Risks of Improper EOL Management
Chief Security Officers and those responsible for security focus concerns on day-to-day threat management, including strategies for handling infrastructure management related to security. Too often, too little thought is given to security after an IT asset is decommissioned. This is the area of greatest concern; with improper end-of-life asset management, the threat to security is ten-fold.
Even if you think your in-house process is enough, reports say otherwise. Unless the internal group uses a DOD-certified process and validates every unit is processed or outright shreds equipment, data could still remain. Stories of how internally wiped drives later turned up sensitive data litter the news.
Threat List:
1. Exposure to violations of the following: Sarbanes-Oxley, HIPAA (criminal penalties of up
to $250,000 and/or 10 years imprisonment per violation of patient security information),
Gramm-Leach-Bliley (penalties of up to $100,000 per violation for financial
service/customer information), Fair Credit Reporting Act, Children’s Online Privacy Act,
FERPA, FTC consumer information, WEEE, Basel Convention, RCRA, CERCLA, State-based recycling rules/regulations and data privacy/protection laws, plus national legislation pending and enacted surrounding privacy.
2. Improper Storage: Not only does “out-of-sight, out-of-mind” closet storage create issues with loss of ownership, unrestricted access and loss of responsibility, the cost to the organization is high.
3. Loss of credibility with the market/customers. Any security breach will cause concern among clients or employees. In competitive markets, the loss of customers over something that can easily be remedied is an unnecessary risk.
Consider also how much money and time is invested in maintaining a secure infrastructure: IDS, firewalls, network management, threat mitigation, policy, personnel and how that is compromised so easily once the asset is no longer useful to the organization.
Experts across the board advise outsourcing the security and disposal process to an outside firm. However, selecting the wrong disposal firm can increase the liability even more! This is why working with Hesstech creates complete assurance of secure asset disposal. Hesstech audits downstream partners, provides complete asset tracking, issues a clean itemized certificate of recycling, and provides advisory services on the asset disposal process. In addition, you will always know where your asset is, what is happening to it, and where it ended up.
Back to Top |
|
