Information Security At The End Of The Life Cycle: Computer and Media Disposal

1. Information Security At The End Of The Life Cycle: Computer and Media Disposal Chuck Elliott Associate Director, Customer Services Marshall University Computing Services celliott@marshall.edu This presentation is online at http://users.marshall.edu/~celliott/ComputerDisposal.ppt

2. Agenda • Marshall’s IT Environment • History of Computer Disposal at MU • Proposal To Do Things Better • Executing the Plan(s), Theory and Practice • How We Do Business and the Technology Being Used • Hazardous Materials, Assistance, and Legislation • More Media Types and More Security Concerns • Media Disposal, Wiping Solutions, and Shredders • Q & A West Virginia Statewide Technology Conference 2005

3. Marshall’s IT Environment • 16,000 students, 1100 faculty • UCS Help Desk • 5 full-time and 2 part-time • Monday through Friday 8am to 9pm • on-call during weekends • documented 14,000 calls during FY04-05 • Current Supported Equipment • 4770 Computers (approx. 250 Macs) • 392 Printing Devices • 66 IP Based Phones • 377 Courtesy Jacks (Open To Campus Use) • 48 Wireless Access Points • 30 Video Conference Units • 44 Card Readers • PDAs, cell phones, various removable media West Virginia Statewide Technology Conference 2005

4. History of Computer Disposal at MU • How do West Virginia schools, colleges, and agencies dispose of their surplus computing equipment? • At Marshall University…back in the day… • Surplus and obsolete computers transferred to MU Receiving for public sale. The very popular biannual “Yard Sale.” • Pros: • Low overhead • Departments received a share of their revenue • Cons: • Information security breaches • Grades • SSN • Exams • Personnel appraisals • Confidential memos • Software licensing violations • Ownership changes often nullify license agreements West Virginia Statewide Technology Conference 2005

5. West Virginia Statewide Technology Conference 2005

6. Proposal To Do Things Better • Program initiated in December, 2002 • Jointly proposed by the VP for Information Technology and the VP for Finance • Proposal outlined • UCS “process” all surplus computers • Receiving provides transportation of equipment to and from processing location • UCS receives 60% sales revenue • Finance receives 40% sales revenue • Sounds feasible to everyone involved West Virginia Statewide Technology Conference 2005

7. Execution: Plan A (2003) • Advertising and marketing plan • Informed all local vendors (mom and pop shops) • Established web site to publish details • Established e-mail list • First Processing location: Drinko basement • Noisy, dusty, no environmental controls • Help Desk innovations • In addition to cleansing, certification of equipment/components • Provided some software licenses • First sale a huge success • All equipment in lots of 10 or more • Citizens complained “who in the bleep can use 10 computers?” • Second sale included individual units, another success! • Fire Marshall spoiled the party West Virginia Statewide Technology Conference 2005

8. Execution: Plan B (2004) • Moved surplus computer processing location to the Dewco building • Pros • Great for staging equipment prior to sale • Easy access for buyers to pickup their goods • Conveniently co-located with 10,000 square feet of 3-4 years worth of very old computers, printers, terminals, copiers, medical devices, etc. • Cons • Distance from campus • A roof but open-air (very nice Spring and Fall) • Lacked strong physical security West Virginia Statewide Technology Conference 2005

9. Execution: Plan C (present) • New building acquired early 2004 • Renovations included lighting and roof • Dedicated area for computer processing storage • UCS moved in early 2005 • Includes small but enclosed 1-room building with phone, networking, power, and air-conditioning. • Co-located with Receiving Department • Working well !! • Next sale is Sep 12, 2005 and details will be available soon at http://www.marshall.edu/ucs/computersale/ West Virginia Statewide Technology Conference 2005

10. West Virginia Statewide Technology Conference 2005

11. Theory and Practice • In theory, there is no difference between theory and practice. But, in practice, there is.JAN L.A. VAN DE SNEPSCHEUTDutch-American computer scientist and educator (1953 - 1994) • In theory • With a 4 year lifecycle we should be processing 1,000 to 1,200 surplus computers annually, and • We should be, today, processing mostly Pentium III computers and some Pentium IV • In practice • Majority of computers released for surplus processing are still below Pentium III • Annual processing of surplus computers is close to 600 • up from approximately 400 a couple of years ago • Contributing factors • Departments lack incentive to reduce inventory • Some departments appear to be keeping spares • Out of sight, out of mind (check your closets!) West Virginia Statewide Technology Conference 2005

12. How We Do Business • Legal notice placed in multiple newspapers 2 weeks prior to sale • Listserve subscribers receive earliest warning • 300 subscribers and growing • Details on each lot or unit are posted on web, and used on bid sheets • Sale dates are always on a Monday • Bidders registration and viewing begins at 9am • Secret bids accepted into bid box until 3pm • Successful bidders notified on Tuesday • Equipment must be paid for and picked up by Thursday • No warrantees whatsoever. All equipment sold as is and where is. West Virginia Statewide Technology Conference 2005

13. Technology Being Used • Symantec Ghost Corporate Edition 8.x • Gdisk, a disk-wiping utility that meets DoD 5220.22-M specifications and HIPAA requirements • Killdisk.com and others also offer suitable utilities for disk-wiping • KVM switches • Keyboard, Video, and Mouse • Connects multiple computers • Eight-way video splitter for testing monitors • Web site is indispensable • We’re often #1 on Google • http://www.marshall.edu/ucs/computersale/ • Microsoft Excel 2003 • Special workbook created to help Purchasing Office quickly identify highest bids West Virginia Statewide Technology Conference 2005

14. Hazardous Materials (partial list)In Computing Equipment • Lead • Lead can cause damage to the central and peripheral nervous systems, blood system and kidneys in humans. • Consumer electronics constitute 40% of lead found in landfills. • The main concern in regard to the presence of lead in landfills is the potential for the lead to leach and contaminate drinking water supplies. • Between 1997 and 2004, over 315 million computers will become obsolete is the USA. This adds up to about 1.2 billion pounds of lead! • Cadmium • Cadmium and cadmium compounds accumulate in the human body, in particular in kidneys. • Between 1997 to 2004 over 315 million computers will become obsolete and this represents almost 2 million pounds of cadmium content. • Mercury • When inorganic mercury spreads out in the water, it is transformed to methylated mercury in the bottom sediments. • Methylated mercury easily accumulates in living organisms and concentrates through the food chain particularly via fish. • Although this amount is small for any single component, 315 million obsolete computers by the year 2004 represent more than 400,000 pounds West Virginia Statewide Technology Conference 2005

15. Help Is Available • Keeping computers and othe consumer electronics out of landfills is a growing problem, worldwide • Businesses, most notably Dell and HP, are responding • http://msnbc.msn.com/id/5437079/ • Free recycling at Office Depot until Sep 6. • Buy a new Dell and get free recycling • In West Virginia, state agencies should West Virginia State Surplus for disposal assistance. 800-576-7587 • Ask for Mr. Ken Frye, Director • No charge to agencies required to use WV State Surplus • For recycling assistance in West Virginia contact the Solid Waste Management Board (Carol Throckmorton) • http://www.state.wv.us/swmb/Staff.htm • None of the above will solve your information security problem !! West Virginia Statewide Technology Conference 2005

16. Legislation Is Coming • Four members of the U.S. House of Representatives have created the Congressional E-Waste Working Group to work on standardizing national laws for recycling and disposing of discarded electronic and computer equipment (source: PC World article) • In WV, appears to be no controlling legislation for keeping computers out of landfills • Landfill operators are regulated by EPA and will probably not let you dump a truckload of hazardous materials in their landfill • Residential garbage collectors can and do get away with it and good citizens will spread the word how bad this is for everyone • None of the above will solve your information security problem !! West Virginia Statewide Technology Conference 2005

17. More Media Types and More Information Security Concerns • USB drives • staggering growth of USB flash drives • from 5 million units sold worldwide in 2002 to 46 million units in 2004 (Source: Gartner) • has left many IT departments at odds on how to best tackle this useful, yet potentially risky appliance • Some companies still opt to ban USB drives in their organizations. • Floppies, Tapes, CDs and DVDs • Memory sticks • SD cards • Cell phones • PDAs West Virginia Statewide Technology Conference 2005

18. Media Wiping Solutions and Shredders • Media Wiping Applications • KillDisk • WipeDrive • Mediawiper • Look for those that meet HIPAA and/or DoD specs • Shredders • Kobra 400C4 • great for shredding CDs and DVDs • And the favorite of UCS Help Desk staff…SSI Shredders (watch it in action) • If used properly, the above can help with the information security problem !! West Virginia Statewide Technology Conference 2005

19. Q&A • Thank You!! • Questions? • This presentation is online athttp://users.marshall.edu/~celliott/ComputerDisposal.ppt • For more information or to request these slides send e-mail to:celliott@marshall.edu West Virginia Statewide Technology Conference 2005