A new computer, mobile device or other IT equipment generally requires some effort setting up and migrating data. Enterprises also need to spend the time making sure the data is completely removed from the equipment as it is replaced.
Organizations do not always stop to consider the security implications of leaving data on obsolete equipment before disposing of them, Jim Kegley, president and CEO of U.S. Micro, told eWEEK. With more and more sensitive data being stored on devices such as copy machines, computers, phones and tablets, organizations without secure IT asset disposal policies are at risk of costly data breaches and reputation damage, Kegley said.
The holiday season also means that many people received new mobile devices or computers. While synchronization and backup tools have made switching data to new devices a much easier process, users don’t often take the extra step to remove data, including contacts and work emails, from the older device before throwing it away, increasing the organization’s risk.
Companies spend millions of dollars securing new equipment, but neglect to make the appropriate investment to secure sensitive information when disposing of assets, according to Kegley. Approximately eight pounds per U.S. resident worth of IT equipment are discarded each year, according to U.S. Micro.
Earlier this year, New Jersey’s comptroller’s office discovered that 80 percent of the computers disposed by state agencies and flagged for public auction still contained personal identifying information such as Social Security numbers and confidential data such as tax returns, case reports and immunization records. Last year, a federal audit found that National Aeronautics and Space Administration personnel at four facilities neglected to ensure data was properly removed before selling or discarding computers.
In 2010, Blue Cross Blue Shield of Tennessee disclosed it had spent more than $7 million investigating the loss of 57 hard drives that had been stolen while sitting in storage waiting to be destroyed, according to Kegley.
Just moving the equipment off-site for long-term storage or relying on self-cleaning to remove data are "poor options," Kegley said. Deleting the hard drive or reinstalling the operating system is not always enough, especially if handled by personnel without the proper training. Experts recommend sanitizing drives by overwriting and degaussing the device so that it is impossible to recover the data. In highly sensitive environments, it is often recommended that the drives be physically destroyed to prevent any potential data leaks.
Just last week, Army investigators presented evidence against Pvt. Bradley Manning and the classified documents that he’d allegedly leaked to whistleblowing site WikiLeaks. Investigators said that someone had attempted to securely wipe the laptop by overwriting the data with zeros. The process is effective, but should be run several times. The operation was run only once on Manning’s laptop, allowing investigators to retrieve some of the data that hadn’t been destroyed to build their case.
Less than 25 percent of mobile devices, computers and electronics equipment are discarded properly, according to Sims Recycling Solutions, an electronics recycler that specializes in removing data from discarded equipment.
Earlier this year, the Obama administration unveiled the National Strategy for Electronics Stewardship, calling for federal agencies to buy, reuse and recycle electronics responsibly, and to use certified recyclers to dispose of electronics. The initiative requires agencies to establish and follow a comprehensive policy on how data stored on the used equipment is removed. Agencies will also have to improve their processes for tracking what happens to the electronics after they have been disposed.
Enterprises should ensure that all the data has been wiped even before the equipment leaves the premises for sale or disposal, according to Kegley.
The strategy, intended to protect the environment and encourage the use of energy-efficient devices, does not go far enough regarding the data stored on those devices, according to Kegley. "The strategy falls flat on the important topic of data sanitization and higher standards that are currently available and could be easily implemented to ensure better protection of consumer data," he said, noting that it is also "fairly silent" on regulations already in place regarding data protection.
A national strategy, if properly developed, would be useful as it would give consumers and businesses information on how to properly recycle electronics to prevent data breaches, Kegley said.