Patrick is assessing an organization and finds that they have numerous multifunction printers (MFPs) that are accessible from the public Internet. What is the most critical security problem he should detect?

In this scenario, Patrick should identify the use of the printers for further attacks against the organization as the most critical risk. Use as part of a distributed denial-of-service (DDoS) attack does not directly impact the organization in most cases, exhausting supplies would be an annoyance, and the risk of scanning documents from a remote location requires sensitive documents to be left in the MFPs. Patrick should note that all of these issues could be problems and move the MFPs to a protected network so that third parties can’t access them. The scanners may be accessed to allow attackers to scan documents that are left in them.