Re: Data Sanitization

[Chris Green <cmgreen () UAB EDU>]

We just instituted a process for shredding of hard drives.  About 2 years ago, UAB identified that the 
"cheap/affordable" degausser that we had did not properly sanitize higher density drives.    We already had a group 
with an industrial shredder for disposal of other types of equipment  and they agreed to shred the hard drives into 
quarter->silver dollar sized pieces for us.

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Kamnab 
Keo
Sent: Tuesday, April 07, 2009 1:42 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Data Sanitization

We are trying to get a good feel of what methods other institutions are using to sanitize electronic storage devices 
(Hard disk drives, USB flash drives, CD, DVD, tapes).  We are particularly interested if you are using a degausser, 
hard drive bending machine or some other physical destruction methods (drilling holes in the disk drive, hammers, drive 
shredder).

One of our primary concerns is implementing a sanitizing process so that we can verify that data is adequately 
eliminated.  For example, with a degaussing machine we would have to connect the disk drive to a computer in order to 
verify that it is no longer usable after the degaussing process.  Has anyone experienced a failed degausser?

Your feedback is greatly appreciated

Kamnab Keo
IT Risk Management Analyst
Virginia Commonwealth University

VCU Information Security - http://infosecurity.vcu.edu/
Information Security News, Tips & More - http://www.twitter.com/vcuinfosec

Don't be a phishing victim - VCU and other reputable organizations will never use email to request that you reply with 
your password, Social Security number or confidential personal information. For more details visit 
http://infosecurity.vcu.edu/phishing.html.