The Dangers Of Inadequate Data Disposal

Leading professional services firm Alvarez & Marsal  (A&M) has released findings by its Disputes & Investigation practice regarding in-depth forensic analysis conducted across six used devices purchased on an online marketplace. 

The project’s aim was to expose the dangers of inadequate data disposal in business and private settings and demonstrate how failure to properly dispose of redundant IT equipment can lead to data breaches, which not only violate data protection laws, but can also result in financial fraud, with devastating impacts on companies’ finances and reputation.

The analysis found sensitive and highly personal data had not been deleted from old devices.

  • Thousands of sensitive documents recovered from the laptops purchased online which their owners believed to have been ‘wiped’.
  • Personal data found across 80% of devices searched.
  • 366 files recovered contained business-related keywords.

A&M was able to recover 5,875 user-generated documents across the six devices. The majority of those items came from carved data (i.e., deleted data on the hard drives of the laptops), with a few documents still sitting on the hard drives, undeleted. 

Most of the data recovered by the A&M team contained highly personal and sensitive information; such as scans of valid passports, as well as various appraisal forms and job application forms detailing personal identifiable details including full names, National Insurance numbers, addresses, emails, date of births and other sensitive data. 

In addition, 366 files analysed on the devices by the A&M team included business-related keywords.  Graeme Buller, Director at A&M, explained: “The rise of bring-your-own-device (BYOD) and remote working are increasingly blurring the lines between personal and business use of devices, exacerbating concerns around data security and the lifecycle management of IT assets... While only 6% of the files recovered in our analysis contained business-related information, the very fact that they made their way onto these personal devices is sincerely worrying. If released into the wrong hands, even what appears to be small, harmless data can have devastating impact on a company.”

Other insights from the document recovery included:

  • 155 documents had references to the term “invoice”.
  • 100 documents had references to the term “court”.
  • 84 files recovered contained the keyword “report”.
  • 23 files recovered mentioned the word “appraisal”.
  • Images were found that consisted of workplace building ID cards, salaries of employees, invoices, and other internal business correspondence.
  • Of the 5,875 documents which were retrieved from the PCs, 366 files included work-related keywords and 4% contained residual data that had been improperly deleted.
  • Web-related items accounted for 16% of overall data.
  • 2,111 email items were found.

Much of the that data A&M captured was done using software that is widely available to anyone and highlights how vulnerable many office devices really are - even when they are believed to be ‘clean’.  

The key here is making sure all devices are wiped correctly and observe a rigorous data disposal management process and A&M recommend these 5 best practice tips when managing data disposal:

1.  Strongly enforce data security policies:   To prevent sensitive data from being transmitted outside of secure environments at the first place, company emails and documents should ideally be kept in a secure location and never saved locally to a machine or device.

2. Establish and maintain a secure data destruction policy:   There should be policies and procedures in place that relate to the secure destruction of data. There should be alignment between Legal, Risk, HR and IT departments to ensure consistent flow of information and to provide clarity around roles and responsibilities for those involved this process.

3. Adapt policies for the new business reality:   Data disposal policies must be updated to reflect the current remote working environment. New considerations should include how to ensure devices are handed back when an employee leaves the firm, or how to remotely wipe IT assets if they refuse to return the device or in case of loss/theft/replacement. One alternative is to create incentivised pathways for staff to dispose responsibly.

4. Ensure all data is securely and effectively wiped:   Deletion and formatting – including factory-resets - do not permanently remove the data from the devices. Data sanitisation practices including the use of specialist software should be introduced to ensure all data is properly wiped and cannot be recovered by hackers.

5. Ensure companywide training:   Ensuring all employees get sufficient training around data destruction, and indeed are educated on the correct way to save data, is key. This should be training across the board and regularly updated to remind employees of the correct procedures, especially as tech continues to evolve. 

In the case of GDPR compliance in Britain, unnecessarily holding on to personal data, runs the risk of fines and likelihood of ICO enforcement action if that data is then involved in a privacy breach.

 Buller concludes: “As our study demonstrates, failure to properly dispose of redundant IT equipment may well lead to data breaches which not only violate data protection laws, but can result in financial fraud, with devastating impacts on a company’s finances and reputation.”

Alvaraez & Marsal:

You Might Also Read: 

Police Get New Tools To Process Digital Evidence:

 

« CYRIN Launches New Docker Lab
Russia’s Cyber Strategy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CCL Solutions Group

CCL Solutions Group

CCL is one of Europe’s leading digital investigation specialists, supporting law enforcement, government and organisations across both public and private sectors.

Cast Software

Cast Software

CAST is a pioneer in Software Analysis and Measurement (SAM) to capture and quantify the reliability and security of business applications.

Schneider Electric

Schneider Electric

Schneider Electric develops connected technologies and solutions to manage energy and process in ways that are safe, reliable and sustainable.

HYPR

HYPR

HYPR Decentralized Authentication minimizes the risk of enterprise data breaches while providing an enhanced user experience for your customers and employees.

Wüpper Management Consulting (WMC)

Wüpper Management Consulting (WMC)

Specialized in compliance, risk management and holistic information security WMC GmbH has longtime implementation experience in global projects.

Armorblox

Armorblox

Armorblox stops targeted email attacks such as 0-day credential phishing, payroll fraud, vendor fraud, and other threats that get past legacy security controls.

HumanFirewall

HumanFirewall

Your secuirty is dorectly proportional to the awareness of your employees. Use Phishing simulation across your organization to train & profile user behavior.

OXO Cybersecurity Lab

OXO Cybersecurity Lab

OXO Cybersecurity Lab is the first dedicated cybersecurity incubator in the Central & Eastern Europe region.

Hubraum

Hubraum

Hubraum is Deutsche Telekom’s tech incubator, helping startups to create new business opportunities in areas including data analytics, AI, robot process automation and cyber security.

Lionfish Cyber Security

Lionfish Cyber Security

Lionfish Cyber Evolution & Empowerment Model™ empowers SMBs to prepare and protect themselves against cyber threats using a unique combination of on-demand training, support and managed services.

HancomWITH

HancomWITH

Hancomwith is an information security company. We provide optimized blockchain solutions in areas including next-generation authentication, security and digital asset transaction.

MalwareFox

MalwareFox

MalwareFox is an advanced, yet simple-to-use anti-malware solution for Windows computers. We provide aggressive detection capabilities and an effective malware removal tool to keep your systems safe.

HALOCK Security Labs

HALOCK Security Labs

HALOCK is an information security consultancy providing both strategic and technical security offerings.

Strata Identity

Strata Identity

Strata is pioneering identity orchestration to unify on-premises and cloud-based authentication and access systems for consistent identity management in multi-cloud environments.

Saudi Information Technology Company (SITE)

Saudi Information Technology Company (SITE)

SITE is a forward-thinking enterprise, which aims at revitalizing Saudi Arabia’s digital infrastructure, cybersecurity, software development, and big data and analytics capabilities.

Boltonshield

Boltonshield

Boltonshield provide a unique and proactive approach to cyber defence with managed security services, integrated technologies, and a team of security experts, ethical hackers and analysts.