, and log what it does. Most of this takes minutes per device. Skipping it leaves a computer with stored documents, network credentials and a web login sitting on your network.

This guide is a working checklist for owners and office managers in Wisconsin and anywhere else. Each step says what to do and why, and each is tied to guidance from government agencies, universities and printer manufacturers.

TL;DR

Printers and scanners often ship with default credentials and sometimes hold privileged accounts. Attackers use them to move laterally and compromise a domain.
Never expose a printer directly to the internet. Put it behind a firewall, on its own VLAN, with printing and management limited to the hosts that need them.
Change default admin passwords and SNMP strings, switch to HTTPS, and disable protocols you do not use.
Patch firmware under change control, turn on logging, and use secure print release so documents wait for the right person.
Wipe or destroy stored data when a printer is retired, then scan the device to confirm only the ports you need are open.

Why printers are a real security risk
The printer hardening checklist
A practical order of work
What we see and what we recommend
Get your printers and network assessed
FAQ
Sources

Why printers are a real security risk

A modern multifunction printer is a small computer. It runs an operating system, hosts a web server, stores jobs on a drive, talks to email and file shares, and often holds a directory account so it can look up users. That makes it a useful foothold.

The NSA and CISA, in a joint advisory on the most common misconfigurations they see, note that printers and scanners may contain default credentials and privileged domain accounts. An attacker who gets in with the default login can use those accounts to move through the network and compromise the domain. The printer is the doorway, not the target.

There are also flaws in the devices themselves. CISA's advisory on certain industrial printers described how specially crafted packets sent over the same network could retrieve a front-panel passcode. The practical lesson: a printer that any device on the network can reach is a printer anyone on the network can probe.

Wireless, mobile printing and cloud features add convenience and entry points. HP's U.S. guidance says these features can open the door to unauthorized access, document interception, malware and network intrusion if they are not configured with care.

For a manufacturer, a law office or a dental practice, the paper also matters. Contracts, patient forms, drawings and financial statements all pass through the output tray and the internal drive.

The printer hardening checklist

The order below follows how most universities and manufacturers structure their own hardening guides. Work through one printer model at a time. HP's own checklist for its multifunction devices says to configure settings in order, one model at a time, because some settings can cut off management tools and applications that rely on them. Test printing and scanning after each change.

1. Inventory every device and know where it sits

You cannot secure what you have not listed. Write down every printer, copier, scanner and multifunction device: model, location, IP address, firmware version, who administers it, and what it connects to (email, file shares, directory, cloud print).

Include the forgotten ones: the label printer on the shop floor, the old copier in the back office, the scanner at reception. Industrial and label printers are covered by the same advisories as office ones.

Use private, non-public IP addresses for every device. UT Austin's hardening checklist calls for private IP space and restricting printing and management to required subnets or trusted hosts.

2. Keep printers off the internet

CISA's guidance is plain: printers should not be fully accessible from the internet. Where remote access is needed, it should use a secure, encrypted connection, and devices should sit behind firewalls and be isolated from business networks where appropriate.

Kyocera gives the same advice for its devices: do not connect a printer directly to the internet, and use a local address on an internal LAN protected by a firewall or router.

If staff need to print from home, require a VPN rather than opening a port. Michigan Engineering's guidance recommends requiring VPN access for remote printing instead of exposing the printer directly.

Check your router and firewall for old port-forwarding rules that point at a printer. They are easy to forget and easy to find.

3. Segment the network

A printer should not share a flat network with your file server, accounting workstations and production equipment. HP recommends a dedicated VLAN and firewall restrictions for printer traffic.

The rule set is short:

Workstations may send print jobs to the printer on the ports it needs.
Print servers and administrators may reach the management interface.
The printer may talk out only to the services it needs, such as your mail relay, directory or update server.
Nothing else gets in or out.

If you have not segmented before, our guide to network segmentation basics walks through how to separate device types without breaking day-to-day work.

4. Change defaults and lock down administration

This is the highest-value step. Do all of these:

Set a unique administrator password on every device. Never reuse your domain admin password.
Change SNMP community strings from the defaults. Where SNMP is required, Duke recommends SNMPv3 and changing default community strings.
Manage over HTTPS, not HTTP. If HTTP is not needed, Michigan Engineering advises disabling plain HTTP and keeping HTTPS.
Protect the front panel. Duke also recommends restricting configuration menus with a PIN, password or passphrase.
Review directory and email accounts stored on the device. Use a dedicated, least-privilege service account, never a domain admin.

Some industrial printers add a protected mode. Zebra's CISA advisory explains that on Link-OS 6.0 and later, protected mode blocks unauthorized configuration changes once an administrator sets a password and activates it. Check whether your devices have a similar feature.

5. Turn off what you do not use

Every enabled service is something to patch and defend. UT Austin lists Telnet, unused SNMP, FTP, SMB, LPD, IPP, SMTP, AppleTalk and IPX as candidates to disable, with a caution that port 9100 is used by many printing services and may be needed.

A simple way to decide:

Service	Typical decision
Telnet, FTP	Disable. Older, unencrypted management and transfer methods.
AppleTalk, IPX	Disable unless you run legacy equipment that needs them.
HTTP admin	Disable and keep HTTPS only.
SNMP	Disable if unused. If needed, use SNMPv3 with non-default strings.
SMB, LPD, IPP	Keep only the one your print setup actually uses.
Port 9100	Keep only if your print path requires it, and restrict by source address.

Kyocera recommends determining appropriate settings for your specific environment before changing anything, then disabling unnecessary protocols. Document which protocol each printer uses before you switch anything off.

6. Secure the wireless side

If a printer connects over Wi-Fi, it inherits the strength of that network. HP recommends strong, encrypted Wi-Fi, preferably WPA3 where available, with complex network credentials. Put wireless printers on the same restricted segment as wired ones, and keep guest Wi-Fi away from them. Our article on Wi-Fi controls small businesses skip covers the network side in more detail.

7. Patch firmware under change control

Printer firmware gets security fixes like any other software. UT Austin's guidance is to apply patched firmware expediently, under change control, and use automated patch notifications if available.

A workable routine for a small business:

Subscribe to security notices from each printer manufacturer you use.
Record the current firmware version in your inventory.
When a security update appears, test it on one device, then roll it out to the rest.
Record the date and the version.

Before a new device goes live, UT Austin recommends protecting it from hostile traffic until its operating system is installed and hardened. Configure it on an isolated segment first, then move it into production.

8. Protect print jobs and stored data

Printing moves protected information onto paper and onto the device's own drive. CISA's guide on printing while working remotely points to a governance problem beyond hacking: printed material moves protected information to places where enterprise controls may be weaker.

The controls that matter:

Secure print release. Jobs wait on the device or server until the user authenticates, so a payroll run does not sit in the tray.
Encryption in transit. HP recommends encrypting data sent over the network and requiring authentication for printer functions.
Encrypted internal storage. NC State's standard says to enable it where available. If it is not, disable caching and avoid sending highly sensitive data to that device.
Spool and temporary data. UT Austin's checklist includes securely removing spooled and temporary data from the device.

For dental offices, law firms and financial firms, that last group matters most, because client records are the documents most likely to be stored on the machine.

9. Log, review and verify

Turn on logging and review it routinely. UT Austin also advises following your data-retention policy for those logs. HP's guidance adds audit trails to monitor printing activity. Look for failed logins, configuration changes, unexpected firmware changes and unusual job volumes.

Then prove the hardening worked. After you finish, scan each printer. Michigan Engineering suggests using a tool such as Nmap to confirm only known, needed ports are open. If a port you disabled still answers, fix it before moving on.

10. Watch the print server too

If Windows hosts handle your print queues, the Print Spooler service is part of the attack surface. After the PrintNightmare vulnerabilities, CISA's 2021 emergency directive required federal agencies to disable Print Spooler on domain controllers and to disable it or restrict Point and Print on other Windows hosts. The directive is now closed, but the principle holds for any business: turn off Print Spooler on servers that do not print, and restrict driver installation on the rest.

11. Retire printers safely

A printer leaving your building takes its drive with it. UT Austin's checklist says to ensure sensitive data is disposed of when the device reaches end of life. In practice:

Use the manufacturer's secure erase function, or remove and destroy the drive.
Clear stored address books, email credentials and network settings.
Remove the device from your inventory, DNS and firewall rules.
If it is a leased device, get the return terms in writing and confirm how the drive is handled.

A practical order of work

If the list feels long, start here:

Build the inventory and find any printer reachable from the internet.
Change default admin passwords and SNMP strings.
Move printers to a dedicated VLAN with firewall rules.
Disable Telnet, FTP, HTTP admin and anything else unused.
Update firmware and set a patch routine.
Turn on secure print release and storage encryption.
Enable logging, then scan to verify.

For a handful of printers, that is an afternoon. For several sites or a production floor, it is a project that needs a documented standard so the next printer you buy gets the same treatment.

What we see and what we recommend

We treat printers as part of the infrastructure we manage, not as office furniture. They sit on the same network as your servers and your data, so they get the same ownership: inventory, monitoring, patching and documented settings.

The failure we see most often is simple. Nobody owns the printers. They were set up once, the default password was never changed, and no one has looked at the firmware since. A fixed standard applied to every device is what closes that gap, and it is why we run one standardized stack for every client instead of a menu of tiers.

For manufacturers, lawyers, dentists and financial firms in Wisconsin, the question is not whether a printer matters. It is whether you can show an auditor or a client that you know what is on your network and how it is configured. Documented printer settings are a small piece of that evidence.

If you want a second set of eyes, start with an assessment. It shows you where printers, Wi-Fi, remote access and identity stand today, so you fix the real exposures first.

Dustin Collett

Get your printers and network assessed

Printers are one device class on a network that also includes routers, Wi-Fi, remote access and user accounts. We built the IT & Security Assessment to show where those exposures are across your whole environment, so you can fix them in a sensible order.

If you would rather have someone own this ongoing, our Managed IT Services cover full infrastructure management, 24/7 monitoring, proactive support and security management at a fixed cost per user. You can also see where your company stands in about a minute with the free IT risk score, or read about our wider cybersecurity solutions for business.

FAQ

Is disconnecting a printer from the network the safest option?

A printer connected only by USB has no network exposure, so it removes that risk. For most offices it is not practical, because many people need to print and scan. A hardened network printer on its own segment, with a strong admin password, limited protocols and current firmware, is a realistic standard.

What is the first thing I should change on a printer?

Change the default administrator password. The NSA and CISA advisory flags default credentials on printers and scanners as a way for attackers to move into the wider domain. Next, change SNMP community strings and switch management to HTTPS.

Should I disable port 9100?

Only if nothing in your print path uses it. UT Austin's checklist notes that port 9100 is used by many printing services and may be needed. Restrict it to your print server or the workstations that print, and confirm printing still works after the change.

How often should I update printer firmware?

There is no fixed calendar. UT Austin advises applying patched firmware expediently under change control, so install security updates soon after the manufacturer releases them, test on one device first, and record the version. Subscribing to the manufacturer's security notices tells you when an update exists.

Do small businesses really need to log printer activity?

Yes, because logs are how you notice a problem. Failed logins, configuration changes and odd job volumes show up there. UT Austin's checklist includes enabling logging, reviewing it routinely and following your retention policy.