How to secure your network printer from ransomware

Summary

This guide helps you troubleshoot and resolve: How to secure your network printer from ransomware. Follow the steps below to fix the issue.

Common Causes

Network printers are common targets for ransomware because they often sit on the network with weak security settings and rarely receive regular updates. If compromised, a printer can act as an entry point for attackers to spread malware across your business network. This guide explains how to secure your network printer and reduce the risk of ransomware infection.

Quick Fix Steps

1. Change the printer's default administrator password immediately.
2. Disable unused services such as FTP, Telnet, and raw printing ports.
3. Ensure the printer firmware is up to date.
4. Place the printer on a separate VLAN or guest network where possible.
5. Restrict access to the printer's web interface to trusted IP addresses only.

Detailed Instructions

Change the Default Administrator Password

Most network printers ship with a default username and password that are widely known. Ransomware and other malware often scan for devices still using these credentials.

1. Find the printer's IP address by printing a network configuration page from the printer's control panel.
2. Enter the IP address into the address bar of a web browser on a computer connected to the same network.
3. Log in using the default credentials (check the printer manual or a sticker on the device if you have not changed them).
4. Navigate to Administration, Security, or Settings, depending on your printer model.
5. Select Change Password or Administrator Password.
6. Enter a strong, unique password and save the changes.

Update the Printer Firmware

Printer manufacturers release firmware updates to patch security vulnerabilities that could be exploited by ransomware.

1. Log in to the printer's web interface using its IP address.
2. Go to Tools, Maintenance, or Device Settings.
3. Look for Firmware Update, Update, or Check for Updates.
4. If an update is available, download and install it following the on-screen prompts.
5. Do not turn off the printer during the update process.

Disable Unused Network Services and Ports

Every open service on a printer is a potential entry point for ransomware. Turn off anything you do not actively use.

1. Access the printer's web interface.
2. Navigate to Network Settings, TCP/IP Settings, or Services.
3. Disable the following if they are not required:
4. • FTP
   • Telnet
   • SNMP (unless used by your IT provider for monitoring)
   • Raw port printing (port 9100) if you only use secure print queues
   • Web Services on Devices (WSD) if not needed
5. Save your changes and restart the printer if prompted.

Segment the Printer on Your Network

Isolating your printer from general workstations limits the spread of ransomware if the printer is compromised.

1. Log in to your business router or firewall administration page.
2. Create a separate VLAN or network segment for printers and IoT devices.
3. Assign the printer a static IP address within that segment.
4. Configure firewall rules to allow print traffic only from your print server or specific workstations.
5. Block access to the printer's web interface from all devices except your IT administrator's computer.

Enable Secure Printing and Access Controls

Secure printing requires users to authenticate at the device before a job is released, reducing unauthorised access to sensitive documents.

1. In the printer's web interface, go to Security or Access Control.
2. Enable Secure Print, PIN Printing, or User Authentication.
3. Require a PIN or ID card swipe at the printer's control panel before jobs print.
4. Limit administrator access to specific MAC addresses or IP addresses where supported.

Troubleshooting

I cannot access the printer's web interface

• Confirm your computer is on the same network subnet as the printer.
• Try entering http://[printer-ip-address] in your browser. Some printers require https://.
• Temporarily disable firewall software on your test computer to rule out local blocking.
• If you recently changed the printer's IP address, print a new network configuration page to confirm the current address.

Firmware update fails

• Ensure the printer has a stable network connection during the update.
• Download the firmware file directly from the manufacturer's support website and use the manual upload option if automatic checking fails.
• Do not interrupt the update. If the printer becomes unresponsive, consult the manufacturer's recovery instructions.

Printing stops after securing the printer

• If you disabled raw port printing or WSD, update the printer port settings on your workstations to use the correct protocol.
• On Windows, go to Settings > Bluetooth & devices > Printers & scanners, select your printer, and choose Printer properties > Ports to verify the correct port is selected.
• On macOS, go to System Settings > Printers & Scanners, select the printer, and click Options & Supplies to check the connection settings.

If you need assistance securing your office printers or suspect a security incident, Open a Ticket.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

For related guidance, see our article on Printer not printing / offline.

Still Having Issues?