A Clean Sweep-2004-09-20-Making sure refurbished drives don't recycle private data.-Kathy Ferguson

Many organizations face the challenge of disposing of IT equipment, particularly PCs. Until recently, the focus was primarily the environmental risk associated with careless and unregulated handling of end-of-life PC equipment.

Guidelines have been developed across Europe and in parts of Asia to handle and regulate the disposal of IT equipment, while new legislation has passed in some U.S. states and is pending in several others as well as in Canada. Now, as companies race to prepare for, and adhere to, federal and state environmental regulations, they face new concerns about hardware disposal, this time related to data security and privacy.

"Disk sanitation" is taking on greater importance as more and more data storage devices are refurbished and reenter the marketplace. According to Gartner Dataquest, about 150 million used drives were sold via secondary sales markets last year. At the same time, roughly 200 million new hard drives were shipped. That means that for every 10 new drives that enter the market, seven used ones are resold.

About a year ago, graduate students at the Massachusetts Institute of Technology (MIT) published a study to examine the effectiveness of data cleansing techniques used on hard drives. They bought 158 drives between November 2000 and August 2002 from computer stores specializing in used equipment and online auctions such as eBay.

After using a number of recovery techniques available to any skilled IT professional, they found that of the 129 functional drives, only 12 percent had been properly sanitized. Intact data recovered from drives that had not been properly sanitized included 675 Word documents, 566 PowerPoint presentations, 5,000 credit card numbers and 9,500 e-mail messages.

Among the more celebrated cases where data cleansing was neglected, a press story reported that a woman purchased a used computer only to find the prescription records of 2,000 customers of Smitty's Supermarket pharmacy, the previous owner of the drive. The state of Kentucky came under fire for discarding old hard drives that still contained databases of thousands of patients diagnosed with AIDS and other sexually transmitted diseases. And recently, it was reported that several North Carolina state agencies failed to properly destroy Social Security and bank account information on computer hard drives before they were offered for public sale, putting citizens at risk of identity theft.

According to the latest survey of business executives of mid-sized to large companies conducted by Granite Research Consulting on behalf of IBM Global Financing, companies rate data security as the No. 1 concern of PC disposal, even over cost, yet most are not complying with regulations or truly protecting their customers� privacy. About 90% of companies still simply reformat disks in-house before disposal, believing incorrectly that data is destroyed in the process.

A number of factors complicate the process of cleaning or erasing data from storage devices. As reported in the MIT study, lack of knowledge and concern for the problem; lack of tools and training; non-storage hardware failure that doesn't allow drives to be properly sanitized; and insufficient methodology and lack of redundancy in data cleansing top the list.

Making a Clean Sweep
So how does an organization ensure that data is erased from a storage device before it is disposed of or resold via used equipment markets? In addition to the safest alternative - drive destruction - there are two methods available to prevent private information from being inadvertently shared with future users.

The first is to use a magnetically-charged bulk eraser. Bulk erasers are most commonly used to erase tape-based storage devices. The process, called degaussing, takes only a few seconds to erase all data, and the tape can be reused again as if new. However, the magnetic fields created by bulk erasers aren't typically strong enough to remove data from a hard drive.

The second, and more widely accepted, practice is to overwrite the drive's data so that it is virtually impossible to recover. This method writes a random series of zeroes and ones to every block on the disk, thus over-writing pre-existing data. Although highly-specialized processes can sometimes be used to recover original data, it can be considered as essentially 'erased' for any non-advanced users without access to such rare and costly equipment.

Measuring the Financial Impact
There are two critical factors that all companies need to consider when making a decision about disk sanitation practices - cost and risk.

The cost of running sanitation programs on a fleet of computers can be prohibitive. Even in smaller organizations, the number of hard drives that need to be cleansed can be unmanageable. Most IT managers do not have the hours or staff to accomplish such a task without impacting other core business responsibilities. Should a company choose to circumvent these costs and simply destroy their drives (many of which could be re-used), they dispose of equipment that still has market value.

At the same time, companies need to recognize the significant risk associated with breaches of private information. When companies don't properly sanitize exiting storage devices, they expose themselves to myriad public relations, legal, and business repercussions should any confidential data be leaked. Data confidentiality is protected by federal statute in certain industries. For example, in the healthcare industry, HIPAA guidelines already impose extensive rules and requirements, and penalties for non-compliance. The financial services industry is covered under a similar federal law. As federal and industry regulations adopt stricter standards, and penalties, for electronic data security, IT managers must act quickly to adopt and implement appropriate disk sanitation practices.

Outsourcing Disk Sanitation

The question of how to balance cost and risk has many organizations looking for outside help. For a growing number of companies, the answer is to outsource their entire sanitation and asset disposition process. Using a third-party vendor helps them achieve three major goals - appropriate sanitation of exiting drives, avoidance of cost/mitigation of risk associated with in-house sanitation and disposal, and getting cash for their IT that is remarketable.

Kathy Ferguson is a Business Unit Executive in the Asset Recovery Solutions division of IBM Global Financing.

Here are the topics we cover computer certification computer careers computer training computer games consulting data recovery data security digital entertainment emerging technology gadget reviews handheld computers hardware reviews home automation home networks home office how-to advice internet linux local companies local news local profiles macintosh mp3 players network security online music online security open-source small-business technology soho software reviews technology books technology dictionary vpn web site reviews wi-fi windows wireless technology tech articles tech news press releases tech dictionary education resources career solutions create your personal blog upload your videos become a writer usergroups special interest group SIG 3com cipts adobe adobe certified expert apc ncpi apple achds acpt acsa actc avaya bea 8.1 certified administrator 8.1 certified architect 8.1 certified developer 9 certified administrator bicsi rcdd checkpoint ccmse ccsa ccsa ngx ccse ccse ng plus with ai ccse ngx cisco access routing and lan switching ccda ccdp ccie ccip ccna ccnp ccnp old ccsp ccvp crmam ip communications optical proctored exams for validating knowledge sales specialist storage networking vpn and security wireless lan citrix cca 3.0 cca 4.0 cca 4.5 cca xp ccea 3.0 ccea 4.0 ccea xp ccia ciw ciw associate ciw certified instructor master ciw admin master ciw designer master ciw enterprise developer security analyst comptia a+ network+ security+ server+ computer associates ca cusa cuse cwna cwna cwsp dell eccouncil cea cep certified ethical hacker chfi e-commerce architect emc emc specialist implemenation technology foundations enterasys ese eta exam express exin exin itil extreme networks ena ens filemaker f7cd f8cd fortinet fortigate foundry cne fujitsu fujitsu guidance software ence hdi css hda hdm hdsa hitachi hitachi certified professional hp ais apc app aps ase certified systems developer csa cse master ase huawei hcne hyperion hcp ibm advanced deployment professional advanced technical expert application developer business process analyst certified administrator certified advanced system administrator certified advanced technical expert certified associate developer certified enterprise developer certified solution designer certified specialist certified systems expert database administrator db2 deployment professional enterprise developer eserver certified specialist ibm on demand business solution advisor solution designer solutions developer solutions expert storage administrator system administator iisfa cifi intel isaca cisa isc cissp sscp iseb itil ism cpm juniper jncia jncis legato lcaa lcea lotus clp lpi lpic level 1 lpic level 2 lpic level 3 macromedia mcafee mcdata csnd microsoft crm mbs mcad .net mcdba mcdst mcitp mcp mcpd mcsa longhorn mcsa 2003 mcsa 2008 mcsd .net mcse mcse 2000 security mcse 2000 to mcse 2003 upgrade mcse 2003 mcse 2003 messaging mcse 2003 security mcse 2008 mcts microsoft business solutions microsoft partner competency mile2 cnsa network appliance nac-na nac-nie naca nace nacp network general sniffer certified professional nokia nokia security administrator nortel ncde ncds ncse ncss ncts novell5 cna 5 cne 6 cna 6 cne 6.5 cne cne upgrade omg ocup oracle 10g dba 10g oca 11i 8i dba 9i dba 9i internet application developer oca ocp8 to ocp8i dba upgrade exam pmi project management professional polycom pcve redhat rhce rhct sair sas institute sas scp saas scp snia snia certified architect snia certified professional snia certified systems engineer snia storage networking certification program administrator professional associate symantec scse scsp scta scts teradata tca v2r5 tcad v2r5 tcda v2r5 tcis v2r5 tcm v2r5 tcp v2r5 tia ccnt ctp tibco tcp trusecure ticsa veritas infraguard chamber of commerce vcp vmware certified professional webex linkedin facebook myspace Professional page layout, image editing, vector illustration, and print production Website design, development, prototyping, and blogging Creation of rich interactive content Industry-standard visual effects and motion graphics Video capture, editing, and production; DVD titling; and digital audio, Adobe Photoshop CS3 extended, Adobe illustrator CS3,Adobe indesign CS3,Adobe Acrobat 8 Professional, Adobe Flash CS3 Professional, Adobe Dreamweaver CS3,Adobe Contribute CS3,Adobe Fireworks CS3,Adobe After Effects CS3 Professional, Adobe Premiere Pro CS3,Adobe Soundbooth CS3,Adobe Encore CS3,Adobe OnLocation,Adobe Bridge CS3,Adobe Version Cue CS3,Adobe Device Central CS3,Adobe Stock Photos, Intel Pentium 4 (1.4GHz processor for DV; 3.4GHz processor for HDV), Intel Centrino, Intel Xeon, (dual 2.8GHz processors for HD), or Intel Core, Duo (or compatible) processor; SSE2-enabled processor required for AMD systems Microsoft Windows XP with Service Pack 2 or Microsoft Windows Vista Home Premium, Business, Ultimate, or Enterprise (certified for 32-bit editions) 1GB of RAM for DV; 2GB of RAM for HDV and HD; more RAM recommended when running multiple components 10GB of available hard-disk space (additional free space required during installation) Dedicated 7,200 RPM hard drive for DV and HDV editing; striped disk array storage (RAID 0) for HD; SCSI disk subsystem preferred Microsoft DirectX compatible sound card (multichannel ASIO-compatible sound card recommended),1,280x1,024 monitor resolution with 32-bit color adapter Blu-ray burner required for Blu-ray Disc creation OHCI compatible IEEE 1394 port for DV and HDV capture, export to tape, and transmit to DV device QuickTime 7.1.2 software required to use QuickTime features Broadband Internet connection required for Adobe Stock Photos* and other services

3PAR, Accellion, Acronis, Actional, Active Endpoints, ActiveGrid, activePDF, ActiveServers, ActiveState, Actuate, Adaptec, Agile Software, AGiLiENCE, Agilysys, Akorri, AlachiSoft, Alter Logic, Altor Networks, Altova, AMD, AMDAHL, Amentra, Amyuni, anacubis, Apani, APC, Appcelerator, AppSense, AppStream, Array Networks, Ascential, Astaro, Attune Systems, Autodesk, AutoVirt, Availl, Avanade, Azul Systems, Barracuda Networks, BEA Systems, B-hive, Black Duck Software, Blackbaud, Blade Network Technologies, Blue Coat, Blue Lane, BlueArc, BlueNote Networks, BluePheonix Solutions, BMC Software, Borland, Bristol Technology, Brix Networks, BroadVision, Brocade, Burton Group, Business Objects, CA, CalAmp, Cassatt, Cast Iron Systems, Catbird, Cayenne Technologies, Ceedo Technologies, Cenzic, Certeon, CiRBA, Cisco Systems, Cision, Citrix Systems, ClearApp, ClearCube Technology, CollabNet, Compass America, Composite Software, Compugen, Compuware, Configuresoft, Continuity Software, Coraid, Courion, Coyote Point Systems, Crescendo Networks, CSC, DataCore, DataSynapse, Dell, Desktone, Digipede Technologies, Double-Take Software, Ecora Software, EDS, eG Innovations, Egenera, Elastra Corporation, Electric Cloud, Embotics, EMC Corporation, Emulex, Endeavors Technology, Enigmatic Corporation, Enterprise Management Associates, Entuity, EqualLogic, Ericom Software, ESRI, EVault, eXludus Technologies, F5 Networks, FalconStor, FastScale Technology, Foedus, Force10 Networks, Fortisphere, Forum Systems, Fujitsu, GemStone Systems, Getronics, GlassHouse, Green Hills Software, Grid Dynamics, GridGain Systems, GT Software, Hitachi, HP, Hyper9, Hyperic, IBM, ICEsoft, IGEL Technology, Illumita, ILOG, IMEX Research, Information Builders, Ingres, InstallFree, Integrien, Intel, Intellium, International Computerware, iTKO LISA, JBoss, Juniper, KACE, Kidaro, LeftHand Networks, Leostream, Lifeboat Distribution, Liquid Computing Corporation, Liquid Technology, Lynux Works, Mainline, ManageIQ, Managed Methods, ManageSoft, Marathon Technologies, McAfee, Mellanox Technologies, Microsoft, Mid-Atlantic Computers, Mindbridge Software, Mindreef, MKS, MonoSphere, Motorola, MQSoftware, mySoftIT, NASTEL, Ncomputing, NEC, Neocleus, NeoPath Networks, Neoware, NetApp, Netegrity, Neterion, Netuitive, Neverfail, Nexaweb, NextAxiom, Nimbus, Nimsoft, Niyuta, NoMachine, Novell, ONStor, Opalis Software, Open Kernel Labs, OpenSpan, OPNET Technologies, Optaros, OpTier, Oracle, Pano Logic, Parallels, Parasoft, Perforce Software, PHD Technologies, Phoenix Technologies, Phurnace Software, Pillar Data Systems, PlateSpin/Novell, Progress Software, Prolifics, ProSync Technology, Provision Networks, QLogic, Quest Software, Racemi, Raritan, Raxco Software, Red Hat, Reflex Security, Resolution Enterprises, RingCube Technologies, Riverbed Technology, Rogue Wave Software, RSA Security, Sagnet Solutions, SanDisk Corporation, SAP, SAVVIS, ScaleMP, Scalent Systems, Seanodes, Secure Command, Secure Computing, Sentillion, Shavlik Technologies, ServInt Internet Services, Silpion IT Solutions, SIMtone, Skytap, Skyway Software, Software AG, Sonasoft, SourceGear, Splunk, StackSafe, SteelEye Technology, StillSecure, StoneFly, Stonesoft, Stoneware, StoreVault, StrikeIron, STT WebOS, Sun Microsystems, SunGard, Supermicro Computer, Surgient, SWsoft, Sybase, Symantec, Systar, TBD Networks, Tenfold, TheInfoPro, Thinstall, Third Brigade, TIBCO Software, Tidal Software, Tideway Systems, TOA Solutions, TRANGO Virtual Processors, Trend Micro, Tresys Technology, Trigence, Tripwire, Ulteo, Unisys, United Devices, VaST Systems, VDIworks, VeeAm Software, Verari Systems, Verio, VeriSign, Vicom Computer Services, VirtenSys, Virtera, Virtual Iron, VirtualLogix, Virtugo Software, Virtutech, VisionCore, Vizioncore, VKernel, VMLogix, vmSight, VMware, Vordel, vThere-Sentillion, Vyatta, WaveMaker, Web Age Solutions, WSO2, Wyse Technology, XDS, XenoCode, Xiotech, xkoto, Xsigo Systems, Zenith Optemedia, Zeus Technology.