Avoid data loss with secure print release / Find-Me printing
Stop a shared printer being your next data leak or potential compliance risk by introducing a secure hold-and-release queue.
“Pull printing,” “push printing,” — whatever name you may have heard before, Find-Me printing is one of the coolest advancements that PaperCut brings to your printing environment.
It’s like making every shared printer your own personal printer without “old clunky"sitting next to your desk, taking up valuable family photo space.
In a perfect business world (we can dream right), we’d be efficient and security conscious at all times — but often our processes, technology, or people can play a part in losing data, often without knowing.
In the printing space, simple data loss prevention/control is available to avoid misuse of printed material. Think about it; a lonely unloved document sitting on a printer is not owned. There’s a much lower barrier to taking a document from a printer than someone else’s desk.
Using PaperCut’s popular Secure Print Release feature, you can stop jobs printing on an unattended printer by making sure that the user standing in front of the printer is the owner of those jobs. No more stretching to make the 100-yard dash before prying eyes see your salary review or dumpling recipe.
Secure Print Release prevents data loss using a central hold-and-release queue. It’s one of our most popular print management features.
Use the table below to identify opportunities to improve your print security. We recommend the foundational set as a baseline for all organizations.
Foundational (the must-have features)
|Secure print release||User must prove their identity at a printer before their job is released.||PaperCut MF PaperCut NG (with release station) PaperCut Pocket (with list mode disabled) PaperCut Hive|
|Print logging||Get visibility into what is being printed where and by who.||PaperCut MF PaperCut NG PaperCut Pocket PaperCut Hive|
|ID or password authentication||Basic authentication options at an MFD||PaperCut MF PaperCut Pocket PaperCut Hive|
|Culture change||Not a feature, but an essential component for success. Read more.||All|
|Find-Me printing||Print to a “virtual printer” and retrieve your print job at any device.||PaperCut MF PaperCut Pocket PaperCut Hive|
|Card or biometric-based authentication||Use your door access card to authenticate yourself at the printer. Users can self associate their card to minimize IT overhead.||PaperCut MF|
|Two factor authentication||Increase security by requiring a second authentication method, such as a PIN.||PaperCut MF|
|Blocking releasing to a printer that is in error||If a printer is out of paper at release time, there is a danger that a secure job might come out later after adding paper into the tray. This feature ensures that won’t happen!||PaperCut MF PaperCut Pocket PaperCut Hive|
|Delegated printing||Sometimes you need a teacher to release jobs on behalf of students, or an assistant to release jobs for an executive. Either way, delegated printing is the feature you need.||PaperCut MF PaperCut NG|
Real world examples
There are hundreds of tops that have to do with print control. We have taken the best practices out of key industries to give you some.
Exams are a stressful time for students, and teachers aren’t immune either. Preparing exam questions and making sure they stay top secret until the test is administered takes a lot of time and effort. PaperCut can’t help draft the exams, but when they’re being printed we sure can help keep them safely away from the eyes of desperate students.
An international school had exam venues spread across four buildings, and teachers used to struggle with getting access to the printer closest to their exam room. Sometimes they had to run the risk of printing, securing, and transporting exam papers ahead of time. After implementing PaperCut’s Find-Me printing and secure print release, it was easy for any teacher to print to any printer, no matter where their exam room was, with confidence that the sought-after papers wouldn’t print until they were standing at the device ready to scoop them up.
Classrooms can feel out of control sometimes, and having students running back and forth to a printer and squabbling over printing is just one more distraction. At “Some School”, junior year teachers had one less distraction to manage when the school configured print delegation. Now, when the students printed their assignments during class, only the teacher could release the print jobs when they were ready to collect them before the bell rang.
Like many large specialist diagnostic clinics, a medical imaging center had most of its doctors and technicians working as subcontractors. Specialist skills are always in demand, and staff turnover was high. This made it difficult to comply with the strict HIPAA standards protecting PHI in printed documents.
Using PaperCut, the clinic was able to integrate the user identities from their security access card database so staff could securely release print jobs using their door swipe cards. This helped streamline staff onboarding and minimized mistakes. Combined with audit logging, secure print release and user watermarking, it was easy for IT staff to stay on top of the huge amount of PHI moving through the clinic and trace any potential privacy breaches.
The clinic was also able to replace most of the small desktop printers in labs and consulting rooms with two large MFDs with secure release, reducing the risk of protected health information (PHI) being left in output trays by busy people.
They also started using delegated release, so nurses could release print jobs on behalf of doctors at a central MFD, making it easier for them to collect and file patient records securely.
Making print release and print auditing easier, means it’s easier for users to stay compliant and avoid data breaches caused by human error and simple mistakes.
PaperCut makes it easy to leverage your existing investment in building security to deliver print security. An insurance company had installed slick new security doors and proximity card systems as part of their head office tower fitout five years ago. Dealing with huge amounts of sensitive information about their customers, it was important to compartmentalize access between underwriters, claim agents, call centers, and administrative teams throughout the building.
Now a print fleet refresh was driving device consolidation, with each floor getting two new large MFDs to replace all the smaller desktop printers.
This was a perfect opportunity for print security to meet and exceed the already high standard set by building security. By integrating PaperCut with the building’s security card system database, staff could use their existing door cards to authenticate and release print jobs at the new MFDs. Going one step further, the company enabled 2-factor authentication in PaperCut, so users could only access the MFDs with their building door card and an individual PIN.
The transition was almost seamless in an organization with a strong security culture, with staff making the small step from the card-based building security to card-based print security almost overnight. It helped that the same support process for lost/damaged cards continued to be handled by the same security helpdesk in the lobby.
Resources are shared wherever possible in a growing law firm, and one paralegal supports every three junior partners. Before implementing delegated print release, all the partners printed directly to shared MFDs, and the poor paralegals had no end of bottlenecks and headaches trying to sort through stacks of documents to pick out the right ones for their partners.
Now, all jobs are securely released only when the paralegal is at the printer, and they only get jobs for their three partners. The collective sigh of relief was audible three floors down.
What’s better than making things secure? Saving the world!
Not only are Find-Me print and Secure Print Release the best features for security, they’re also the best features for minimizing environmental impact. A lot of users will see the security benefits of secure print release but might be put off by the extra authentication step. Mixing this with a positive environmental message creates a compelling reason for everyone to get behind the initiative.
The key to Secure Print Release is in the name — secure. The authentication at the device is the critical step here, to ensure the system knows the user is genuinely at the device and to release only the documents that the user has selected via the screen. The user now controls what is released and when… the when being while they’re standing there.
The method of authentication, too, is an important security step. Give everyone a one-number ID number… easily guessable and far from secure! But request their network username and password, or require a card and PIN — then you know that person at the MFD is who they claim to be! Like all things around security, the right level is a balance-call that will differ from organization to organization.
We log in code to make sure problems can be identified, analyzed, and resolved. Think about any security issue in your organization and think about where you’d be without logs.
Printing security breaches are no different. And it’s not just the ability to prove there has been an issue, but also the ability to prove there hasn’t! Suspicions are easily proved or disproved when you can access a detailed log of precisely what has happened in a system. We associate all jobs to an originating owner, document name, date, time, pages, breakdown of pages, device, and for extra points, the optional archiving of a job in both its original form and viewable image.
Reading any more than one page on our site and you’ll encounter Find-Me print a number of times. The value of this feature spans usability, cost savings, time savings, and much more.
In the context of security, Find-Me printing is an overlay that sits on top of Secure Print Release but makes the Secure Print Release solution something users are more than happy to adopt because of the notable improvement in the usability of the printing fleet. Find-Me printing makes the security win a clear usability win, too!
Losing a bank or credit card used to be an inconvenience and frustration, but it was rare it would result in theft from your bank account. A bank card without a PIN was a piece of plastic. Now with pay wave, that risk is back!
But, not in PaperCut. You have the option to enforce two-factor authentication for card and ID-based authentication. A card or ID number without the associated PIN is going to get you nowhere!
Since a card can access a user’s print jobs, we’ve also provided several methods to match cards to users. Self-association allows users to link their card to their PaperCut account, giving them the ability to self-authenticate at the MFD. We do this by matching their network credentials to their card. If you have an external user database, we’ve also got you covered by using an external card number lookup.
We’ve all seen someone frantically opening and shutting the trays of an MFD, squirreling around the sides of the device and searching any cupboard nearby for paper — all because they’ve released a job to a printer that was out of paper. Their ‘sensitive’ document is going to print out the second someone puts paper in that MFD, so they’re desperate to be the one to load those sheets!
Hidden document names in print queues
This problem has been around since Methuselah was a rookie — when you share a print queue, you can see what’s passing through that print queue. The keen eye watching a shared queue can see the document name of their colleagues, and if you’re printing a CV or resignation letter, this is office gossip gold (but who does that :-))
Holding jobs in a print queue exacerbates this problem unless you use PaperCut’s ability to hide document names for jobs that sit on a queue. This only hides them from the eye on the queue, not from our detailed logs. So the prying eye sees nothing, but the administrator still retains key information.
There are always users in your organization who will be an ‘exception to the rule’ and make the request to not have to release their jobs. It could be a partner in a law firm. It could be someone with limited mobility or vision that needs assistance to release their jobs. The solution to the rule exception should not be the absence of security — that is, not the immediate release of all jobs.
Delegated printing allows a relationship to be created within the software to ensure one user has the ability to release the jobs on behalf of another, and this feature is again, included in PaperCut.
You might like to: