Preventing Your Hard Drives and Back-Up
Tapes Becoming a Data Loss Liability
We don’t expect to be kidnapped or die in a plane accident. In the same way, as companies or individuals, we also don’t expect to see our old IT equipment up for sale on eBay or at a second hand computer fair, when it still contains confidential information about us, our company or its customers? However, a recent international study has shown that this is more likely to happen than one would think.
BT teamed up with the University of Glamorgan to conduct some research.
300 hard drives were bought at computer fairs or via web stores and auctions in the UK, Germany, France, United States and Australia, and then examined the data on them. Between 35-40% of the hard disks held commercially sensitive data. These included NHS patient records and intellectual property. One hard drive acquired from a US source contained launch codes from a missile system!
 Many companies outsource the disposal of hard drives and their destruction. Some of the hard disks which were part of the survey and handled by an external supplier were found to contain data from the Lanarkshire NHS. The disks were not properly erased by the external supplier. After learning of the survey results, the hospital concerned does its data destruction in house.
This story clearly reveals a vulnerability in the systems of the external supplier. However, it also points to clear failings in the management system of the hospital.
In the first place, the obvious move is to choose an accredited supplier with proper management systems. The CCT Mark scheme run by CESG, part of Cheltenham GCHQ, is the most obvious example of this.
 The second action point is to make sure that the internal person ordering the data destruction services is sufficiently responsible or senior and has a basic understanding of the risks involved. At Data Eliminate, we find so many cases where a very junior member of staff (eg somebody from the post room) is charged with the job of disposing of old discs and media. In these cases, the appointed person’s number one priority is too often to get rid of the disks and get them off his or her desk.
The crucial thing to remember here is that it’s people who represent the biggest security threat through dishonesty, lack of education or sloppiness– not computers. So the most obvious risks come into play when you destroy the hard drives off-site as opposed to on-site. With on site destruction, as the customer you can witness the process and be sure it is completed to your satisfaction.
With off-site destruction, you are at the mercy of the chain of custody between the collection from your premises and the final place of destruction. Does your data destruction supplier vet their staff and offer other security measures to reduce the chance of the pilfering of a disk or data tape? A simple security measure in the case of off- site destruction measure might be for the service provider to call you and confirm the quantity of items that are about to be processed at the destruction facility is the same as that you handed to their driver. In many cases, sealed security containers may also be used for this purpose.
A simple way in which you can begin to protect yourself, is by having a data classification system in place. This involves labeling documents, files, IT equipment and other items according the value of the data held on them. HMG Government uses a protective marking scheme which provides a good example. There are six ‘impact levels’ within the government protective marking system. Level 1 is ‘HMG Unclassified’, Level 2 is ‘HMG Protect’, Level 3 is ‘HMG Restricted’, Level 4 is ‘HMG Confidential’, Level 5 is ‘HMG Secret’ and Level 6 is ‘HMG Top Secret’. Different policies exist for the daily treatment and final destruction of data from paper to hard drives and data tapes according to its level of security classification or the ‘impact’ a leak of the information might have. Obviously, Level 6 information might comprise NATO’s battle plans and will receive more protection than medical records (as in the case above) which might be Level 2 ‘Protect’.
These are three of the most straightforward steps organisations can take to protect themselves from an incident of data loss relating to used hard disks and computer media.
For further information on our data destruction service, please call 0845-1234-400 or complete our enquiry form. For brief details see our postcard flyer on Government Certified Secure Hard Drive Destruction.
|
