Re: Tape disposal added to Question: Drive-Shredding / Data Destruction

["Gregory, Edward" <EGREGORY () DEPAUL EDU>]

We use Iron Mountain to destroy our tapes, they certify they have destroyed the tapes and send a letter stating that 
fact.

________________________________

From: James H Moore [mailto:jhmfa () RIT EDU]
Sent: Thu 12/22/2005 12:43 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Tape disposal added to Question: Drive-Shredding / Data Destruction



One of Cam's questions also applies to backup tapes.  Is verification
required?  What do you do with tapes?

Jim

- - - -
Jim Moore, CISSP, IAM
Information Security Officer
Rochester Institute of Technology
13 Lomb Memorial Drive
Rochester, NY 14623-5603
(585) 475-5406 (office)
(585) 475-4122 (lab)
(585) 475-7950 (fax)



"We will have a chance when we are as efficient at communicating
information security best practices, as hackers and criminals are at
sharing attack information"  - Peter Presidio

-----Original Message-----
From: Cam Beasley [mailto:cam () AUSTIN UTEXAS EDU]
Sent: Thursday, December 22, 2005 12:30 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Question: Drive-Shredding / Data Destruction

Colleagues --

in response to recent state legislation, i am developing
an inventory management strategy for our campus that would
require the shredding (or otherwise virtually unmanned
destruction) of large volumes of surplused hard-drives/month.

i would like to know if any of you have dealt with this issue
at your institutions, and if so, what were your challenges?

other related questions:

 - do you centrally destroy drives?
   if so, what group owns this fxn (e.g. physical plant,
   central IT)? 
   or do you delegate it to the local units/depts?

 - how do verify and document data destruction is successful
   for each drive?

 - any suggestions on a vendor?  we are currently looking at
   devices that will support our volume, such as:

   http://www.semshred.com/contentmgr/showdetails.php/id/535
      
 - outsourcing may be an option, but are there any gotchas?

 - did you consider recycling the drive mulch?

 - did your surplus go to charities or the less fortunate?
   if so, how were they affected?

btw, we aren't considering wiping drives at this point due
to the necessary wipe/verification time requirements that would
be associated to our surplus volume.

i appreciate your insight and experiences and would be happy to
summarize any feedback i receive for the list.

thanks and merry christmas,

~cam.


--
Cam Beasley CISSP CIFI
Director | UISO
Information Security Office
ITS | University of Texas at Austin
cam () austin utexas edu | 512.475.9476