HP seeks to secure the printer

HP has announced a new system designed to secure the process of printing documents.

Most enterprises do not consider printers to pose any sort of security threat, but discounting the risks of networked printers is an invitation to disaster, claims HP.

The company contends that groups ranging from US weapon design facilities to primary schools have experienced data breaches as the result of compromised printers.

"Hackers are looking for the weakest link," Gary Lefkowitz, director of HP's Secure Print Advantage programme, said at a meeting with reporters in San Francisco.

"And if you look at a printer, it has an embedded operating system, it has storage, and very few controls."

The printer is attached to the network and can be just as vulnerable as other connected devices, according to HP, and can allow internal and external attackers to steal data.

In order to secure the process of printing sensitive data, HP looked to an unlikely source: the automated teller machine (ATM).

HP's Atalla division has been providing security modules for ATM transactions for more than 30 years which encrypt and decrypt data before it is sent between financial institutions.

HP estimates that it secures roughly 80 per cent of transactions in the US, and its solution for securing printing operates along similar lines.

Secure Print Advantage features a series of devices that encrypt and decrypt data travelling between the workstation and the printer using government-grade FIPS 140-2 Level 4 encryption.

The first step of the process is a module installed in the user's desktop or notebook computer which encrypts the outgoing data and sends it to the Secure Document Server.

The server then scans the document for malware and, if clean, the document is either re-encrypted and delivered to the printer or held for another user to access.

From the Secure Document Server, the document is then passed along to a Secure Printing Module, which decrypts the information and transfers it to the printer.

The printing module can also be equipped with a keypad or card-reader to ensure that documents print only when an authorised user is present rather than sitting in a printer tray out in the open.

HP did not release any pricing information, but admitted that the system will be expensive to begin with.

It is therefore expected to appeal mostly to high security government agencies and law firms, or regulated industries such as financial and medical institutions.

However, HP hopes that the technology will eventually make its way into smaller operations in the same way that other security systems transitioned from high-security networks to consumers and small businesses.

"As little as 15 years ago, none of us knew what a firewall was, and we thought a virus was something that people caught," said Michael Howard, manager of security solutions at HP's Imaging and Printing Group.

"It took some time before people realised the importance of this, and that's where we are today with [printing]."

HP plans to make the Secure Print Advantage system available to the general public by February 2008.