Re: Discoverability of expired tapes?

["Hudson, Edward" <ewhudson () CSUCHICO EDU>]

We just dealt with this issue last month. In brief:

*         We also have a two week "limit." GC felt that would not likely stand up to court scrutiny and recommended 
something more along the lines of 30 days but nothing has been mandated or set to policy.

*         We have encrypted backup tapes (not from Exchange) that we are no longer in possession of the password for 
(due to a change in technology)and are thus non-recoverable. We were still advised to keep them as is pending court 
review and determination.

Net: 200+ tapes are sitting in a locked cabinet till the folks in the black robes pass judgment on what is to be 
provided to opposing counsel.
"YMMV" and local law prevails but we chose to defer to GC rather than try and make the call ourselves in any area that 
wasn't abundantly clear cut.  Working closely with the assigned attorney was extremely beneficial and we all came away 
comfortable that we had positioned the campus as optimally as possible.
Hope this helps.

Ed Hudson, CISM
Information Security Office
California State University, Chico
www.csuchico.edu/ires/security<http://www.csuchico.edu/ires/security>
Office: (530) 898-6307
Cell: 707-799-3250
ewhudson () csuchico edu


From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Greg 
Francis
Sent: Wednesday, January 06, 2010 8:32 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Discoverability of expired tapes?


Hello,

I have a question for those out there that may have dealt with this issue.

We have set our tape backups for our Exchange system to expire after 14-days. We keep no archives. This not only saved 
us a significant number of tapes and had negligible impact on our recoverability, but it also reduced our eDiscovery 
issues significantly. BTW, we don't  have a mail archiving solution in place.

What I just discovered in our backup system is that, even though the backups are expiring, until the tapes themselves 
are reused, the backup is still listed. The tapes are all marked as "expired" and are available for reuse but the 
actual session (we use HP Data Protector) doesn't purge from the backup software until all of the tapes for the session 
are used. In reviewing this, I discovered that three backups over the 14-day expiration period still have all of the 
tapes available so I could theoretically recover them if I had the need.

My question is this, since I can recover these backups, are they discoverable even though all of tapes are marked as 
expired?

BTW, I'm looking at ways to purge these sessions once they have expired but we're in a situation where we might not 
want to do that right now.

Thanks,
Greg


Greg Francis
Director, Central Computing and Network Support Services
Gonzaga University