 |
 |
Ensuring Information Security Through Data Destruction
Data Privacy and Risk
The news is full of stories these days of incidents of unintentional disclosure of sensitive information. In many cases, this occurs when IT assets containing storage media are disposed of without proper data destruction. In one episode, a major utility recycled 84 hard drives that wound up for sale on Ebay. Data on the drives contained proprietary company information such as memos, correspondence with some customers, and confidential employee information. In another case, a used hard drive that was returned to Best Buy for destruction ended up being sold intact at a Chicago flea market.
In addition to generating negative publicity, these incidents can place a company at risk of violating a number of federal privacy laws. However, those risks can be mitigated through three alternative methods of data destruction:
Software based solutions - These software packages over-write hard drive with zeros in order to eliminate existing data. Examples include: public domain DBAN software and commercially available software packages such as Active@'s "KillDisk" or OnTrack's "DataEraser™". The major advantage to this method is that it may enable the owner of the equipment to recover the end of life value of the asset by reselling it. The major disadvantage of this approach is that data can still be inadvertently disclosed in the absence of adequate business process controls and follow-up testing. However, this is a common and safe method of data destruction so long as the process is subject to proper oversight and forensic testing.
Degaussing - Another method of data destruction is to erase the data by exposing the hard drive to a powerful magnetic field. However, this method is not always reliable. Rather than actually making the drive platters unreadable, the process may only destroy the electronics. Furthermore, the results can only be verified by testing each drive to ensure that the data has been completely eliminated.
Physical destruction solutions - The final alternative to software-based data destruction or degaussing is to physically destroy the hard drive. This approach may be most appropriate when the drive is inoperative or defective, or the sensitive nature of the data makes even a small risk of inadvertent disclosure unacceptable. The primary advantage of physical destruction over software destruction and degaussing is that physical destruction provides visual proof that the drive (and thus the data) has been destroyed.
Physical destruction techniques run the gamut from manual brute force to highly- sophisticated automated solutions. Manual methods usually include a process for crushing or perforating the hard drives or tapes. Tools used to destroy the drives can be as simple as a sledge hammer, hammer and chisel, or drill press.
Some of the more bizarre and humorous approaches to physical destruction have included a military installation that used the hard drives for target practice and a utility that employed a steam roller to crush the drives.
Unfortunately, worker safety is a major issue with physical destruction due to the possibility of injury from errant flying debris. In addition, manual processes can be quite slow and tend to take a toll on equipment (e.g. broken drill bits and bent chisels).
Using a shredder can be a higher-volume alternative to manual data destruction methods. However, the equipment is quite expensive, takes up a significant amount of space, and has special electrical requirements. In addition, the shredding process is extremely loud - requiring proper ear protection and other safety equipment for operators. Lastly, hard drives can jam or destroy shredder blades and could lead to exposure to unsafe materials and/or result in high maintenance costs.
New Destruction Technology - In an effort to find a safe, simple, and secure method for physically destroying hard drives, LifeSpan has recently entered into a co-marketing arrangement with eDR Solutions , of Greenville, South Carolina. eDR's Hard Drive Crusher ("HDC") system combines the advantages of higher volume and enhanced safety into a simple and cost-effective physical destruction solution.
|
|
|
How it works - The operator places the hard drive into the destruction chamber. Closing the door trips a safety switch that enables the system. The operator then presses a hand-held switch in order to activate a hydraulic pin that crushes the hard drive. The resulting mix of electronic waste and aluminum can be recycled by LifeSpan.
|
For a video demonstration of the HDC in operation, please click on the following link:
Video of the process
The HDC system has the following advantages over other methods of physical destruction:
- Fraction of the cost of other automated systems
- Safe
- Transportable
- Durable
- Operates off of a standard 110 volt outlet
- Quick (10 second cycle time)
LifeSpan has already sold an HDC system to a public utility that wishes to destroy hard drives within their facility. We have identified a number of other interested parties and are presently considering the establishment of a mobile hard drive destruction service.
For additional information about the HDC system or to provide us with any feedback, please contact LifeSpan at: (888) 720-0900.
|
|
 |
|
|
|
|
|
 |
 |
IT/MIS professionals - Reduce your effort and costs in managing asset retirement programs |
|
Investment recovery managers - Minimize your total cost of ownership |
|
Purchasing managers - Cost-effectively remove old equipment so that new equipment can be deployed |
|
Compliance officers - Reduce risk and potential liability by securing sensitive data and disposing of equipment in an environmentally-safe manner |
 |
 |
Large Distributed Enterprises |
|
Systems Integrators |
|
Technology OEM’s |
|
Municipalities |
|
Not-For-Profit Organizations |
|
|
