Challenge
Theft and loss through careless handling procedures are the primary means by which sensitive information is inadvertently disclosed. In the case of portable media, much of this release happens as laptops and storage hardware is decommissioned without proper erasure. Conventional means to overwrite data on drives is infeasible due to the time it takes to properly overwrite all sectors on a drive.
Data protection and reporting laws (GLBA, HIPAA, SB1386 and derivatives, US Safe Harbor, EU Data Protection Directive) are a strong compliance requirement for tracking the location of sensitive information and maintaining control over it. When media that potentially contains sensitive information goes unaccounted for, costs associated with remediation and reporting of the loss range from $95 to $305 per record. A lost laptop drive can easily cost over $95M in lost labor and “out-of-pocket” expense, not to mention the hidden cost of reputation damage. Failure to control information adequately can lead to government fines, 20-year audit requirements, and even civil litigation.
Solution
On-metal, low profile HID Adept 400 Data RAIN® RFID UHF tags are applied to disk drives to provide a unique identifier, and near perfect read performance, as drives are crushed. Crushers handle up to 60 drives an hour. As drives are crushed, tags on the drive are crushed as well, so verification of destruction by unique drive ID is provable.
As computers are received for decommissioning, the unique ID of the computer is associated with the internal drive by the information encoded in the transponder placed on the hard drive. Tagged drives are positioned for destruction in the disk crusher in such a way that the HID transponder will be crushed as the disk is crushed. The reader records the signal from the transponder until the transponder “flat lines” due to destruction. Thus, a verification of destruction of the disk is uniquely identified and recorded as part of the company records.
Result
Verification of disk destructions provides demonstrable support to management’s intent for appropriate controls over sensitive information. Payback is in “soft” cost savings as insurance in the event of investigation or query into management practices. The solution may also provide support under Federal Sentencing Guidelines.
