The Quiet Computer by the Window: What Your Office Printer Is Hiding
Photo: hyolee2, CC BY-SA 4.0, via Wikimedia Commons
The office printer is easy to ignore. It sits by the window, holds a tray of paper, and only gets attention when it jams or runs out of toner. But the modern multifunction printer — the MFP — is not really a printer. It is a small computer with a hard drive, a web server, an admin account, and often a direct line into your email system. It scans contracts, stores job history, and remembers email addresses. If nobody owns it, it becomes one of the least managed devices in the building.
You do not need a security consultant and a fortnight of meetings to fix the basics. You need a lunchtime, a cup of tea, and a short checklist. Here is how to spend about 25 minutes making the machine by the window a lot less interesting to anyone who should not be poking around it.
Start with the screen nobody reads
Before you touch any settings, find out what you are dealing with. Note the make, model, and network address. Ask who installed it, who supports it, and whether it is owned or leased. If it is leased, check what the contract says about firmware and admin access — you may not be allowed to change everything, but you can still ask the provider to do it.
Look at the touchscreen. Is there an admin login? Is it still on the factory default? Many small offices never change it because the installer set it up and nobody wrote anything down. That is the first thing to fix.
Default logins and the admin password
Search the manual or the manufacturer's website for the default admin credentials. If the device still accepts them, change the password immediately. Use a long, unique password stored in your password manager — not the office Wi-Fi password, not the postcode, and definitely not 1234.
While you are in the admin menu, turn off remote administration from outside the office unless you genuinely need it. Disable unused protocols such as Telnet, FTP, and any old-style web services. If the printer has a cloud service nobody uses, switch it off. Every extra door is another thing to remember to lock.
Firmware: the update you never see
Printers run software, and software needs updates. An old firmware version can leave known holes open, and the device may sit on your network for years without anyone noticing. Check the manufacturer's support page for the current firmware and compare it with what the printer reports.
If the printer supports automatic updates, turn them on and schedule reboots for outside office hours. If it does not, put a reminder in the calendar to check every quarter. Also check whether the model is still supported. If it reached end-of-life years ago, start planning a replacement rather than pretending it is fine.
Stored jobs, address books, and scan-to-email
This is where the printer stops being a printer and starts being a filing cabinet. Clear stored print jobs, scan histories, and any mailbox features. Set jobs to delete automatically after a short period rather than sitting there indefinitely.
Then look at scan-to-email. Which account does it use to send? If it is the managing director's mailbox, a compromised printer could send email as them. Create a dedicated account with a sensible name, limited permissions, and its own password. Review the address book and remove old contacts, personal addresses, and anything that should not be there.
Check whether the printer allows scanning to any email address or only to approved domains. If you do not need open scanning, restrict it. It is a small change that makes the device far less useful to someone trying to exfiltrate documents.
Should the printer be on its own network?
Ideally, yes. Put printers on a separate network segment or VLAN from payroll, finance, and the main file server. That way, if the printer is compromised, it cannot freely reach the rest of the office. You do not need a data centre to do this — a decent business router or a managed switch can handle it.
If segmentation is not realistic this month, do the next best thing. Restrict who can reach the printer's admin page, keep it off the guest Wi-Fi, and make sure it is not exposed to the internet. A printer should not be reachable from outside the office just because it has a web interface.
A simple owner and a short routine
Security works better when someone owns it. Give the printer a named owner — often the office manager or the person who already deals with supplies. Put the model, network address, admin password location, and support contact in your asset register.
Then set a light routine: a five-minute monthly check of stored jobs and error messages, a quarterly firmware and password review, and a proper wipe before the device is returned, sold, or scrapped. If you use a managed print provider, ask them to confirm these checks in writing.
The printer will never be the most exciting item on your IT list. But it stores documents, sends email, and sits on your network. Treat it like the computer it is, and it stops being an unmanaged machine with a paper tray.
