Question: Drive-Shredding / Data Destruction

[Cam Beasley <cam () AUSTIN UTEXAS EDU>]

Colleagues --

in response to recent state legislation, i am developing
an inventory management strategy for our campus that would
require the shredding (or otherwise virtually unmanned
destruction) of large volumes of surplused hard-drives/month.

i would like to know if any of you have dealt with this issue
at your institutions, and if so, what were your challenges?

other related questions:

 - do you centrally destroy drives?
   if so, what group owns this fxn (e.g. physical plant,
   central IT)?
   or do you delegate it to the local units/depts?

 - how do verify and document data destruction is successful
   for each drive?

 - any suggestions on a vendor?  we are currently looking at
   devices that will support our volume, such as:

   http://www.semshred.com/contentmgr/showdetails.php/id/535

 - outsourcing may be an option, but are there any gotchas?

 - did you consider recycling the drive mulch?

 - did your surplus go to charities or the less fortunate?
   if so, how were they affected?

btw, we aren't considering wiping drives at this point due
to the necessary wipe/verification time requirements that would
be associated to our surplus volume.

i appreciate your insight and experiences and would be happy to
summarize any feedback i receive for the list.

thanks and merry christmas,

~cam.


--
Cam Beasley CISSP CIFI
Director | UISO
Information Security Office
ITS | University of Texas at Austin
cam () austin utexas edu | 512.475.9476