Driving a Hard Bargain

Throughout the last several years, an increasing number of security issues surrounding data left on computers and servers that were sold into the secondary market has received wide media coverage.

For instance, one of the United States Veterans Administration medical centers donated and sold retired computers complete with hard drives full of sensitive medical and financial information, including the records of patients with AIDS and government credit card numbers.

Additionally, an auditor for the state of Florida found Social Security numbers, security system data and personal information on computers slated for disposal from eight departments within the state. The auditor concluded that the state could face legal exposure in light of improper data security procedures.

Finally, the University of Illinois Medical Center in Chicago threw its outdated computers in a trash bin behind its building. A citizen alerted a local TV station that retrieved the computers and discovered private patient data on the hard drives.

This is just a small sampling of the data breaches that have occurred. Hundreds of data security breaches on retired hard drives have been reported, a number exceeded only by the number of incidents that go unreported or undiscovered. A recent study by the Financial Times found that less than 25 percent of computers disposed of by companies have been properly sanitized of data.

Next to not sanitizing a hard drive at all, simply deleting confidential files is the most insecure form of security. A deleted file is not really gone; only the information that points to the exact location of the file on the hard drive is removed.

Reformatting a drive essentially removes all of the information that points directly to every file’s location, primarily the root directory and the file allocation table. A reformat overwrites less than 0.1 percent of a hard drive…0.1 percent! Virtually all files and data can be recovered using off-the-shelf file recovery software.

Determining the best practice to protect an organization from the inherent data security risks associated with IT asset disposition turns out to be a slightly more complicated task than it seems, because the "best"—that is, the most secure—approaches to data security are generally considered cost prohibitive by most organizations.

On-site total hard drive destruction is the most secure method to prevent potential data security breaches. Of course, the cost of on-site destruction may be prohibitively expensive for organizations that need to have shredding devices at every corporate location, as a reasonable hard drive shredder can run about $5,000.

The drives can be transported to centralized locations equipped with data shredding devices, but hard drive or tape transport is the weak link in the IT asset disposition process, as Time Warner might be quick to verify. The company lost 40 backup tapes while in transit to an off-site data protection and electronic vaulting company’s location.

On-site hard drive sanitization and degaussing ia another part of the data migration and hardware de-installation process. However, most organizations opt to de-install hardware as one process, placing the assets in storage or staging areas prior to sanitation because of potential problems with data migration. This two-step process increases costs substantially.

Hard drives in non-working assets need to be degaussed and cannot be sanitized using software methods. However, equipping each corporate location with a degausser could prove expensive. Deguassers can cost as much as $1,400 each, excluding the cost of labor to operate the equipment.

A safe and affordable approach when decommissioning IT assets is the combination of data encryption and outsourced disposition.

Data encryption makes it virtually impossible to recover information from a hard drive. Encryption involves the use of a key that must be known by the user to access information on a particular hard drive. Some data encryption tools also provide for pre-boot authentication passwords. In short, these tools ensure that data cannot be accessed from retired hard drives except by the most sophisticated methods, like ones employed by high-level law enforcement organizations like the FBI and CIA.

Used in conjunction with data encryption, outsourced IT asset disposition offers the most value to organizations that are focused upon data security and retired IT assets. Because data is encrypted as an enterprise strategy, an outsourced IT asset disposition services provider can perform all the other necessary services to minimize the cost and maximize the financial return from an IT asset disposition program. Data encryption mitigates the data security risk when assets are transported to the IT asset disposition provider and ensures that potential data security breaches are virtually eliminated.

Experienced IT asset disposition services providers not only sanitize hard drives, they also provide a full range of reuse and recycling services, including: inventory management; asset testing and configuration capture; asset tag capture; reuse of assets with value; establishment of an audit trail for the disposition of every asset; environmental and data security liability indemnification; and serialized settlement reporting.

The combination of data encryption and outsourced IT asset disposition can be an ideal data security solution and offers cost savings to an organization. This solution provides for the lowest total cost of ownership because in many cases the financial return from the sale of used IT assets into the secondary market more than offsets the cost of data encryption and information technology disposition services.

A small investment in hard drive data security can save an organization millions of dollars in loss of brand equity and the less tangible cost associated with damage to its reputation if a security breach occurs. A $30 investment to properly handle the disposition of a PC or laptop—addressing security concerns and also ensuring proper environmental recycling—will seem miniscule compared to the damage resulting from a headline telling of a security breach.

The authors are Stampp Corbin, chief strategic officer of Intechra, an information asset disposition company based in Carrollton, Texas, and Intechra consultant Mary Couse.