in

This Blog

Syndication

Tags

News

AlertBoot offers a cloud-based full disk encryption and mobile device security service for companies of any size who want a scalable and easy-to-deploy solution. Centrally managed through a web based console, AlertBoot offers mobile device management, mobile antivirus, remote wipe & lock, device auditing, USB drive and hard disk encryption managed services.

Archives

AlertBoot Endpoint Security

AlertBoot offers a cloud-based full disk encryption and mobile device security service for companies of any size who want a scalable and easy-to-deploy solution. Centrally managed through a web based console, AlertBoot offers mobile device management, mobile antivirus, remote wipe & lock, device auditing, USB drive and hard disk encryption managed services.

Hard Drive Encryption: Discarded News International Computer Drive Ends Up In Researchers' Net

While carrying out a study on discarded computer hard disks and the data contained in them, the Cyber Security Research Institute (CSRI) happened upon a computer drive that was used by The Sun, one of the newspapers that belongs to News International.  The kicker?  Apparently, the news organization uses disk encryption and a third party contractor to wipe data.

30% of Discarded Drives Contain Data

The hard drive contained names, home addresses, and mobile phone numbers of The Sun staff and high-profile individuals.  According to theregister.co.uk, "The Sun's PC came into the hands of CSRI via a third-party disposal firm that had failed to wipe the data."

The Sun contacted theregister.co.uk and noted that,

"All our drives are encrypted and we have a policy to only dispose of end-of-life hardware in a secure way through a 3rd party supplier. We are contacting the CSRI to find out more about the drive that has been passed to them."

Taking into consideration the two statements, I infer that this unnamed third party is....selling used hard drives?  After wiping them, I guess (but not doing a great job of it)?

Decrypting Drives Before Wiping Them?

My question, though, is: if these drives were encrypted, how was CSRI able to access the information?  Encryption software prevents unauthorized access to data.  In fact, that's all encryption does.

The obvious answer is that The Sun got rid of the encryption before handing the drive over to the vendor.  But, that's a bad idea, as the above shows.

Not only do you risk a data breach from the third party supplier (it's not as if those never happen), there is also the problem of your data not being protected between the time you decrypt the hard drive and the contractor collecting the device.

So, the proper method for getting rid of drives would be to hand them over to a company dedicated to destroying data (if you choose to go that way) while it's still encrypted.


Related Articles and Sites:
http://www.theregister.co.uk/2011/10/26/discarded_pcs_data_treasure_trove_study/

 
<Previous Next>

Health Information and Quality Authroity (HIQA) Encryption

Reputation Cost Of A Data Breach: One Year

Comments

No Comments

About sang_lee

Sang Lee is a Senior Account Manager and Security Analyst with AlertBoot, Inc., the leading provider of managed endpoint security services, based in Las Vegas, NV. Mr. Lee helps with the deployment and ongoing support of the AlertBoot disk encryption managed service. Prior to working at AlertBoot, Mr. Lee served in the South Korean Navy. He holds both a B.S. and an M.S. from Tufts University in Medford, Massachusetts, U.S.A.