1. Data Destruction Expanding Business Opportunities Dag Adamson LifeSpan Technology Recycling

2. Agenda Differentiation & Roles of Certifications AAA NAID Certification & Best Practices Benchmarking Sanitization Technologies Physical Destruction Technologies Industry Convergence

3. Differentiation & Role of Certification “My laser printer prints a certificate as good as yours” Stakeholders –Customer – what’s the difference? –Vendor – better than the next guy – we want to sell value –Industry – responsible professional Certification –Performance Approval –Audit Largest Purchasers – Drive the Industry –Government –OEM’s

4. Present / Next Generation A Perspective: Load up the CDs and disks - turn it on Throw it in the shredder New Business Paradigms: Audit and Compliance Breach Notification Liability On-site Sanitization and Physical Destruction

5. AAA NAID Highlights - Personnel Access Individuals & Employees –I-9 –7 yr Criminal SS Header Search State and Co Annual re-search –Drug Testing Continuous Sampling Requirements –Identification Badges / Uniforms

6. AAA NAID Highlights - Infrastructure Security in Transit Infrastructure Security –Destroy vs. Sanitize –Perimeter (s) Security Systems –Physical and Surveillance –Working? –Tested? –Logs

7. AAA NAID - Process Staging Acceptance Wiping / Destruction Technology Recovery Verification Quality Control Tagging Record Keeping Receipts – customer and vendor

8. Benchmarking Sanitization Hardware –Use Re-purposed PCs / Storage arrays –Hard Drive Manufacturer Test Equipment –Specialized Sanitization Equipment Software –DOD 5220.22.M –NIST 800-88 –Benchmark Data - samples

9. Hardware - Repurposed Pros: Inexpensive Readily Available Simple Cons: Reliability Power consumption SCSI / FC Speeds Connectivity Portability

10. Hardware – Hard Drive Mftr Test Equipment Pros: Inexpensive Built for large volume Fast (sometimes) Cons: Sourcing Configuration

11. Hardware – Specialized Sanitization Equipment Pros : Built for the job Fast Smaller Footprint / Power Portable Cons : Pay

12. Sanitization Software – DOD 5220.22.M 1995 – Table referring “clear” “sanitize” –“write all data with a single character, its compliment, and then a random character” 2006 –1995 - Hereby canceled – No table, No reference to “triple pass” –Comments from Simpson Garfinkel 2006 NIST 800-88

13. Sample Benchmark 8hr 49min3hr 7min3hr 2min47min 28sec54min 58sec27min 30sec KROLL ONTRACK v3.04 5hr 32min2hr 3min3hr 40min 24sec45min 9sec1hr 15min19min 17sec EBAN v2.1 5hr 16min1hr 56min3hr 37min 34sec 34min 6sec 1hr 6min 39sec18min 6sec DBAN v2.0.0 1day 8hr 19min5hrs 11min2hr 34min26min 18sec55min 43sec13min 6sec KillDisk v5.1 6hr 19sec2hr 6min1hr 28min27min 49sec39min 20sec13min 7sec White Canyon WipeDrive Pro 5.0 3xPass1xPass3xPass1xPass3xPass1xPass 146GB SCSI 80GB SATA 40GB SATA

14. Sanitization Benchmark MOTHERBOARD VENDOR MOTHERBOARD MODEL PROCESSOR CPU SPEED RAM ADAPTER SATA WIPE STATION SUN MICROSYSTEMS SUN ULTRA 40 WORKSTATION 2 x AMD OPERTRON 254 2800MHz 4GB DDR2 PC3200 4SATA EMBEDED CONTROLLERS SCSI WIPE STATION HEWLETT PACKARD HP SYSTEM BOARD Pentium 4 1600MHz 374MB 133mhz Adaptec AHA-2940W Sparcstorage Multipack 6-slot library/array

15. Physical Destruction Big ones, Little ones, Fat ones too… Shredding / Shear –5 HP and up –Hydraulic Hammer Mills –Disintegrate Crushing –Single / Multiple –Manual

16. LifeSpan Technology Recycling LifeSpan Technology Recycling has principal offices in Boston, Omaha, Denver, and San Diego providing I.T. investment recovery and recycling services through a network of 20 processing facilities nation wide. LifeSpan’s focus is to reduce their customer’s environmental, privacy, and reputation risks associated with IT asset disposal by using best management practices. Dag Adamson LifeSpan Technology Recycling 617 513 1182 dag.adamson@lifespanrecycling.com