The U.S. Federal Trade Commission doesn't mince words when it comes multifunction printers (MFPs): “Digital copiers are computers,” they say, complete with hard drives, embedded firmware, and the ability to communicate with other network systems. Without the proper security measures in place, MFPs present a significant business risk.
Cybersecurity initiatives have traditionally focused on preventing data breaches, which the Ponemon Institute defines as “an event in which an individual's name plus a medical record, financial record, or debit or credit card information is potentially put at risk,” by securing computer networks and perimeters. However, overlooking or deprioritizing MFPs can be dangerous for several reasons.
MFPs are connected to the corporate network, enabling users to email documents to the MFP for printing or send scanned documents through email. This connection to the network puts MFPs at risk to threats originating on corporate networks and desktops. A huge portion of customer information, including personally identifiable information (PII), continues to be stored in business documents. This means PII is at risk every time electronic files are converted to physical documents through printing, or paper documents are converted to digital versions through scanning.