Asset disposal security: an IT no-brainer

Which has more value: an armored truck or a van carting away a bunch of old computers? This is not a trick question. It’s one that Kyle Marks, founder and CEO of Retire-IT, asks his clients. And the answer is easy, says the Columbus, Ohio-based entrepreneur, but it eludes most businesses. “The armored truck might, on average, carry a few hundred thousand dollars, and it has armed guards,” he says, but “a recycler’s van full of obsolete IT equipment carries millions of dollars of liability.”

“This is the most overlooked aspect of IT security,” he contends. “Companies spend millions of dollars to protect their IT assets while they’re in use.” When these assets are retired, they contain all the same information , but, he contends, companies take the security aspects of disposal pretty much on faith.

Companies spend millions on IT security, but forget that when they toss old computers without a plan, they’re sustaining huge liability.

Not that he’s advocating hiring Brinks to cart away used servers. What he does recommend is a simple procedure that involves labeling every asset that is to be retired with a unique tag  marked for disposal, and then implementing a comprehensive “reconciliation methodology” to ensure that the data is destroyed and the  hardware goes where the company wants it to.

It’s the ounce of prevention that can make all the difference, says Marks, who earned his MBA from Harvard. All it takes is one hard drive that goes missing. If that drive contains sensitive client records, suddenly a worn-out piece of hardware can become a costly liability that he contends “could put a company out of business.”

It’s true that while data security breaches have become commonplace, most of the resulting class action suits to date have not been successful. Plaintiffs’ claims that they have been subjected to increased risk because of asset disposal breaches have been viewed dimly by the courts; in most cases actual damages are required in order to qualify for class action status. But the judiciary’s take on such cases has been evolving bit by bit, and class action strategies have become more sophisticated, which leaves companies vulnerable. An ounce of prevention, says Marks, is well worth it.

Kyle Marks, CEO of Retire-IT, says an ounce of prevention is well worthwhile.

In his view, companies don’t need to target the recycling contractors. Most pilferage of obsolete hardware takes place, he maintains, before the recyclers ever set foot in the door. It’s the “trusted insiders” on the IT staff who are usually responsible, he says. “They view it as a victimless crime,” and help themselves to a piece of equipment that they know is destined for the dump. The problem is that if the data on these machines has not been wiped clean, who knows where it might eventually end up.

The solution, says Marks, lies in identifying the assets  every step of the way. And that’s where he says disposal tags come in. This is a departure from common practice. The traditional tracking tool has been the serial number on the piece of hardware, but Marks says serial numbers are subject to human error in transcription. Get one character wrong, and the asset becomes unidentifiable. With a bar-coded disposal tag, the scanner does the recording, and human error is no longer part of the equation, he says.

A simple asset tag can help prevent data piracy and lawsuits when IT paraphernalia is in retirement. Via myassettag.com.

But why not use the asset tags that many companies assign to each piece of hardware when it is  put into service? “We tell clients that they can use them, but we’ve never found a client that has a consistent, homogeneous system” for asset tagging, Marks says. Plus, older tags are often worn out and unreadable, and sometimes they’re so old that they predate bar coding; asset disposal tags bypass all of these pitfalls.

Marks uses simple one-by-three-inch white self-adhesive polypropylene tags with what he describes as “the most easily read bar code format.”  His clients do their own tagging; this ensures that the correct assets are marked for disposal, and it also acts as a deterrent to the assets disappearing before the recyclers arrive. The tags are used to build a master inventory list that also uses serial numbers as a backup. “It’s two-key tracking—a complete reconciliation methodology,”  Marks explains.

Category: Barcodes and RFID