Preparing for the end

Abstract

Failing to ensure correct disposal (and retention) of information assets has caused significant data leaks for numerous organisations. Increased legal and regulatory powers and attention, media interest and formal compliance regime requirements all mean that this often neglected area deserves the same consideration applied to more in-vogue aspects of security. It should be incorporated into organisational policies and processes as well as specifically considered as part of infrastructure and location projects. Destroying stuff, while occasionally satisfying in a mindlessly violent way, is an important but often neglected aspect of information security. Whether you are considering the physical destruction of defective equipment, the sanitisation of corporate data before publication or how to ensure that your suppliers do not accidentally release your sensitive data to the world and its dog, proper disposal of information assets is both critical and easy to get horribly wrong.