IT DRILLDOWN
 
NEWSLETTERS
 

CIO.com updates, insights and advice on technology, management and your career.

 
 
 
LEADERSHIP
 
CIO Executive Programs
The Leader in Face-to-Face Education for Senior Executives

Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »

 
CIO Executive Council
A Peer-Advisory Service and Professional Association for CIOs

Social Responsibility's Strategic Benefits

December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)

Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.

Working With and Communicating to Your Board of Directors

January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)

CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.

IT's Role in Growing Mid-Market Companies

January 14, 4:00 PM - 5:00 PM ET (GMT-5)

Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.

More / Register »

Learn more about the CIO Executive Council »



 
 
RESOURCE CENTER
 
 
 
SUBSCRIBE TO CIO
 
Are you involved in setting the direction for your company's IT budget or strategy?

Apply today for a FREE subscription to CIO Magazine!

 
 

Data Security Tips for CIOs: Wiping the Hard Drive

A CIO responsible for donating end-of-life computers shares her experiences with data security technology and managing used technology in a secure and environmentally friendly way.

 

April 10, 2008CIO — Security issues are on the minds of all CIOs these days. Whether the CIO of a 1,300-student liberal-arts college or that of a 13,000-employee Fortune 100 company, never before has the issue of data security been more important. Besides a record-breaking year of data breaches, legislation such as Sarbanes-Oxley, Gramm-Leach-Bliley and HIPAA mandates new security protocols that must be followed or violators face severe penalties.

At Catawba College, network, computer and information security concerns have been a major focus of our information technology work for the past several years, as evidenced by our campus-wide 802.1x network authentication and our CatNet Connect process to clean and secure student computers before allowing them to connect to the residence hall network.

As we faced the prospect of a hardware refresh for about 500 personal computers on campus, it was only natural for us to be concerned about how to dispose of the outgoing equipment in a secure and environmentally friendly way. For the environment's sake—and to benefit the community—we decided to donate our used equipment to a local organization that trains middle school and high school students to refurbish computers, which are then donated to needy families. From an information security perspective, it was essential that we ensure all confidential data was completely eliminated from the hard drives in a manner that would preserve the drives. (also read Is Your Hard Drive Data Really Gone?)

As we investigated ways to completely remove the data from hard drives in a nondestructive manner, we immediately eliminated two options—degaussing and mechanical destruction—because both failed to meet our reusability criteria. The magnetism of degaussers destroys the read/write head, rendering the hard drive inoperable. And mechanical destruction is very harmful to the environment because it requires drives to be ground into tiny pieces, releasing a variety of toxic chemicals.

Although they passed the reusability test, the software overwrite methods we had traditionally been using to clear hard drives fell short in some key areas. First, these methods are labor-intensive and very time-consuming. A typical 120GB hard-drive triple-overwrite process can take four hours or longer to complete and the process must be physically monitored for security purposes. Second, these methods lacked the level of automated logging that we required. For information security and auditing purposes, it was imperative that the hard-drive sanitization procedure be completely documented, without exception, and without the possibility for error.

Ultimately, we chose the Digital Shredder, from Ensconce Data Technology. The Digital Shredder is about the size of an average suitcase, has a familiar touch-screen interface and accommodates up to three hard drives. It sanitizes drives by activating the Secure Erase technology built into the hard drives by the manufacturer.

Secure Erase is a very fast method of nondestructive drive sanitization. It is defined by NIST SP 800-88 as "purge" technology and is recommended as the best nondestructive method available for sanitizing hard-drive data. Security measures include three independently locking hard-drive bays, as well as detailed audit logs. And printed certification labels are produced automatically upon a successful sanitization, which provides an easy way to inventory and track our drives. And the Digital Shredder's reformatting and image capability allows our IT staff to quickly and easily apply the standard software install to machines when receiving new hard drives or redeploying hard drives throughout the network.

Although our major technology refresh is now behind us, the many lessons we learned during the process have paid numerous dividends, including piece of mind for data security and the satisfaction of doing our part in helping others, as well as protecting the environment.

Joanna Jasper, CIO, directs the information technology programs at Catawba College in North Carolina. Previously, Jasper was an assistant director of business computing at Wake Forest University and a senior software engineer for a higher-education enterprise resource planning software vendor.

© 2008 CXO Media Inc.
Loading...
 
 
CENTER OF EXCELLENCE
 
Security
» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.
» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.
» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.
» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.
» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.
Center sponsored by

 
 
ABCs
 

Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.

Over 25 tutorials on everything from business intelligence to virtualization.

 
 
FEATURED SPONSORS
 
 
 
SPONSORED LINKS
 

Integrating ActiveRoles With IBM Tivoli Identity Manager 5.0

Quest Authentication Services: Simplify Identity Management

Check Point Endpoint Security - Unifying Essential Components

Gartner on Data Deduplication Cost Savings

Data Protection Options Explained

Unified Communications & Collaboration: Game-Changing Business Results

7 Requirements of Data Loss Prevention

Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands

The Case for Business Software Assurance ~ Securing Your Applications

Forrester Total Economic Impact (TEI) report: Save Millions in Fraud Losses.

Get IDC's take on one company's foray into storage virtualization.

White Paper: Centralized Data Backup and Your WAN

White Paper: Accelerating the Next Phase of Virtualization

The Right and Wrong Master Data Management Strategies to Start Small and Grow Big

Find out why IDC thinks virtualization is changing operating environments.

Explore the impact virtualization can have on your bottom-line.

Save with 0% Lease Offer on HP Servers and Storage

How RFID Improves Data Center Efficiency

Find out how to manage virtualization's risks and reap the rewards.

Conquer the realities of managing virtualization

Improve Web-Enabled SAP Performance

Remote Infrastructure Management - What Your Peers are Thinking

Complementary BI: The New Approach to Business Intelligence

Expand High-Performance Computing (HPC) Capabilities

Power the Platform of Choice for Virtualization in the Enterprise

Quest Authentication and IBM Tivoli Identity Management

Revolutionizing Endpoint Security with a Single Agent

Laptop Security: Where Do CIOs See Weaknesses?

Achieve a 50:1 Data Deduplication Ratio

Examine security implementations based on six key criteria.

E-LOAN Maintains Reputation as a Privacy Leader with Symantec

Information Security: Data Drains and How to Prevent Loss

Prudential Financial Protects its Brand with Symantec

Solving Online Credit Fraud Using Device Reputation

Operational Excellence Is Key to Maximizing IT Investments

Data Protection: Challenges for the Traveling User

Learn how wide-area data services can help deliver the benefits of virtualization

Learn how companies are changing how they reach out to their most profitable customers.

Learn how to leverage virtualization for a 74% savings in TCO.

Find out how you can affordably consolidate applications with VMware.

ESG Research on Server and Storage Virtualization

Data Center ROI with RFID Asset Tracking

Get help navigating the management challenges of virtualization.

Narrow the gap between virtualization's benefits and the management risks.

Cash in on the promise of virtualization

Determine the ROI of Web Application Acceleration Managed Services

Webcast - "Into the Wild: Managing Laptops Outside the Office"

5 Steps to Successful IT Consolidation

High-performance computing is no longer just for Big Business

Leading university calls on Nokia for mobile unified communications.