I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice.
The only problem is that printers are notoriously good at being huge security holes.
The printer is connected to my EAP-TLS network, which allows hosts to talk with one another, provided that they're in that network or connected directly to ethernet. (ie: both my EAP-TLS WiFi and ethernet share the same LAN) It has to be in the same LAN as the other computers so that they can access it. I've succeeded in getting the Brother printer onto the EAP-TLS network, but what steps can I take now to protect myself?
The network is firewalled so that there aren't any open ports accepting connections from the WAN. Any device inside will be able to "speak" with any other device inside. The printer also features Google Cloud Print, though I haven't done anything to configure it yet.
What can I do to further harden and lock down the printer from a networking point of view? I've configured the login password for the printer so that other users of my network won't be able to change things willy-nilly, but login is over HTTP and there's no way to turn that off. If someone has gotten into my EAP-TLS network, generally they should be there, but I greatly fear the security hell that this printer could possibly unleash in my network. What can I do?