Data Destruction Expanding Business Opportunities Dag Adamson LifeSpan Technology Recycling

Agenda Differentiation & Roles of Certifications AAA NAID Certification & Best Practices Benchmarking Sanitization Technologies Physical Destruction Technologies Industry Convergence

Differentiation & Role of Certification “My laser printer prints a certificate as good as yours” Stakeholders –Customer – what’s the difference? –Vendor – better than the next guy – we want to sell value –Industry – responsible professional Certification –Performance Approval –Audit Largest Purchasers – Drive the Industry –Government –OEM’s

Present / Next Generation A Perspective: Load up the CDs and disks - turn it on Throw it in the shredder New Business Paradigms: Audit and Compliance Breach Notification Liability On-site Sanitization and Physical Destruction

AAA NAID Highlights - Personnel Access Individuals & Employees –I-9 –7 yr Criminal SS Header Search State and Co Annual re-search –Drug Testing Continuous Sampling Requirements –Identification Badges / Uniforms

AAA NAID Highlights - Infrastructure Security in Transit Infrastructure Security –Destroy vs. Sanitize –Perimeter (s) Security Systems –Physical and Surveillance –Working? –Tested? –Logs

AAA NAID - Process Staging Acceptance Wiping / Destruction Technology Recovery Verification Quality Control Tagging Record Keeping Receipts – customer and vendor

Benchmarking Sanitization Hardware –Use Re-purposed PCs / Storage arrays –Hard Drive Manufacturer Test Equipment –Specialized Sanitization Equipment Software –DOD M –NIST –Benchmark Data - samples

Hardware - Repurposed Pros: Inexpensive Readily Available Simple Cons: Reliability Power consumption SCSI / FC Speeds Connectivity Portability

Hardware – Hard Drive Mftr Test Equipment Pros: Inexpensive Built for large volume Fast (sometimes) Cons: Sourcing Configuration

Hardware – Specialized Sanitization Equipment Pros : Built for the job Fast Smaller Footprint / Power Portable Cons : Pay

Sanitization Software – DOD M 1995 – Table referring “clear” “sanitize” –“write all data with a single character, its compliment, and then a random character” 2006 – Hereby canceled – No table, No reference to “triple pass” –Comments from Simpson Garfinkel 2006 NIST

Sample Benchmark 8hr 49min3hr 7min3hr 2min47min 28sec54min 58sec27min 30sec KROLL ONTRACK v3.04 5hr 32min2hr 3min3hr 40min 24sec45min 9sec1hr 15min19min 17sec EBAN v2.1 5hr 16min1hr 56min3hr 37min 34sec 34min 6sec 1hr 6min 39sec18min 6sec DBAN v day 8hr 19min5hrs 11min2hr 34min26min 18sec55min 43sec13min 6sec KillDisk v5.1 6hr 19sec2hr 6min1hr 28min27min 49sec39min 20sec13min 7sec White Canyon WipeDrive Pro 5.0 3xPass1xPass3xPass1xPass3xPass1xPass 146GB SCSI 80GB SATA 40GB SATA

Sanitization Benchmark MOTHERBOARD VENDOR MOTHERBOARD MODEL PROCESSOR CPU SPEED RAM ADAPTER SATA WIPE STATION SUN MICROSYSTEMS SUN ULTRA 40 WORKSTATION 2 x AMD OPERTRON MHz 4GB DDR2 PC3200 4SATA EMBEDED CONTROLLERS SCSI WIPE STATION HEWLETT PACKARD HP SYSTEM BOARD Pentium MHz 374MB 133mhz Adaptec AHA-2940W Sparcstorage Multipack 6-slot library/array

Physical Destruction Big ones, Little ones, Fat ones too… Shredding / Shear –5 HP and up –Hydraulic Hammer Mills –Disintegrate Crushing –Single / Multiple –Manual

LifeSpan Technology Recycling LifeSpan Technology Recycling has principal offices in Boston, Omaha, Denver, and San Diego providing I.T. investment recovery and recycling services through a network of 20 processing facilities nation wide. LifeSpan’s focus is to reduce their customer’s environmental, privacy, and reputation risks associated with IT asset disposal by using best management practices. Dag Adamson LifeSpan Technology Recycling