• Reassess costs
• Explore equipment reuse and resale
• Understand social and environmental factors that are driving the need for a change.
• Confirm that you can still minimise data security risks.

The ITAD Cycle: why is it vicious?

IT teams will almost invariably have responsibility for managing retirement of IT assets, but the disposal method is usually dictated by security. This relationship is the hub around which ITAD challenges cycle.

Device procurement and use has fundamentally changed (bigger end user storage, shorter upgrade cycle, less in-house server-side, fewer desktops, more mobile devices) so why haven’t ITAD policies changed?

• Security risk aversion – There is a disproportionate belief that destruction of hard drives and other storage media is the only way to adequately mitigate the risk of data disclosure or theft.
• Immature data governance – Data governance at most firms is still relatively immature. It is therefore hard to confirm, with a high degree of confidence, whether retired devices will or won’t contain personal, company confidential, or secret data. IT teams will therefore follow the security path of least resistance.
• Lack of motivation to rock the boat – This has gone on for so long the budgetary burden of storage, destruction, and device recycling just feels (to everyone) like a cost of doing business.
• The consumer driven ITAD market – Most of the ITAD market, led by consumers, aims to destroy and recycle kit as quickly and cheaply as possible. There is little motivation to provide more financially, environmentally, and socially sustainable alternatives.

Alternatives are out there. Alternatives that allow you to recover a significant portion of the depreciated cost of retired equipment, while effectively controlling data related risks, and limiting the amount of material that just ends up in landfill, but ability to take advantage of that does depend significantly on your own asset management and disposal due diligence.

Why co-operate to break the cycle?

This impasse is primarily about data security. After all, as we said before…

…data can never be fully erased

The inevitable image conjured is a CSI Cyber-like scene. The bad guys scrambling to securely wipe their disks while the feds batter down their door. Then, back at the lab, after a bit of cyber jiggery-pokery, all of the deleted data magically reassembles before the agent’s eyes. The only reasonable mitigation for the 1337est crims? Acid baths, drilling drives, or setting it all on fire.

Copyright : Weerapat Kiatdumrong

It is a tough thing to counter, especially when the ‘default to destroy’ policy guarantees that all data, along with reusable kit, is gone. Why would overburdened IT and security professionals dedicate time to researching this with a view to reconsidering?
The fact that your firm likely doesn’t have the same risk profile as an activist trying to hack the NSA is one point, but there are a bunch of other more mundane reasons to invest time in researching alternatives:

3 Big reasons to reuse and resell:

• Money – Refurbishing, repairing, reusing, and reselling retired devices can slice up to 30% off an annual ITAD bill if all you do now is destroy and recycle.
• The Environment – Equipment ending up in landfill, or being part recycled (not much is) adds up to a shocking waste of reusable materials and is environmentally irresponsible.
• Social Responsibilityy – Recycling is a dirty and increasingly difficult job. Worker conditions and pay are serious ongoing concerns, especially with decreasing returns putting pressure on paymasters.

Risk reality vs historical justification

So, first things first, let’s tackle the “Data can never be fully erased” statement. Primarily it is just that, a statement…and a debatable one. Businesses need to manage risks to keep them within a reasonable risk appetite, not build policy around loudest concerned voices.
No-one ever solved a problem without defining it first, so here we go:

The device resale or reuse risk articulated:

Theft of, or access to data on erased devices

Let’s say, for the sake of argument, even best attempts at overwriting data on storage devices leave remnants behind. Remnants that may, if the digital puzzle pieces can be put back together, reveal some personal, company confidential, or secret information. Here are two key data theft incident scenarios to consider:

1. Opportunistic data theft – A malicious actor randomly acquiring lots of old kit, or having a rummage around in devices they happen to lay their hands on, in the hope that one or more of them will reveal some useful data.
2. Targeted data theft – A malicious actor targeting an ITAD firm and stealing drives or devices because they have confirmed that drives contained personal, company confidential, or secret data.

Pivoting to look at probability, you MAY have a problem on your hands IF:

That’s a lot of ‘IF’s

When calculating the probability of a number of consecutive dependent events, you estimate the probability of the first event (often as 1 in Xyrs. or 0.X events in 1yr). Then reduce the overall likelihood of incidents by multiplying by the probability of all subsequent events.
It doesn’t take a statistician to work out how extremely unlikely it is that all of the above factors will fall in the targeted attacker’s favor. How likely is it that A. they can get hold of something readable and B. they can then use that data to cause anyone any real impact.
But those are not the only scenarios.

Theft of, or access to data on pre-erasure devices

This is the key risk around IT Asset Disposal: losing track of assets that are yet to be erased. This is is what persuaded me to publish the post after all this time. Asset management and other vulnerabilities exploited by threat actors to cause this kind of fallout:

---

NCIX DATA BREACH – Millions of Canadian and American consumers are now at risk thanks to a series of shady backroom deals that have resulted in records detailing 15 years of business being sold.

Travis Doering, Privacy Fly – 9/18/2018, 9:32 PM

---

A tale of kit liberated from a bankrupted rightful owner by a third-party and sold to the highest bidder. Kit holding LOTS of data and with an exploitable connection to other available machines. Kit that came to the person posing as buyer complete with a set of valid admin credentials. In this scenario, as any security pro worth their salt will tell you, all bets are off. You just buckle up for the incident management ride.

Defining the scenario:

Setting aside that brutal example of what can go wrong and what we all have to lose, this very basically defines the scenario to try and explore risk management and mitigation.

1. Opportunist or Targeted data theft from pre-erasure devices – An opportunist, career criminal, or member of ITAD staff, obtains drives or devices BEFORE they have been securely erased or destroyed. If the data is unencrypted, intact, valuable, and attributable, it may enable malicious actors to perpetrate a data related crime, or otherwise disadvantage or threaten the ITAD company, you or your customers with a damaging leak. Even in absence of exploitation, discovery of the breach may result in significant financial penalties or other sanctions from regulators, or potentially impacted parties.

This is not just a resale and reuse risk. It is a risk for all data processing and disposal operations. Kit needs to stay where it’s put in your data centre, or wherever you outsource hosting. It then needs to get safely from its operational origin, to wherever it goes to be decommissioned, then from that location to an ITAD provider, and remain secure until kit is destroyed or data securely erased.

What is the mitigation?

• Your asset management both in-house and by third parties.
• Your due diligence when selecting 3rd party data processors and ITAD providers. How well is your chosen ITAD provider doing? How robustly and consistently are they implementing controls that make reuse and resale of retired kit an acceptable risk?
• The provider’s information security, physical security, business continuity, and disaster recovery controls. Especially staff security, network security, system security,access security, and asset management controls.
• The same controls for any subcontractors used by your third parties and the ITAD provider.

What, in broad terms, is ITAD good practice?

NOTE: As mentioned at the start, this post was originally drafted in 2016. Links have been checked, but some more up to date sources might be available.

Data Erasure

ITAD companies should erase data to Department of Defence (or UK Ministry of Defence) standards. The most common broader standard adhered to is NIST 800-88 (revised in 2014). The most common practice is overwriting data on every drive sector one or more times. If sector by sector overwrite verification shows issues, further overwrites should be carried out. If that fails other methods can be tried. Destroying a drive need only be by exception. Blancco systems are generally recognised as the gold-standard for automated erasure as they exceed all government and private sector requirements.

Solid State Drives (SSDs)

A few years ago this mainly applied to flash or ‘thumb’ drives, but smartphones tablets and ultra-thin laptops have dramatically increased the use of high-capacity SSDs. As for HDDs, all sectors are overwritten and individually verified as being unreadable. Exceptions do still happen. If a sector overwrite fails after multiple attempts, the next most likely steps are hardware layer or cryptographic erasure. The latter involves deleting encryption keys stored on encrypted drives, along with content.

Other storage

What many people forget are the peripheral devices that have a storage capability including printers and copiers. It won’t stop there. On-board storage on these ‘Things’ can be wiped in the ways described above…if clients remember to ask their ITAD vendor to deal with them.

Bad Press for Solid State Storage Erasure

Let’s be honest, SSD erasure has had some bad press, notably this 2011 research paper. It called out erasure failings, but mainly using tools shipped with devices and other wiping means on the open market. They called out problems finding and removing traces of files that had been selectively deleted from disks. It comes down to how SSDs write to disk. Data gets stored electronically rather than magnetically and it is written and moved around in a far less structured way. This can leave ‘remnants’ throughout the drive. Full disk overwriting also came under fire, but less so.

But Things Change…

SDD technology is still evolving, but, as with historical evolution of HDDs the trend is towards making data easier to reliably locate (and therefore erase) and it has been 7 years since that paper was written. A lot can change in 7 years, especially in the world of technology. In 2013 Blancco released it’s new automated SSD erasure solution. It has been verified as leaving no trace of confidential data under deeply invasive laboratory tests. This is not promoting Blancco, it is just a way to underline that problems do get solved and things move on. If doing your own assessment of risks, by all means dig for more recent validated tests of deletion adequacy.

Destruction

Destruction happens under very similar process and control circumstances to erasure. A variety of methods may be used. Shredding is the most common with careful verification that destruction has reduced the drive to a state where individual pieces cannot be put back together to enable data to be reconstituted. That verification plus careful asset management are the crux of good control.

Recycling

By the most generally accepted definition this conjures up an overwhelmingly positive feeling. Taking potential landfill and retrieving useful components and raw materials. Things that can be given a new life and at the same time take pressure off dwindling natural resources.
Financial return from recycling is also a fundamental part of ITAD firm revenue, but how socially and environmentally sound is it?

Environmental and social considerations

Reputable firms should not incinerate e-waste or dump it. Air pollution or ground and water pollution from degrading components, can have a significant environmental impact over hundreds of years. Those things are outlawed in the main, but US state laws can vary significantly. The vast majority of firms won’t contravene these laws because of either ethics or the threat of sanctions, but the motivation to sidestep controls is significant.
There are international laws in place to prevent companies taking advantage of cheap and vulnerable overseas workers including children and prisoners. The Basel Convention, an international treaty under the United Nations, forbids the trade in toxic materials, including e- waste, between developed and developing countries.
There are many competing reasons for less reputable firms to bend or break laws. Laws that are applied variably across US states permitting more leeway than is granted to the vast majority of other countries. These are the two key independent regulatory hooks for international IT asset disposal.

The E-Stewards programme and R2

Extended Producer Responsibility

ERP programmes (here is an overview from the OECD) are another pillar of intended defense against an unsustainable ITAD world. The concept is to require producers to shoulder a fair proportion of the eventual disposal burden to encourage the right sustainable and recyclable design considerations and investment in efficient disposal mechanisms. Needless to say that hasn’t, especially in the US, been the case. Instead the producer contribution has been minimised as far as possible, especially by the biggest firms, with the remaining burden handed over to consumers through increased prices. Here’s more on that from Sage SE’s blog

Capital equipment investment

High throughput recyclers (as opposed to smaller shops who might spend significant time extracting parts that have a good resale/reuse value) will have invested millions in infrastructure that quickly breaks kit into raw material and waste. Materials, including precious metals that they have to pay other firms to recover, further squeezing margins.
Having bet the farm on this business model they have little motivation to differentiate between kit destined to be ground up and kit that could return significantly more value to clients while reduce unusable waste. An idle recycling machine costs money and customers are not pushing for things to change.

Rapid firm failure due to high competition and low margins

Another key consideration is the viability of ITAD companies. With that big capital investment in high-throughput recycling equipment, or the effort overhead for small shops who painstakingly recover reusable materials, many firms don’t last long. That often results in stockpiles of kit being left in storage units. There are also plenty of examples of firms liquidating and reinventing themselves, leaving pre-existing customers struggling to get legal recourse or kit returned, a risk no-one should underestimate.d
None of that encourages R&D…but all of it is a driver to find cheaper or even legally questionable ways to make ends meet.

How do we manage the risks?

Asset Management

Most data goes missing or falls into the wrong hands because companies fail to keep track of it. Off-network data can be a particular weak spot. You, your 3rd party data processors, and ITAD companies should have policies, robust procedures, and scrupulous record keeping around all of the following:

• Safe transport
• Safe storage
• Unique asset identification
• Evidence collection and retention to prove an unbroken chain of asset custody
• Processes controlling unauthorised outside or insider access to asset inventories,workflow logs and physical areas.
• Monitoring for exceptions and anomalies in asset inventory contents, workflow records and physical/system access logs.

As with most risks, device loss or theft gets harder to prevent the more motivated and expert the attacker. There should be robust and well-practiced incident response plans for common device loss or theft scenarios, but cost/benefit for protective and detective controls is down to the relative risk of loss, theft, or misuse in a given situation, and the balance you have to strike with getting your job done.
All the hosting locations I’ve been to stop just short of a strip search, there’s a camera every 10 paces, mantraps between you and the cages, and every visit requires 24 hour notice with photo ID. You would expect something similar for an ITAD provider’s pre-erasure kit stores, but you can’t enforce that for every area of offices despite the fact you could scoop a few phones or laptops after a single circuit. Do you effectively compensate for that residual risk?

Supplier selection and due diligence

If you have flexible ethics and huge legal indemnity insurance it is ok to pick the first ITAD firm that ranks well on Google. Otherwise, a big part of supplier selection should be ensuring they adhere to one or more industry standards for responsible practice and have a sustainable business model that offers alternatives to recycling. That’s aside from more general due diligence around their financial health as a firm, their data protection capabilities, and the state of their security control. As regards social responsibility, the most stringent regulations that companies can chose to adhere to are the ones mentioned before:

• E-Stewards – The Basel Action Network website. BAN created the E-Stewardship programme.
• R2 – Sustainable Electronics Recycling Internationald. SERI oversee standards and certification for R2.

Ongoing supplier governance

Like any other supplier that handles your data, you should establish a good relationship, foster trust, but then verify how well they have implemented and are running controls. Assess the inherent risk they can cause your business, then decide on appropriate governance. Given the ITAD business model, you might want to rethink how vendor governance work is scoped if they don’t come out as priority to look at.
Due diligence and regular ongoing assessments should not just focus on erasure and recycling methods. Look at all layered controls that can influence security of your assets. In particular the on-going effectiveness of all the asset management controls listed above.
Things will go wrong. No process or system is 100% reliable. It is not about incidents happening (unless there is a concerning trend), it is about how they are dealt with. You need to state in contracts that ITAD vendors must notify you promptly and have a robust incident response plan in place. Their ability to quickly and effectively investigate and mitigate impact any impact on you depends enormously on robustness of the aforementioned asset management controls.

Data Governance

If you are now convinced that destruction is not the only way, you may still want a belt and braces approach to your most sensitive data. The problem: most firms do not have an adequate handle on where it is, or even what it is.

Structured Data