Everything wiped?: Kroll Ontrack urges caution

Peter Dinham
Wednesday, 22 June 2011 19:53

Business IT - Security

Data recovery IT services company, Kroll Ontrack, is urging consumers and enterprises to do more planning for how they retire old computers and systems, cautioning that there is currently often insufficient attention given to ensuring the security of financial or confidential information when deploying next-generation IT infrastructure.

Coinciding with the end of the financial year when he says many enterprises are deploying next-generation infrastructure, Kroll Ontrack's general manager Asia Pacific, Adrian Briscoe, cautions that, while many organisations at this time of year are in the process of rapidly purchasing and deploying new equipment, there is often 'little regard paid to ensuring that sensitive financial or confidential company information is permanently wiped from old computers or systems.'

According to Briscoe, this can leave organisations vulnerable to major security breaches, because many of still do not have a practical approach in place for properly disposing of their company's old electronics and destroying confidential electronic data. 

Briscoe cites a case, earlier this month when Kroll Ontrack purchased a used laptop, desktop and server and performed tests in the company's clean room in Brisbane to discover if any data still existed on the systems, and subsequently discovered that while all the hardware had been subjected to some type of data erasing, the three units had a combined total of approximately 170Gb of recoverable data.

'We found data on the server and were able to identify its previous owner, which was a large multinational financial services company with offices in Sydney.  We did not extract, copy or access the data, and performed a quality data erasure of the machine. The server had previously only been partially wiped.

'The fact that IT equipment is being sold online without all the data being wiped should be a concern for the community at large.  With so much news circulating about computer security, companies need to incorporate a process to handle data from the cradle to the grave,' Briscoe suggested.

Briscoe says that Kroll Ontrack previously performed tests on IT equipment purchased online three years ago, and he warns that the testing earlier this month highlights that not much has changed in terms of how data is wiped.

According to Briscoe, the server in question was advertised in the following condition: 'This particular server has been owned by a U.S. corporation with offices in Sydney. Server is in very good cosmetic condition, has been tested and is fully working. Data on the system has been wiped.'

Briscoe says that Kroll Ontrack recommends that managers or IT personnel responsible for hardware disposal and data security look for a qualified vendor or select a do-it-yourself solution that is foolproof, and that equipment should be erased at the companies' premises.