Presentation on theme: "Information Security At The End Of The Life Cycle: Computer and Media Disposal Chuck Elliott, MS, MCP Director, Customer Services Marshall University Computing."— Presentation transcript:
Information Security At The End Of The Life Cycle: Computer and Media Disposal Chuck Elliott, MS, MCP Director, Customer Services Marshall University Computing Services email@example.com This presentation online - http://users.marshall.edu/~celliott/Security06.ppt Welcome to the EDUCAUSE Mid-Atlantic Regional Conference 2006
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 2 Copyright Notice Copyright Charles A. Elliott, 2006. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 3 What We’ll Talk About Today Marshall University’s IT Environment History of Computer Disposal at MU Proposal To Do Things Better Executing the Plan(s), Theory and Practice How We Do Business and the Technology Being Used More Media Types and More Security Concerns Media Wipers, Shredders, and Degaussing Solutions Results Q & A
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 4 Marshall’s IT Environment 16,000 students, 1100 faculty UCS Help Desk –5 full-time and 2 part-time –Monday through Friday 8am to 9pm –on-call during weekends –Documenting ~14,000 calls annually Current Supported Equipment –4770 Computers (approx. 225 Macs) –392 Printing Devices –66 IP Based Phones –377 Courtesy Jacks (Open To Campus Use) –48 Wireless Access Points –30 Video Conference Units –44 Card Readers –PDAs, cell phones, various removable media
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 5 How The MARC ’06 Audience Schools Are Disposing
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 6 History of Computer Disposal at MU How do other schools, colleges, and agencies dispose of their surplus computing equipment? At Marshall University…back in the day… Surplus and obsolete computers transferred to MU Receiving for public sale. The very popular biannual “Yard Sale.” Pros: –Low overhead –Departments received a share of their revenue Cons: –Information security breaches Grades SSN Exams Personnel appraisals Confidential memos –Software licensing violations Ownership changes often nullify license agreements
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 8 Proposal To Do Things Better Program initiated in December, 2002 –Jointly proposed by the VP for Information Technology and the VP for Finance Proposal outlined –University Computing Services (UCS) “process” all surplus computers –Receiving Dept collects and transports surplus equipment to processing location –Hold separate and frequent “Surplus Computer Sales” –UCS receives 60% sales revenue –Finance receives 40% sales revenue –…sounds feasible to everyone involved
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 9 Execution: Plan A (2003) Advertising and marketing plan –Informed all local vendors (mom and pop shops) –Established web site to publish details –Established e-mail list First Processing location: Drinko basement –Noisy, dusty, no environmental controls –Help Desk innovations In addition to cleansing, certification of equipment/components Provided some software licenses –First sale a huge success –All equipment in lots of 10 or more –Citizens complained “who in the bleep can use 10 computers?” –Second sale included individual units, another success! Fire Marshall spoiled the party
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 10 Execution: Plan B (2004) Moved surplus computer processing location to the Dewco building Pros –Great for staging equipment prior to sale –Easy access for buyers to pickup their goods –Conveniently co-located with 10,000 square feet of 3-4 years worth of very old computers, printers, terminals, copiers, medical devices, etc. Cons –Distance from campus –A roof but open-air (very nice Spring and Fall) –Lacked strong physical security
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 11 Execution: Plan C (present) New building acquired early 2004 –Renovations included lighting and roof –Dedicated area for surplus computer processing & storage –UCS moved in early 2005 –Includes small but enclosed 1-room building with phone, networking, power, and air-conditioning. –Co-located with Receiving Department Working well !! Next sale is March 20, 2006 and details will be available soon at http://www.marshall.edu/ucs/computersale/http://www.marshall.edu/ucs/computersale/
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 13 Theory and Practice In theory, there is no difference between theory and practice. But, in practice, there is. JAN L.A. VAN DE SNEPSCHEUT Dutch-American computer scientist and educator (1953 - 1994) In theory –With a 4 year lifecycle we should be processing 1,000 to 1,200 surplus computers annually, and –We should be, today, processing mostly Pentium III computers and some Pentium IV In practice –Majority of computers released for surplus processing are still below Pentium III –Annual processing of surplus computers is close to 800 up from approximately 400 a couple of years ago Contributing factors –Departments lack incentive to reduce inventory –Some departments appear to be keeping spares –Out of sight, out of mind (check your closets!)
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 14 How We Do Business Legal notice placed in multiple newspapers 2 weeks prior to sale –Listserve subscribers receive earliest warning 350 subscribers and growing Details on each lot or unit are posted on web, and used on bid sheets Sale dates are always on a Monday Bidders registration and viewing begins at 9am Secret bids accepted into bid box until 3pm Successful bidders notified on Tuesday Equipment must be paid for and picked up by Thursday No warrantees whatsoever. All equipment sold as is and where is.
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 15 Technology Being Used Symantec Ghost Corporate Edition 8.x –Gdisk, a disk-wiping utility that meets DoD 5220.22-M specifications and HIPAA requirements –Killdisk.com and others also offer suitable utilities for disk-wiping KVM switches –Keyboard, Video, and Mouse –Connects multiple computers Eight-way video splitter for testing monitors Web site is indispensable –We’re often #1 on Google –www.marshall.edu/ucs/computersale/www.marshall.edu/ucs/computersale/ Microsoft Excel 2003 –Special workbook created to help Purchasing Office quickly identify highest bids
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 16 Hazardous Materials (partial list) In Computing Equipment Lead –Lead can cause damage to the central and peripheral nervous systems, blood system and kidneys in humans. –Consumer electronics constitute 40% of lead found in landfills. –The main concern in regard to the presence of lead in landfills is the potential for the lead to leach and contaminate drinking water supplies. –Between 1997 and 2004, over 315 million computers will become obsolete is the USA. This adds up to about 1.2 billion pounds of lead! Cadmium –Cadmium and cadmium compounds accumulate in the human body, in particular in kidneys. –Between 1997 to 2004 over 315 million computers will become obsolete and this represents almost 2 million pounds of cadmium content. Mercury –When inorganic mercury spreads out in the water, it is transformed to methylated mercury in the bottom sediments. –Methylated mercury easily accumulates in living organisms and concentrates through the food chain particularly via fish. –Although this amount is small for any single component, 315 million obsolete computers by the year 2004 represent more than 400,000 pounds
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 17 Help Is Available Keeping computers and othe consumer electronics out of landfills is a growing problem, worldwide Businesses, most notably Dell and HP, are responding –http://msnbc.msn.com/id/5437079/http://msnbc.msn.com/id/5437079/ –Buy a new Dell and get free recycling None of the above will solve your information security problem !!
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 18 Legislation Is Coming Three states (MD, ME, CA) have legislation regarding disposal of electronic waste Four members of the U.S. House of Representatives have created the Congressional E-Waste Working Group to work on standardizing national laws for recycling and disposing of discarded electronic and computer equipment (source: PC World article)PC World article In many states there is no controlling legislation for keeping computers out of landfills –Landfill operators are regulated by EPA and will probably not let you dump a truckload of hazardous materials in their landfill –Residential garbage collectors can and do get away with it and good citizens will spread the word how bad this is for everyone None of the above will solve your information security problem !!
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 19 More Media Types and More Information Security Concerns USB drives –staggering growth of USB flash drives from 5 million units sold worldwide in 2002 to 46 million units in 2004 (Source: Gartner) has left many IT departments at odds on how to best tackle this useful, yet potentially risky appliance Some companies still opt to ban USB drives in their organizations. Floppies, Tapes, CDs and DVDs Memory sticks and SD cards Cell phones and PDAs –Messaging & Security Feature Pack for Windows Mobile 5.0, works with Microsoft Exchange 2003 SP2
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 20 Media Wipers, Shredders, and Degaussing Solutions Media Wiping Applications –KillDisk; WipeDrive; MediawiperKillDiskWipeDriveMediawiper –Look for those that meet HIPAA and/or DoD specs Shredders –Kobra 400C4Kobra 400C4 great for shredding CDs and DVDs –And the favorite of UCS Help Desk staff…SSI Shredders (watch the “computers (whole)” in action)SSI Shredders Degaussers and Hard Drive Erasers –http://www.magnetechcorp.com/Hard_drive_eraser.htmhttp://www.magnetechcorp.com/Hard_drive_eraser.htm –For every 3 min on need 27 min off -- due to heat If used properly, the above can help with the information security problem !!
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 21 Results Gartner Research estimates used computers sell for between 3-5% of original retail cost After selling a few thousand computers we are doing exactly as Gartner predicts UCS is almost recovering costs
EDUCAUSE Mid-Atlantic Regional Conference 2006Slide 22 Q&A Thank You!! Questions? This presentation will soon be posted on the EDUCAUSE web site and is online now at http://users.marshall.edu/~celliott/Security06.ppt http://users.marshall.edu/~celliott/Security06.ppt For more information or to request these slides send e- mail to: firstname.lastname@example.org@marshall.edu