Tell me about PaperCut's security

A Security White Paper

We have pooled our security knowledge and lessons learnt over the past two decades to bring you a new white paper: Securing your Print System. This paper provides practical and tested advice on how to secure your print system end-to-end, from before a print job is printed, through securing the print workflow, all the way to safeguarding your printed documents. This white paper continues to be improved and expanded upon, drawing from our ongoing research, as well as through feedback sought directly from industry experts.

Code reviews

PaperCut NG and PaperCut MF have been developed from day one with security in mind. With its roots in education and with the full understanding that college kids “like to hack”, our software’s development process has continually focused on security. At the core of this is our open source code-based culture, with large amounts of our source code being made available to customers. The code has been reviewed by leading education organizations, an undertaking which has proven to bear fruit; during one such review in 2008, an independent security expert working for a college discovered an XSRF (Cross-site request forgery) security issue. This issue was fully disclosed and quickly addressed in a subsequent release by the PaperCut development team, accordingly.

Access control

At a software-level, PaperCut NG and PaperCut MF leverage security groups in a directory management system (for example Active Directory, Google Workspace, LDAP or Office 365) for access control. Administrators can be setup with different levels of access. For example, system administrators may have access to all application features, whilst office staff could be limited to running reports and accessing only a subset of all features, such as Shared Account management. PaperCut NG and PaperCut MF use SSL/HTTPS for communication and remote web based administration, ensuring sensitive data like passwords and account information is secured over the network, and session cookies are securely flagged so as to prevent their interception or modification for malign purposes. Internal passwords, if used, are stored in a BCrypt hashed format which is seeded by username and salted with a random salt. All security related development is internally assessed and R&D is conducted to ensure we’re meeting best practice.

3rd party components

PaperCut NG and PaperCut MF also leverage a number of 3rd party components such as the Jetty HTTP Server, Apache Tapestry, Ghost Trap, and the Apache Derby database. PaperCut actively works with the open source community backing these projects and has reported and assisted with bugs and issues found over the years. The security of these 3rd party components is actively monitored, and any resulting security implications relevant to our software are openly addressed. The PaperCut development team has also worked to find security problems within copier/MFP firmware, and has teamed with leading vendors to address these issues as found.

Coding standards

PaperCut NG and PaperCut MF are developed in line with security best practices such as CERT Coding Standards, OWASP Top 10, and Oracle Java Security Guidelines. A number of our larger university customers have also had our applications subjected to full PCI Security Audits prior to deployment for handling online payments.

Security Response and compliance

Our Security Response Team regularly reviews prospective and emerging security threats, and proactively works to add new (and harden existing) security features in line with best practice. Examples include:

• Support for HTTP Strict Transport Security (HSTS) - delivered in PaperCut NG and MF version 17.1, in accordance with Memorandum M-15-13. M-15–13 dictates that publically facing United States federal websites and web services must enforce secure connections over HTTPS, with HSTS included as a key requirement, so this addition has allowed US government bodies to run PaperCut NG or PaperCut MF and remain legally compliant.
• PaperCut NG and MF 17.2 introduces functionality to summarise and export all stored data concerning individual user accounts, as well as fully redact that data, enabling compliance with the General Data Protection Regulation (GDPR) to be enforced within the EU from mid-2018. Not only does this bolster our information privacy offering, it also can help to minimise the potential magnitude and severity of data leaks in the event your environment is compromised. Data protection is also facilitated by our document watermarking feature, which can be used to inject a cryptographically generated unique digital signature into each printed page. This allows physical printing in highly secure environments to be traceable from the paper product back to the originating user and printer, rendering the direct dissemination of confidential information a much more difficult proposition.
• Fixing Spring4Shell and Log4Shell vulnerabilities in versions 21.2.10 and later, and addressing security patching issues known as PrintNightmareCVE2021 in 2021.

Other initiatives have included the Ghost Trap project; a best practice security related project instigated by PaperCut. The aim is to bring best-of-breed security to the open source Ghostscript interpreter by sandboxing it, utilising similar technology to that as featured in Google’s Chrome web browser.

See also

• PaperCut Security Whitepaper
• Security vulnerability information and common security questions
• Security Settings for PaperCut’s Web Server
• The Security and Privacy category for other print and system security articles.
• PCI Compliance for PaperCut MF/NG