Windows Protected Print (WPP)

Windows Protected Print (WPP) is Microsoft’s print security framework, and Cirros has integrated it into its cloud solution so that organisations can print without legacy print spoolers or third-party print drivers.

What WPP is

WPP is a modern print security framework from Microsoft. It addresses long-standing weaknesses in traditional print architectures, which often rely on print spoolers, third-party drivers and high-privilege execution. Each of these is a potential route for cyber threats.

Security flaws such as the PrintNightmare vulnerability showed the risks of elevated permissions in print services, including unauthorised access, privilege escalation and system-wide exploits.

WPP is a secure, driverless printing approach built on the Internet Printing Protocol (IPP). It removes the need for vendor-specific print drivers and significantly reduces the attack surface. It also simplifies print deployment and management.

Why it matters

Traditional print drivers:

• cause incompatibility between different printer models
• need frequent updates and patches, which adds administrative overhead
• carry security risks, because outdated drivers can be exploited for remote code execution attacks

Driverless printing over IPP lets organisations:

• deploy printers without vendor-specific drivers
• reduce the attack surface by removing privileged print spooler processes
• get a consistent printing experience across different operating system environments

How Cirros supports WPP

Cirros has integrated WPP into its cloud architecture. This lets organisations remove legacy print spoolers, drop third-party drivers and enforce Zero Trust security policies.

How a print job travels

1. Submit. A user sends a print job from a workstation, virtual desktop or mobile device. The job is not stored in a local print spooler. It is encrypted and sent securely over the network.
2. Hold. The job waits in an encrypted print queue that only the authenticated user can access.
3. Verify. Before release, the user must prove who they are with multi-factor authentication (MFA), a smart card or a PIN code.
4. Release. The job goes straight to the printer using IPP, which provides secure, encrypted communication between the client device and the printer.

IPP is natively supported in modern operating systems, so no third-party print drivers are needed. That reduces the attack surface of legacy print architectures.

Encryption and storage

Cirros encrypts print jobs from submission to release:

• In transit. TLS 1.2/1.3 encryption prevents eavesdropping and unauthorised interception.
• At rest. Stored print jobs are encrypted with AES-256, which helps protect their contents if storage is ever compromised.
• Zero-knowledge storage. Cirros uses a zero-knowledge storage model, so print job contents are never visible to the cloud storage system. Only the authorised user with the correct decryption key can release and access the document.

Access controls and monitoring

Cirros uses role-based and policy-driven controls that let organisations define who can print, where, and under what conditions.

• Role-based access control (RBAC). Administrators can assign print permissions by job function, department or security clearance level.
• Time-limited and location-based printing. Organisations can use geofencing policies to restrict print job release to approved network locations.
• Audit logging and SIEM integration. Every print job action is logged in an audit trail, which gives real-time visibility and supports forensic investigation.

Cirros also hardens the print environment with Zero Trust policies and continuous security monitoring:

• Print spooler isolation. Print processes run with minimal system privileges, which helps prevent exploitation.
• Regular security updates and patching. Cirros’ patch management framework deploys security updates for print services automatically, without administrative intervention.
• Threat detection. Security logs are monitored continuously with SIEM tools such as Splunk (optional) and Azure Sentinel, to detect unauthorised print attempts or unusual print job behaviour.

What it means for you

• Less to install and maintain. There are no vendor-specific print drivers to deploy, update or patch.
• Sign-in before release. Users authenticate before their jobs are released, so only authorised people can retrieve sensitive documents.
• Control over who prints. Your administrators decide who can print, where, and under what conditions.
• A consistent experience. Printing works the same way across different operating system environments.

Cirros’ WPP-based architecture is designed for government agencies, enterprises and regulated industries. Its access controls are intended to support data protection requirements such as GDPR and ISO 27001.