The new General Data Protection Regulations (GDPR) in the EU highlight the responsibilities all organisations have to protect customer data. In the EU, penalties for leakage of personal data are increasing a hundredfold and other jurisdictions are likely to follow suit.
The printed document is the oldest source of data leaks, and protection of printed output remains an important issue to this day. The first line of defence is to prevent unwanted copies of a document being printed and PaperCut MF’s find-me printing does that very well. But once printed, a paper document left behind in the cafe or on a train seat is typically anonymous, making it impossible to determine when and by whom it was printed. PaperCut NG and MF also provide innovative solutions to this problem – but more about that later.
At PaperCut, we’ve been tackling print security for a long time. Our original hackers were armies of school and university students looking for a way to get a free print or copy. And you wouldn’t believe the things that a motivated student will try!
Behind the scenes at PaperCut, we have been making changes to better equip ourselves for a security conscious world. Recently we established our own Security Response Team (SRT), which formally brings together our company’s top security talent to raise the bar on how we do security. The responsibilities of the SRT include giving the existing application and all new features a thorough security review. When customers report a potential security issue, the SRT is standing by – ready to investigate and quickly fix any nasty reported vulnerabilities.
In more recent years, PaperCut NG and MF are regularly subjected to customer sponsored penetration tests that pound the software from all angles looking for vulnerabilities. If you do run a penetration test and find something – please report it to us through customer support and they will pass it on to the SRT.
Unfortunately, no amount of pen testing will stop a careless employee leaving a sensitive document behind on the train seat. A purely digital solution won’t work in this case. What we need is a way to strongly influence user behavior.
Perhaps a confidential document policy and user education will do the trick? That could be part of a solution, but in practice, policies are not sufficient on their own. But a clear policy coupled with security features in PaperCut NG and MF make for a very strong combination.
Way back in 2010 (release 10.5), we introduced the ability to add a watermark to every printed page. This watermark may contain the user name and date of printing – or even more powerful – a digital signature. A digital signature can be used to uniquely trace any printed page to the exact entry in the job log for that printed document, giving the time of printing, the printer used and the person who printed the document. This sends a powerful message to users that they remain accountable for every page they print.
Perhaps PaperCut was ahead of its time, because for a number of years watermarking has been considered a minor feature – almost forgotten. But In 2017 its time has come. To celebrate, we’ve made it more powerful by adding full page watermarking. This feature, was for us a cool technical challenge to implement and for you, ensures that the watermark cannot be intentionally clipped off the page. Of course you don’t want the full page watermark on every printed document, so it’s good to know you can automatically turn on and off a watermark using a print script to set the watermark text.
There is plenty more to say in the realm of print security, as there are security questions to answer right from the time a user presses Ctrl-P to toner being laid down on the paper and beyond. To help people answer these questions, we recently put out a whitepaper covering end-to-end print security best practices. If print security is your concern, please check it out here – “Securing your Print System”.
About The Author:
Geoff Smith leads the development and product teams at PaperCut Software. He came to PaperCut four years ago after holding roles as software developer architect and project manager at HP and Agilent Technologies. Geoff is a member of PaperCut’s Leadership Team and has overseen the rapid growth in our development capability. Outside PaperCut, Geoff is a keen dinghy sailor and likes to spend his Saturday afternoons at the helm of a small boat.
Posted in General, print security |
Leave a comment
With a number of small, yet impactful enhancements, this release focuses on limiting security risks that can occur during printing, increasing accountability of printed output, and making print management that much smarter.
For years, PaperCut has recognised the importance in providing a secure print environment. But the more important thing to realise is that this security goes beyond the printer. With 17.1, we’ve extended this security with further enhancements to watermarking and digital signatures, ensuring the security of your document is managed for the entire lifecycle of the document, not just until it is printed.
PaperCut NG and PaperCut MF’s HTTP security has had a caffeine boost with HTTP Strict Transport Security (HSTS) and stricter cookie settings. A level up from the current SSL, 17.1 makes it easier to implement higher system security with permanent browser encryption with a simple check box.
The success of PaperCut’s Mobility Print is continuing to grow, with a number of enhancements rolling out automatically. Our latest Mobile and BYOD solution now provides even more security and support for shared devices with optional user authentication for each print job and restricted printer access through subnet filtering.
But PaperCut is not only about security. We certainly pride ourselves on being an easy and user-friendly solution and continue to improve our usability every release. 17.1 is also jam packed with improvements to Web Print, simplified Secure Print / Find Me configuration, Integrated Scanning for Ricoh SDK/J devices, new device support for HP and Xerox and improved workflow on and Kyocera.
Full page Watermarking to increase print security
Protecting your digital environment does not stop once a document has been printed. Secure Print Release protects the document until time of release, and while regulations and policies can be put in place, steps to change user behaviour beyond the printer need to be considered as well. This is where watermarking and digital signatures can be valuable, as they help protect the life of the document after it has been printed.
Stemming from consultations and requests from a number or government customers, in this release we’ve made enhancements to our existing watermark and digital signature feature by including Full Page Watermarking, helping organization push the value of digital signatures to the limit.
Watermarking and digital signatures provide accountability and traceability to printed documents to avoid accidental or deliberate breach of sensitive data after a document has been printed. It has been proven to be an effective mechanism to change user behaviour by reminding them to be careful when leaving sensitive documents lying around.
Watermarking options in Version 17.1
For more on PaperCut’s watermarking and digital signatures, visit https://www.papercut.com/tour/watermark/.
Web security enhancements put PaperCut security at an all time high
PaperCut has always kept a close eye on digital security and consistently ensure we keep in line with best practices, even setting new benchmarks for security in print management. The days are numbered where it is up to an organisation to choose whether they’ll secure their environment. In 2018, European organisations could face fines up to €20m or 4% of their global turnover in the event of a data breach as part of the General Data Protection Regulation (GDPR). In the US, all government organisations are enforced to follow strict security guidelines, including the use of HTTP Strict Transport Security (HSTS).
This release also offers stricter cookie security with HTTP Only and the option to force all cookies to HTTPS with a “secure” flag.
Find out more in our web server security settings knowledge base article.
Reduce Web Print server bottlenecks when printing multiple copies
Our latest Web Print server update changes the behavior of third party application requests for multiple copies of a single job. All copies will now be printed as a single job, improving system performance and user experience.
For SysAdmins and IT Managers, this reduces the load on the Application and Web Print servers with fewer spool file creation and network traffic. For end users, it means less wait time when releasing a job and minimises confusion by only presenting one print job at the release station.
Check out PaperCut’s Web Print Tour page for more information.
Added security for shared devices through enhanced Mobility Print user authentication
To help provide extra security on shared devices Mobility Print now enables optional forcement of authentication for every job printed no matter the user or device. When Mobility Print was released as part of 17.0, the default option was to authenticate “per device”, which meant the user’s details were remembered for the device they were printing from. We have recently added a second authentication option, which is “per job” authentication, which means user details will need to be re-entered for each print job, when printed to a printer which has this option turned on.
This new option gives SysAdmins the ability to enforce this higher security authentication mode on a per printer basis, so it can be set just for those printers available on a shared device, such as tablets or iPads. It will also ensure the correct users are being associated to their jobs, even if a user accidentally stays logged in on a shared device.
Note: This feature is not supported on Windows devices.
Find out more on PaperCut’s Mobility Print blog or the Mobility Print Help Centre.
Restrict printer access through Mobility Print based on subnets
Eliminate any potential confusion and make it easier for users to select the most appropriate printer for them through subnet filtering.
By restricting access to printers for specified users and groups, or across multiple sites and locations, only the printers available on the specified subnet will be shown.
Detailed instructions have been included in the Mobility Print Help Centre to assist with configuring subnet filters.
Mobility Print is now supported by offline Site Servers
The simplicity and versatility of Mobility Print is now supported with the seamless failover of Site Servers. Not only can users have choice and freedom to print from whatever device is at their disposal, SysAdmins can have the confidence that their Mobility Print network will be always available when using Site Servers.
Extending the integration between online Site Servers and Mobility Print, offline mode support has been added to provide networks utilising Mobility Print the continuous availability of printing resources that Site Servers provide.
For more on PaperCut’s Site Server have a look at the Tour page or the Mobility Print Help Centre.
Industry expert feedback on Security Whitepaper
We’ve received some great feedback regarding our whitepaper: Securing your Print System. Based on industry expert feedback we’ve released an update.
If you haven’t already read it, the paper provides practical and tested advice on how to secure your print system end-to-end from before a print job is printed, through securing the print workflow, to safeguarding your printed documents.
For the latest on PaperCut’s security, check out the PaperCut security knowledge base article.
Improved Secure Print and Find-Me configuration
For PaperCut MF users, we’ve made improvements to Secure Print and Find-Me Printing to decrease configuration time, increase awareness of inaccurate settings and we do this all with full backwards compatibility, no matter how unique your current environment is.
Find out more on PaperCut’s Find-Me Printing and Secure Print Release tour pages.
PaperCut MF with Integrated Scanning on Ricoh SDK/J devices
The PaperCut MF application on Ricoh SDK/J (Java) devices has been RiDP certified and now includes Integrated Scanning.
Now with both Integrated Scanning and a modern, intuitive interface on Ricoh Java devices, PaperCut MF provides a seamless end-user experience at the MFD panel. The new pre-configurable Scan Actions ensure secure document scanning on Ricoh SDK/J devices will effortlessly integrate into existing business processes.
Keep an eye out for Integrated Scanning on Ricoh SOP devices coming soon with PaperCut MF in late 2017.
To find out more on Ricoh, visit the Tour.
PaperCut MF for HP’s new lineup of security-optimized A3 MFPs and card readers
Following the recent launch of HP’s new lineup of multifunction printers with advanced security features, we have been working closely with HP to ensure PaperCut MF provides a secure, consistent user experience. The ease of use of the large touchscreen control panel on the LaserJet Enterprise MFPs complements the quality and seamless experience of PaperCut MF.
PaperCut MF also supports the latest card-readers released by HP, HP Universal USB Proximity Card Reader (Product Number X3D03A) and RF IDeas RDR-805H3AKU. Up to four card types can now be configured in the PaperCut Admin web interface.
We have also begun work on a brand new PaperCut MF build for HP so keep an eye for this to be released later in 2017. Built from the ground up, this release will leverage HP’s OXPd platform to bring all the latest PaperCut MF functionality to HP MFP, including Integrated Scanning.
To find out more about PaperCut MF for HP visit the Tour.
PaperCut MF on the new Xerox VersaLink and AltaLink MFPs
For what was the largest product launch in Xerox history, our focus quickly turned to ensuring PaperCut MF was supported on the latest ConnectKey device range. The versatility and scalability of PaperCut MF complements the Xerox VersaLink (designed for small workgroups and distributed teams) and the Xerox AltaLink series (designed for larger workgroups and print volumes) providing a seamless end-user experience.
Keep an eye out for PaperCut MF with Integrated Scanning on Xerox MFPs coming in late 2017.
Find out more about PaperCut MF for Xerox on the Tour page.
Direct access to PaperCut MF from the native Kyocera interface
We’ve made it easy to navigate back to PaperCut MF from the native device interface. These workflow improvements for Kyocera MFDs avoids the need for users to inconveniently logout and then back in again to access PaperCut MF by presenting an icon taking them back to the PaperCut MF home screen.
Find out more about PaperCut MF for Kyocera on the Tour page.
Want to know more?
To help you digest all the updates, we’ve detailed all features, enhancements and fixes, in the 17.1 Release Notes for PaperCut NG and PaperCut MF.
And of course, the “Fine Print”
If you have a current subscription to Premium Upgrade Assurance, your upgrade to Version 17.0 is already included. Otherwise, one-time upgrades may be purchased via our online order system or through your PaperCut supplier. And hey, added bonus – upgrading now will entitle you to all of the releases in the 17.x series throughout the year!
Posted in Blogroll, General, New & Noteworthy, Releases |