40% of orgs doubt effectiveness of disposal procedures of old PCs

UK organizations aren’t certain that all data and settings are deleted from devices prior to disposal, say the findings of a recent survey by user and infrastructure management company Osirium.

Corporate devices have varied levels of confidential data and company specific settings stored on them and access credentials all of which are recoverable. In the wrong hands it could be possible to not only gain access to the networks through recovered group admin credentials but also to compromise data which could constitute a serious data privacy breach.

Worryingly, 40% of all the organizations questioned said that they were not confident that all data was deleted but more shockingly the survey found that in the Finance and Retail sectors around 7% of organizations didn’t delete data at all.

“As the IT industry moves towards 100 gigabit per second Ethernet and 100 megabit per second broadband connections the need to replace routers, firewalls, load-balancers and content filtering devices, amongst others, is also becoming more urgent,” said David Guyatt, CEO at Osirium. “Some devices may be reusable and will therefore have a second-hand value, whilst others will only be fit for the dump. Either way, at some point in the refresh cycle all devices will ultimately end up in the hands of third-parties and as their eventual destination cannot be guaranteed or controlled the appropriate care must be taken.”

Interestingly, Guyatt is able to recount a personal experience of this when Osirium purchased two devices from eBay – being sold by local councils. The first was a Juniper SA found to have configuration information still on it including administration credentials which were recoverable whilst the second was a Bluecoat Proxy SG device which was set up to use Active Directory (AD). This not only had credential information which would allow a person to gain access to AD.

Bob Tarzey, Analyst and Director at Quocirca isn’t surprised about this. “Around 40% of respondents in Quocirca’s new research report are not sure they managed to delete sensitive data from IT devices when they reach end of life. Even those that claim to do so may not have actually safely removed the data. Simple deletion is not good enough, a determined hacker may still be able to retrieve it,” he explains. “Only disk shredding and/or reformatting tools can ensure devices are completely safe to dispose of. Doing so need not be a hassle, technology is available to automate the process and provide an auditable record that data was deleted.”

Ensuring data deletion processes are followed to the letter is critical. The reason this is so important is because if identified administration passwords turn out to be group administration credentials then it allows hackers to access other, similar, devices – and if these credentials are also used across multiple vendor devices then the risk is further extended.

“Even if organizations use IT asset disposal companies their data might not be deleted,” continued Guyatt. “The companies offering these services are of course strong on disk wiping & disposal processes but do they have deeper knowledge of all the differing infrastructure devices, so they don’t overlook, or not even be aware of, something that needs to be wiped? I doubt it.”