Re: Lost and Found

[Richard Hopkins <richard.hopkins () BRISTOL AC UK>]

No, we no longer make any attempts to determine who they belong to, nor
what's on them. We just hold onto them for a "few" weeks and then pass them
on to our (secure) disposal people.

Cheers,

Richard

--On Friday, February 05, 2010 11:05 AM -0500 "James C. Farr '05"
<jfarr () UTICA EDU> wrote:

> Malware is one of our concerns as well.  Do you ever make an attempt to
> determine who it belongs to and or what is on the device?
>
> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Richard Hopkins
> Sent: Friday, February 05, 2010 10:33 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] Lost and Found
>
> --On Tuesday, February 02, 2010 5:05 PM -0500 "James C. Farr '05"
> <jfarr () UTICA EDU> wrote:
>
> > Each of our institutions probably has a lost and found box where people
> > turn in things like flash drives.
> >
> > In the past we look for identifying information so we can return the
> > device to the happy owner.
> >
> > That is all well and good, but what if that flash drive had confidential
> > data on it?
> >
> > We have no idea who saw that drive while it was missing.
> >
> > Does anyone scan lost and found storage devices (either manually or with
> > a tool) to search for reportable information like Social security
> > numbers?
> >
> > If so what processes are you using?
>
> There's also the possible issue of malware on the flash drives. We treat
> them as "hazardous waste" and arrange for them to be securely disposed of
> (after an appropriate time period).
>
> Cheers,
>
> Richard
>
> http://www.bris.ac.uk/infosec



Richard

http://www.bris.ac.uk/infosec