Due to the many breaches that have been in the news in recent years, data security is a hot topic throughout the technology sector. Industry experts have worked around the clock to devise better firewalls, data encryption, end-point protection, and network monitoring, and enterprises are investing millions of dollars into these systems and technology.
What many corporate security and risk managers often overlook is that most of the precautions being taken do not address the end of an asset’s lifecycle. Often, IT asset disposition is given a low priority by the information security and risk managers.
Does your company have a documented process for tracking and storing decommissioned assets? Too often, a retired piece of equipment will be stacked on a shelf in a storage area, in an empty cubicle or office, or even in an open hallway, waiting for data erasure and disposal — only to be picked up by an employee to be used elsewhere. Mobile devices might be handed in, mailed, or shipped via non-secure services.
Encryption provides a good first line of defense. But if you don’t know for sure where a data bearing asset is, and you don’t have a documented record of data erasure or hard drive destruction, you are still open to risk.
End-of-life data security doesn’t have to be high tech, and it doesn’t require the kind of investment that things like network security do. Proper asset tracking is essential. Once a piece of equipment has been unplugged from a company’s network, it is imperative that the device be carefully tracked so that you know precisely where the data — and the HDD — is at all times. Employees should be aware of the policies and procedures and be held accountable for following them.
IT asset managers (ITAMs) do not have an easy job. With the integration of many distributed device types (laptops, tablets, smartphones, PCs), they are being asked to monitor and track a large number of devices at any given time as they move between people, offices, or company locations. In many companies, asset managers are not provided with asset management software tools – other than spreadsheets. So ensuring security and chain of custody of every data bearing asset is a challenge.
Developing easy to follow procedures for decommissioning, storing and moving retired assets will protect your company data – and make the asset management job a bit easier. This is a small investment that can pay off big in reduced risk and increased security.
