In the television show “Fear Factor,” people do foolish things for money. While the stunts are ultimately harmless, one may question whether eating worms or sticking one’s head in lard for a cash reward is worth it.
In the technology arena, there’s a similar activity going on. But in this case, the actions are more careless and the outcome more devastating. This is the practice of selling used back-up tapes.
Many organizations have unwanted back-up tapes gathering dust. At first glance, if someone wants to pay you to take away your junk, you jump at the opportunity. But there is a massive difference between a carton of old Reader’s Digests and a carton of old back-up tapes. While the buyer is paying about the same for each carton, there is a significant security problem in sending terabytes of corporate data on old tapes to the junkyard.
Buyers will pay cash for all types of tapes, cartridges, reel tape and other magnetic media. What seems like a good way to clear out a crowded data center is a serious security risk.
These data tapes have gigabytes of data per tape. Sell all of your used tapes, and petabytes of data is going out of your organization into the void. This is a huge security risk, all for a tiny amount of money. Hopefully, the CISO or at least legal counsel will stop any sale of used back-up tapes.
There is absolutely no reason to sell tapes when the potential downside is significant. While the tape buyers guarantee they will erase or degauss the tapes before they are resold, the risk/reward calculation makes zero sense. Short of a court order, you should never ever give data tapes to anyone outside of your organization. (See related story, Telling tales of the tapes)
All of this demonstrates why it’s important for organizations to have industrial destruction policies and procedures. It is not unusual for a company to have tens of thousands of hard drives, data tapes and other electronic media that should be destroyed once they are no longer needed. The only way to completely ensure that the data is unrecoverable is by physically destroying the media. Industrial-strength shredders and disintegrators from companies such as Security Engineered Machinery easily can destroy physical media so that recovery is impossible.
From a policy perspective, it is crucial that organizations ensure that media is not be released or resold under any circumstance. This makes sense from a practical perspective because most tape resellers will pay only a dollar or so for each used tape.
Companies blindly sell their used data tapes because they don’t understand the inherent risks involved. Selling used media puts an organization at risk and has zero benefit. For want of a nail the kingdom was lost. Don’t let your valuable corporate data be lost. Sometimes it’s better to destroy rather than recycle.
Rothke is a security consultant in New York with ThruPoint and author of Computer Security: 20 Things Every Employee Should Know. He can be reached at ben@rothke.com.
