ITAMG regularly provides IT disposal and data destruction services to our clients with offices and data centers in New York City. Recently we have had a lot of new clients ask us how it’s even possible for us to provide onsite hard drive shredding services in the chaotic New York environment. This post provides a quick explanation of how we manage obstacles and securely destroy electronic media in one of America’s most bustling cities.

Parking in New York City can be a nightmare. The industrial shredding equipment used to shred hard drives weighs thousands of pounds and is mounted on a large box truck (similar to paper shredding trucks you may be more familiar with). Most loading docks in New York City are extremely busy and located indoors, so idling and shredding drives at a dock is not an option due to congestion as well as health and safety concerns.

In order to get the work done curbside our crew will first scan and capture the serial numbers of the drives and then place the media into a locked container while still inside the client’s space. They then transport the locked containers, which are on wheels, down to the mobile shredding truck.

When there are no available parking spaces in the area we may be required to park several blocks from the client’s location. Although the client may be forced to get some unexpected exercise by taking a walk to the truck, he or she is able to follow the media at all times, and no media is left unattended.

To combat parking restrictions we always staff at least three crew members in New York City. All hard drive shredding projects in New York are staffed with a driver and a minimum of two technicians. With this strategy the truck can remain in a standing zone nearby while the other two crew members audit and prepare the drives for destruction.

When the technicians are done processing and auditing the drives the truck is called in to collect the container and the drives are destroyed at the nearest possible location. This staffing practice accounts for a potential emergency or required break and allows for a crew member to always remain available to guard the media prior to its destruction.   

Everything, especially time, in New York is expensive. In order to reduce service costs our shredding trucks are also equipped to collect electronic waste and surplus computer equipment that is being liquidated.  In addition to the shredded media remains there is space to remove upwards of three hundred desktops at a single service.

We are able to reduce shipping and logistics costs for projects that require both on-site media destruction and IT asset disposal services by performing both services at the same time.      

ITAMG has been working in New York City with our own crews since 1999. If you are already a New York hard drive shredding client please reach out to your account manager and let us know how we are doing.      

Interested in Data Destruction Best Practices?  Download our quick guide to NIST 800-88 Guidelines for Media Sanitzation below.

Storage devices and electronic media are not the only devices that require erasure and data destruction service levels in order to eliminate risks of causing a breach from an equipment disposition. Networking devices, routers, and switches hold sensitive information that in the wrong hands can be used to find entry to or otherwise compromise a network’s security.

The good news is that the major manufacturers have built in acceptable erasure methods into various networking devices and the process is easy to navigate.

At IT Asset Management Group we utilize the best methods of clearing a device depending on the manufacturer’s instructions and tools available. If a device cannot be reset to factory default, configuration cleared, NVRAM erased, VLAN cleared or any other information fails to erase with 100% certainty the device is quarantined and then physically destroyed.

The exact method of erasing networking devices will be specific to the manufacturer and model of the hardware but the following is broad overview of the process.Methods for Networking Device Erasure 

1. Switches - Clear all configuration files including startup and running configuration files. Erase the NVRAM file system and removal of all files. Reload the switch to factory default. Clear all VLAN information created on switch. Confirm device has been cleared.
2. Routers - Reset password and device to factory default.   Using Register Configuration write erase and set device back to factory default. Confirm device has been cleared.  

A sample of the type of manufacturer provided instructions used by ITAMG can be found below.

Common Switch: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/24328-156.html

Common Router: http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-123-mainline/46509-factory-default.html

Networking Device Destruction

Any device that cannot be reset and confirmed to no longer contain any user created configurations or data should be physically dismantled, shredded, and recycled for commodity material in accordance with all local, state, and federal laws. ITAMG’s data destruction services are developed in accordance with the DoD 5220.22-M standards and NIST 800-88 Guidelines for Media Sanitization.

Looking for more information on running a secure data destruction program? 

Government agencies, corporations, and various institutions are taking measures to improve IT asset management and disposition practices in order to mitigate risk of a data breach, achieve environmental initiatives, and ensure optimal financial performance. The following are some key pieces to building a secure and efficient IT disposal program.  

1. Implement and utilize an asset management and inventory system

An asset management program’s success will be driven by the inventory tools and processes in place to track assets from cradle to grave, or in other words from the time of an asset’s implementation until the asset is recycled or liquidated. The inventory management system should be utilized to document when an asset is disposed of, its final destination (vendor and asset status), and what administrator or manager signed off on the disposition.

Having robust asset management data that includes model numbers, serial numbers, and other attributes and specifications of equipment also allows an organization to bid out an asset disposal contract more effectively and for more competitive returns.    

2.Track and maintain documentation of disposition and data destruction of assets

Asset management disposition data should be reconciled with the data provided by a firm’s disposal vendor. These inventory reports, settlements, and certifications of destruction and proper handling should be maintained in accessible formats.

The most sophisticated asset disposal programs utilize integration with a disposal vendor’s asset management software in order to confirm and document the disposition of an asset.  In the case of a full integration an asset management team can mark an item as shipped or disposed of and track the receiving, processing, sale, or recycling of the asset.

3. Sign a formal agreement with an IT asset disposition vendor or managed service provider

Take the steps to put an agreement in place with an IT asset disposal provider that documents your firm’s due diligence, understanding, and expectations of the vendor and performance milestones of the disposition program.

A standard Master Service Agreement (MSA) should include the following:

• Data security and privacy policies (including process for disclosure of potential exposures)

• Commitment to environmental recycling controls and compliant waste management

• Insurance coverage

• Overview of service levels, process, financial obligations, reporting and billing standards

4. Develop a data destruction process driven by NIST 800-88 Guidelines for Media Sanitization

If you’re unfamiliar with NIST 800-88 you can learn more from this introduction blog entry.

Developing a data destruction program to the best practices outlined by NIST 800-88 will ensure end of life data security as well as develop a process to maintain audit ready documents that are necessary to validate a firm’s data privacy compliance.

A program following the NIST 800-88 method will identify risk, categorize media, select effective eradication methods, set quality assurances, record and certify destruction of assets, and place responsibility of the program’s success on senior managers.    

Every organization should be considering the risk of a data breach caused by improper data sanitization and set eradication methods and disposal processes according to data privacy laws and industry specific regulations (e.g. HIPAA for health and human services).

5. Create an accounting mechanism to keep liquidation returns in the IT budget

IT asset managers and acting directors are tasked to quantify value to executive management and IT operations. Efficient liquidation of assets can yield significant returns, and these financial recoveries should not go unnoticed.

IT asset managers should develop accounting mechanisms to track returns from the disposal program as well as to keep the funds in the IT budget. This can be achieved by using a credit system for future product purchases or services instead of receiving direct payments from a disposal vendor. The disposal provider can provide goods and services directly or partner with an OEM or VAR to do so.  

Learn More About IT Asset Disposal Best Practices:

Attackers are targeting easier to access confidential information housed on company hard drives that are improperly disposed of.  One must have data destruction policies and procedures in place to ensure a data breach doesn’t occur. In the Guidelines for Media Sanitization (NIST Special Publication 800-88 Rev 1) best practices from the National Institute of Standards and Technology are clearly provided.

In this document three forms of compliant sanitization are defined: clear, purge, and destroy.

• Clear: Overwriting storage space with non-sensitive data is one way to sanitize media. This method is not effective for media that is damaged or not rewriteable. The media type and size may also influence whether overwriting is a suitable sanitization method [SP 800-36].
• Purge: Acceptable forms of purging include degaussing and executing the firmware Secure Erase command (for ATA drives only).  In degaussing a magnetic field is used to sanitize media. Degaussing is effective when working with damaged media, purging media with exceptionally large storage capacities, or for purging diskettes [SP 800-36].
• Destroy:  Sanitization methods used to completely destroy media include Disintegration, Pulverization, Melting, and Incineration.  Destruction methods are typically outsourced to an organization capable of performing these tasks safely and effectively.  Pulverization is commonly referred to as Hard Drive Shredding in the IT asset disposal industry.  

 The NIST 800-88 document provides the below Media Sanitization Decision Matrix containing media-specific lists regarding the options of clear, purge, and destroy.  

Media that contains proprietary, confidential material, or is otherwise deemed to be a high risk must be given priority and the strictest controls and destruction methods should be employed.

Learn More And Download the 5 Most Important Tips from NIST 800-88

ITAMG handles media sanitization in accordance with the National Institute of Standards & Technology (NIST) Special Publication Series 800-88. We can work with you to implement the most appropriate methods of disposal for your media and establish your secure and audit ready data destruction programs.