Are You Really Destroying All Data? Most Companies Aren’t.

Every company handling end-of-life IT equipment has a top requirement—secure equipment disposal. Yet, even the most diligent organizations routinely miss hidden data-bearing devices, exposing themselves to serious security risks. Hard drives, SSDs, and even embedded storage in modern electronics are often missed, leaving sensitive information vulnerable to breaches. Gartner research indicates that a considerable percentage of IT assets, around 30%, can be lost or unaccounted for. This “loss” can manifest in various ways, including physical loss, misplacement, or “ghosting” (assets that are active but not tracked).

 

The Hidden Data Risks Lurking in Your IT Assets

Even security-conscious organizations fail to account for all data storage devices. Here are real-world examples of how missed hard drives and other storage media can lead to serious vulnerabilities:

• Governmental Vulnerabilities: Securis found Top Secret diagrams for a key U.S. Government building mixed in with discarded items during a routine electronics recycling pickup. Without thorough IT asset disposition (ITAD) procedures, this could have led to a catastrophic security breach.
• Financial Industry Oversights: A financial services company, confident in its IT asset management, had already shredded its own drives. Yet, Securis’ triple-check process found an unaccounted-for storage drive hidden in a copier—a device often overlooked as a data risk as well as three additional items that were not in the companies inventory list. These overlooked assets could have led to a major compliance failure.
• Server Room Blunders: Another financial services client assured Securis that all hard drives had been removed from eight decommissioned server cabinets. Upon our close inspection, 86 drives (72 SSDs and 14 HDDs) were discovered—a staggering 15% of the total drives assumed to have been removed. 
• Telecom Mishaps: A major telecom company decommissioned 300 servers, claiming all storage had been stripped. Securis uncovered 30 overlooked hard drives—each containing potentially sensitive data.

 

Government Reports Confirm Data Disposal Failures

• The Office of the Inspector General (OIG) discovered that an FBI-controlled facility had classified and unclassified law enforcement data stored on pallets without adequate protection. If these items had been wiped or degaussed on-premises, there would have been at least one layer of protection before transportation took place. 
• A 2024 NRC OIG report recommended strengthening IT asset disposal processes, including updating decommissioning standards and enforcing strict inventory control.
• In a State of New Jersey audit, 79% of decommissioned state laptops planned for public auction were found to contain data.

Medical Devices: The Overlooked Data Risk

It’s not just traditional IT equipment—embedded storage in medical devices and equipment is often overlooked. A recent study found that 13 infusion pump devices still contained wireless authentication data when resold on secondary markets. 

Accordingly, the Federal Register recently proposed a new rule to strengthen the cybersecurity of electronic protected health information. This proposed rule strengthens overall cybersecurity measures and supports the ongoing requirement for robust data destruction practices to protect ePHI.

 

How Securis Prevents Costly Mistakes

Securis’ Secure, Accurate, and Sustainable IT asset disposition approach ensures no storage device is left behind:

•  Triple-Check Guarantee: Multi-step verification ensures hidden drives don’t slip through the cracks.
• Separation of Duties: Independent verification eliminates single points of failure.
• NAID-Certified Hard Drive Shredding & Data Wiping: Securis ensures 100% data destruction with documented proof, whether on-site or off-site.

 

Choosing the Right ITAD Partner: What to Look For

Who you choose as your IT asset disposal partner matters. Securis helps companies avoid costly data breaches by ensuring every data-bearing device is identified and destroyed. Some best practices you can use to choose a vendor include:

• Certifications:  Does the vendor have NAID AAA Certification for on and off-site destruction?
• Nationwide Coverage:   Can they collect and process IT assets from multiple locations?
• Experience:  Nothing can replace experience.  Experienced vendors know where to look for hidden storage devices.
• Capabilities:  Can the vendor perform shredding to required destruction standards for various assets and storage media types? Do they provide a strong chain of custody and certificates of destruction?

 

Secure Your IT Assets Today

Don’t risk a data breach by overlooking hidden storage devices. Securis ensures 100% secure IT asset disposal with industry-leading ITAD services.

🔹 Contact Securis today for a customized IT asset recycling and secure data destruction plan.

A certificate of data destruction and recycling proves that data on retired electronic equipment was destroyed according to NAID standards. Securis provides these to our clients for their IT asset auditing purposes.

Securis’ data destruction and e-waste recycling services ease your burden by providing a fully audited, managed, and secure computer and data destruction program. We meet the requirements set by the Department of Defense and the National Security Agency for secure IT Asset disposal, as well as industry-specific standards such as HIPPA, HITECH, FACTA, the Gramm-Leach-Bliley Act, and many others, ensuring the legal compliance companies and agencies need. The Certificate of Destruction is proof that IT Assets have been disposed of in a manner that meets these standards.   

When you choose Securis, you choose security. We process your data with your security and protection at the forefront of our minds. Our storage bins and trucks remained locked throughout the collection process. This prevents access to your end-of-life technology before destruction and ensures a secure chain of custody.When equipment arrives at our facilities, we scan each individual asset and create an electronic inventory.  Securis records the make, serial number (if available), and asset type for each asset.  If an asset contains an asset tag, we scan it. In addition, all items get a Securis key with the job number and status.  This gives us up to four ways to identify each asset. We use proprietary data collection software and handheld scanners for audit and accounta

Clients Can Witness Destruction if they Choose

Some clients need to see the physical destruction of their  e-waste. This is why we developed the ability to either shred or micro-shred equipment on-site with mobile shredding or allow for witnesses to come to our facility to witness physical destruction activity Micro-shredding destroys physical equipment by pulverizing it to less than the NSA-recommended 2mm particles. This is especially beneficial for smaller items that cannot be degaussed or destroyed with a standard hard drive shredder.  We provide a certificate of destruction for these assets once the data has been properly destroyed. This applies to large projects like data centers and smaller projects like hard drives and SSDs.

Inventory Lists and COD’s Available 24/7

At the culmination of the asset disposal project, clients are provided with a full inventory of every item that has been wiped to NIST 800-88 standards and prepared for recycling or destroyed by  Securis. This information is available for client viewing 24/7 through our client portal. Certificates of Destruction are also available through our portal. 

We know how important it is to destroy any confidential information that your company may collect properly. From HIPAA violations to government secrets, we know that information needs to be protected, which is why our services exist. This certificate of destruction can protect you from liability as it proves that you met the strict destruction standards for many compliance standards. For a list of all the compliance standards that Securis meets, please see our compliance page.

This is the transcript of a conversation about Hardware Asset Management between and Jeremy Boerger, the author of the Pragmatic ITAM Method and a consultant who helps large organizations implement IT Hardware Asset Management solutions. You can find Jeremy at: https://www.itamcoaches.com

00:00:04:07 – 00:00:38:01

Kurt Greening

So welcome, everybody. Today, I am joined by Jeremy Berger, the creator of the pragmatic ITAM method and a consultant who helps large organizations implement great IT asset management. Jeremy’s been solving problems in this area since 2000, and he uses data theory, automation, self-governance, while others just are answering questions or excuse me, answering tickets and running inventory reports. We’re talking about hardware asset management today, but Jeremy also helps people solve problems with software asset management. SaaS, spend management, and financial operations. Now, there is a lot of debate today about remote work. Many companies are ordering at least a partial return to office, but the IT asset management problems for remote organizations, or at least people who are hybrid, they’re not going away. 

So my name is Kurt Greening. If you don’t know me, I am an executive VP with Securis. Our primary business, is IT asset disposition, but we also help companies manage the hardware assets of remote employees. Jeremy, thank you for joining us today. 

Jeremy Boerger

It’s my pleasure. Kurt, thank you for having me. 

Kurt Greening

Awesome. So I have a few questions for you as, industry expert. First one I would, love if you can share some of the challenges that you may have noticed in your career when it comes to managing remote employees hardware assets.

Jeremy Boerger

Yeah. So the, the biggest challenge is getting to them,  that’s the real problem. It’s either getting that hardware out to the end user and then getting it back when that end user, goes away or goes through a, refresh, and they get new equipment. now you’ve also got, a secondary problem with the communication piece. Inside the United States, we’ve got a much more robust data infrastructure. Most organizations, especially when, hybrid work was first being experimented with, maybe you had the old twisted pair, riding alongside your home phone line. Remember when we had home phones? Yeah. and that was a real challenge for no other reason than just to get the disposition of that device. Is it on? Is it working? Is it getting patched? nowadays we’ve got high-speed connectivity all over the place. for the most part. And so that kind of concern goes away. But the real challenge is getting the device and the entire setup over to the end user and then getting it back when they’re done with it.

Kurt Greening

Yeah. I worked for a remote-only company, so that was interesting. I actually did all of my interviews on, video. Via zoom. it’s a little nerve-wracking to accept a job that way, but onboarding, was also, completely remote. And, you know, you mentioned some of the challenges. I think getting the equipment is a challenge. If I were to, I would make a challenge getting the equipment back, especially with a less-than-happy employee. It’d be an even bigger challenge if you don’t make that super easy as an IP asset manager or a helpdesk organization. I don’t think you’re going to get that equipment back in a timely manner.

Jeremy Boerger

Right. You’re right. And in so when you’re dealing with that, you’re really as an asset manager, you’ve got to make a calculation. risk calculation in your head. once the real value of that device, sometimes it’s the value of the device itself. Don’t get me wrong. I work for an organization that does, animation, computer animation for entertainment, cartoons, and all of that stuff, that’s some high-powered stuff that is cranking along, doing ray tracing and, generating the frames. So there is still value in that. But for most organizations where the real value is, is in the intellectual property, in the data that’s stored on that device. So one of the ways that you can get around that problem is to have a more robust data destruction, cooling, and methodology that if you can remotely eliminate access to the IP from that device, that sometimes will alleviate some of the risk.

00:05:27:05 – 00:05:55:02

Kurt Greening

So that is a good point. Jeremy, you’re about to get into my next question. Which are some of, what are some of the software tools that are available to help improve, cybersecurity saying you mentioned remote wipe. you know, typically, most of my customers here at Securus, they’re using like, an end user management software or a mobile device management software. you know, to help with, you know, to help manage that solution. But other than that, or maybe talk about some of those features or other tools similar to that, that that make managing those, remote and user devices a lot easier.

Jeremy Boerger

 Right. So, it, it’s tough to be able to talk about them because the technology itself is actually rather simple.  It is just being able to have an inventory and the tool being able to reach out and send commands, to that device. from either a pre boot or, or a stance or an operating system where really there’s new tools that are coming on all the time. what I recommend for as part of our pragmatic ITAM  method is stick with the easy ones.

Intune for your Windows devices. Jamf for Apple. There’s others that will also do the work, but those those two are the big ones, and they will get the job done. Encryption,  also seems to have we’ll also have some, remote destruction or, magic bullet commands. sometimes that can go on. And with the, when you start talking about phones and contact lists and the, two factor authentication with some of those, oh, you know, the random number generators, in those password like that.

Those will also work so that you can lock down and immobilize the device, make it useless. not only does it protect any of the random bits that might still be on that device, but also gives, an incentive for the end user to give it up and send it back home, because they’re not going to be able to do anything with it anyway.

Kurt Greening

Yeah. I mean, I understand that some of these solutions also offer like GPS tracking. You mentioned enforcing specific cyber security policies to make sure that they’re safe on the on the network. You know, they might be working in conjunction with anti-virus software or, you know, more sophisticated, tools that are out there, you know, so I think all of those can be incredibly helpful.

Jeremy Boerger

Oh, yeah. And, you know, it’s what I, what I see in my book, you know, the best tool for the job is the one you’ve already got. So use the stuff that you’ve already got access to. Again, Intune is already there. If you’ve got a Windows volume license agreement or you’re part of the, you’re, you’ve got access to, oh, crud. What are they calling their Azure? what they’re calling their device, their cloud system.

Kurt Greening

 And they used to call it. oh, I forgot. I think it’s now M365. But, you know, some of the really advanced security features might be the M5. or E5 offering. 

Jeremy Boerger

Yeah. Yeah. And then actually brings up a good question, or a good thought as well. The proliferation of cloud storage remote backups mean that the risk of loss of the IP, the at the risk of the access of the loss of intellectual property or for an organization actually helps become minimized because so long as that device is inoperable, they have a backup copy that they can reach into. Any data or, intellectual property or whatever other files are needed.

00:10:00:12 – 00:10:16:03

Kurt Greening

I think you did a great job talking about how many of these, software tools can help remotely support these users and help with IT asset management. But there are certain problems that can’t be solved remotely with software. Can you give me an example of some of the challenges that organizations run into with remote employees? 

Jeremy Boerger

You know, I am old enough to remember the old joke about the, the end user who plugged the, following the instructions to the letter plugged the, power strip into the power strip. I don’t know if we can solve that one, with software, but, you know, in today’s age, there’s a lot of, the the end user is a lot more savvy around technology, but some of the problems that you that you’re going to struggle with, are going to be the usability and the process side. And if you don’t have robust processes, around things like data handling and, inventory management and, recovery processes, what are those steps to get those devices back? You’re going to struggle. and there’s not much just throwing another magic bullet, piece of software at that problem is not going to make the poor processes go away.

Kurt Greening

Yeah, I mean, that’s true. I mean, I’ve talked to many of my friends that work in that helpdesk, and some of them are incredible at this job, in their job. They’re they’re highly committed. They tell me stories of, hey, I did everything I could to support this person. They had something, you know, critical coming up customer presentations. I got in my car and I drove four hours with a new, laptop with a fresh image, picked up their old one and took it home because there was nothing more that I could do.

Jeremy Boerger

I had worked Help desk one time and we were able to troubleshoot. the connectivity issue actually came down to the feed line into the, subdivision, buried cable line, and the reason why we were able to figure it out was because I was the first person to ask the guy point blank, the person that we were helping what’s the picture quality on channel two and channel three, which is where the on the old cable modems, that’s where the the data line there on channel three. And I think part of channel 13, he was like, oh it’s terrible. It’s like, how well do you know your neighbors? Can you talk to them? And just that persistence, that systemic thinking of going, okay, we’ve tested every possible issue with the hardware. We know it’s not the software. Then what happens next? That’s systemic thinking about okay, what’s the next device or issue in line that could be causing the problem and then start to troubleshoot it. If I remember right, the cable company came in and replaced all of the wire in that subdivision. It was 20, 30 houses, between the house and the street.

Kurt Greening
Interesting. Some some good, good war stories there. Jeremy. 

Jeremy Boerger

Oh, yeah. That’s. Yeah, that’s the nice thing about helpdesk. Everybody’s got a war story. 

Kurt Greening

Yeah. And, speaking of some of these challenges, why do you think, some companies or maybe even government, organizations might for, outsource laptop logistics, data sanitization, re-imaging imaging repair.

And then eventually, when they’re done with the device recycling that somebody like Securis. 

Jeremy Boerger

Yeah. So, there’s, there’s a couple of reasons why it starts to make sense. The first is scale. as an organization grows, the demands for the disposal, the recovery, the disposal and the, recertification if you’re going to reuse it, all of that starts to become cumbersome and pulls attention and material and resources away from the business’s core focus.Right. If you are, manufacturer, you make airplanes. The last thing you want is people spending their time, hitting laptops with hammers to destroy the platters. Right. So outsource that. the second part is, if you are dealing with very heavily, abused, data, thinking, healthcare, thinking, finance, and government, there are specific regulations that you’ve got to follow and your organization might not be able to keep up with all of those regulations. A dedicated third party service provider, that’s the folks to go to. Finally, off the top of my head and thinking about it, if you are an organization that is in a very heavily congested urban area warehousing becomes a premium and you really want to have, square footage being paid out for devices that are just sitting there because they’re either being prepped or being removed, t hat’s money out the door that, you know, you could redirect somewhere else, especially if you have a, just in time relationship with, third party service provider. 

Kurt Greening

Yeah, there’s a real good point. Yeah. I, I, you know, there’s kind of a space between, you know, a really small company that would outsource everything from an IT perspective to an MSP. And then, you know, I’ve got a customer and it’s a big hotel chain, and they have regionally dispersed helpdesk people, within a two-hour drive of almost, every major, property, so they don’t have a problem, but there’s kind of that in-between space where somebody is like, hey, we’ve got to help desk people, but either they’re not physically close to all those people you mentioned, you know, the warehouse issue or, you know, working for companies. You know, I know of a big company in the software space lab, Gitlab, they don’t have a corporate headquarters so they wouldn’t store the laptops anywhere, so there’s kind of that interesting space where, you know, you’re big enough to have a, you know, your own IT helpdesk to understand your applications, understand your software, but maybe you don’t have somebody in every region or what I’ve been told is that, providing hardware support, you know, shipping stuff out and boxes for somebody who’s got a bunch of, you know, network and helpdesk certifications, they may consider that to be soul-sucking work. 

Jeremy Boerger

Yeah. Yeah. Could be too. Could be too. The other thing to consider is how you’re actually using the technology,  so many of the used to be onboarded software activities are now residing in the cloud or are accessed through a web browser. It doesn’t matter what kind of platform you’re using. All you really need is a consistent connection to that SaaS provider. Apple Mac, however it’s configured, doesn’t matter so long as the connection is secured. Maybe a VPN, some sort of, certificate. You’re off to the races, so go out, pick up something at Walmart and bring it back to your home. 

Kurt Greening

Awesome. Well, good. Good advice. So let’s say the company comes to you and you’re doing some IT asset management consulting to you, and they mentioned this as a problem. And they say hey, I’m going to outsource or possibly outsource some of this. What would you recommend that they look for. What types of questions should they ask of potential providers that will help them figure out what solution might be right for them? 

Jeremy Boerger

So the first question that really needs to be asked is, what kind of a relationship do you want with this third-party service provider? They really, the services break off into two aspects. One is either that just-in-time inventory provision, or they are doing just, dross, haul away the garbage give you a certificate that they’ve destroyed it, and you wipe your hands of it. I’ve seen both. if you are going to go the dross method, then there’s some other sub-questions that you’ve got to ask the people that are doing the inspection. They’re going to be your employees. Are you okay with having someone spend, you know, an hour or two a day for a small organization every once in a while to an entire team of 3 or 4 people going through, examining the usefulness of the device, deciding whether or not it can be reused and put back out into, the computing environment. And then goinging through the activity of wiping it out, doing the DoD five-time wipe. Sometimes that goes for a while on these big, on these big hard drives. Cybersecurity is also starting to poke at some of the persistent memory. So you’ve got to really have some specific tools to break apart the chassis, to get to that memory and make sure that it’s disposed of.

00:20:25:11 – 00:21:01:09

Jeremy Boerger

Is the organization comfortable with having that dedicated team? Now, the last part that I kind of worry about for organizations, if they’re taking on this task on their own, is the sort of, certification of destruction. The insurance companies, especially the ones that are providing cybersecurity insurance, are very twitchy about their documentation. And they want that confirmation that that device has been destroyed.

Jeremy Boerger

Right. if you’re doing it yourself, it’s very easy to break that chain of custody and lose track of that certificate. And then you’re talking some serious money, your insurance. There’s a very real threat that your insurance, policy could be voided, and that’s the last thing you want to have happen if all of a sudden you need it, right?

Kurt Greening

Yeah. I call it thinking of defensible IT asset management or defensible IT asset disposition. Right. Yes. Do you have a policy. would it be considered best practices and do you follow that policy? Right?

Jeremy Boerger

right, right. Well, and I have seen, the, the, TSP’s, they will go so far as to say specifically when they make a run to pick up a lot, they own those devices. Once they obtain custody, they, assume ownership and reliability. Even then, you want that receipt. What did they pick up? When was that date? And you need to store that in your CMBB or, records repository in case anything happens. 

Kurt Greening

All right. Let’s talk let’s talk about systems because you, If you don’t mind, unless you have another thought on that topic, right. So, let’s say and I think you can answer both questions. So you talked about outsourcing IT, asset disposition and data destruction. That’s maybe one relationship. But there’s also the other relationship we talked about where, hey, you’re managing deployment, wiping retrievable redeployment of of IT assets. Talk about some of the systems, whether it’s, ITAMsystems or ITSM systems, that have to be in place, and what do you kind of think that that relationship would be like in both of those scenarios? 

Jeremy Boerger

Right. So when you are talking about just in time, supply, inventory, you own those devices, but you might not necessarily be in physical control of those devices. So the question comes down to where is your stuff? Now, you know, if you’re a small operation, maybe you can take somebody’s word for it that, oh, yeah, that box is sitting on our shelf, and that’s great. But if you’re going to be a large organization and you need to know where that inventory is, especially if you’re going to start doing some automation between your onboarding and procurement and removal and disposal. You have to have, reach into that third-party service provider’s inventory. And in order to do that, the best way is that you both have inventory systems and you’re sharing data back and forth with an API call, or at least some sort of automated report.

Kurt Greening

I’ve actually seen that happen two ways, Jeremy. So I have seen it happen where let’s say there’s, you know, 5 or 10 spare laptops that are inventory. They’re owned by the company, not by the outsourcer, and then all actions are actually done in the company or the customer’s ITSM system, and the IT asset management database. And then there’s various workflows, like hey monthly that outsourcer has to scan and prove that what you know is in the IT Asset Management inventory is actually, you know, still owned, you know, it’s still in, you know, a locked page or whatever the agreement, is that’s, you know, that’s one scenario. And also, you know, that the Outsourcer may get a helpdesk ticket assigned to them. You know, they perform an action that’s updated in the ITSM, system. You know, if there’s tracking numbers, you know, all of those things. I think that that’s that’s another way, right? Is if you are willing to, sign agreements and you would allow that third party to have access to your systems.

00:25:37:00 – 00:26:21:12

Jeremy Boerger

Oh, yeah. No, the, the the visual inspection is costly, but it is necessary for the, “just to be sure”. And let’s remember these are devices that nine times out of ten are not plugged into the network. They’re just sitting there ready to go for the next step. But they’re dark. They’re off the wire. So unless you have really good controls on the, live side, you know, you’ve got, a good tie-in or good reports from bills of lading that say when stuff is getting received in the inventory, you’ve got your discovery tools running full bore, so you know what’s powered on and being used actively. And you’ve got your certificates of destruction being updated regularly, then what should be in that room should be the stuff that you know you own, but you haven’t seen it on the wire yet. But things happen. Things change. Stuff gets moved. I lose track of water bottles all the time. It happens, so I, I really like, I believe if memory serves, the best practice is really once a quarter.

If you’re in a just-in-time inventory relationship, have a visual inspection. It’s a great time to just go and build the, the personal relationships as well with your, service provider. Go. Everything looks fine. Freedom to launch. 

Kurt Greening

Yeah. I mean, I’ve also seen a requirement for monthly scanning of the asset tags and a photograph in addition to the quarterly visual inspection.

Jeremy Boerger

That’s pretty brutal. I mean, but again, if you’re in an organization and you’re uncomfortable with risk, then, yeah, you’re going to make demands like that. 

Kurt Greening

Talk about other demands. We talk about IT Asset disposal. you know, I have some customers that they provide an inventory, we go up on-site, we scan everything that they give us. We cannot leave until there is a 100%, match. You have all the serial numbers, the asset tags and the Securis disposal tags. And then, there are photos taken of what is in the truck. The truck is locked. The truck is sealed. The truck is GPS tracked. It goes to our location. The items are scanned again. That scan is compared to the inventory, the two other inventories,  and if one, item is off, then they start an investigation to figure out, do they have a cyber security incident or not? So to me, that’s what good inventory management, looks like, and I mostly see that from banks. I’d like to see that in some other industries as well.

00:28:46:10 – 00:29:21:01

Jeremy Boerger

It’s certainly, again, with financial and health care, there is so many nefarious activities that are going on. You have to be careful. honestly, between you and me, I would think that that level of chain of custody is pretty extreme. I hope your customer is paying for that level. For most organizations,  the bill of lading is actually plenty to be able to tell you.

You know, here’s the truck, and here is the driver, here’s the expected delivery. Did all of the serial numbers that they said that the the delivery company picked up actually make it? And if that didn’t happen then that specific piece, that delivery driver is going to be in the hot seat. so there’s a range and I and that’s really where it kind of comes down to where you and I can agree. It’s that level of risk and the management of that risk through the collection of the details and the data about where those devices are between you handing the physical custody over to a third party and then saying, you know, providing a receipt that says, yes, we did the needful, this thing is now a small pile of molten metal. You’ll never see it again. 

Kurt Greening

So this is all, good advice. Clearly, Jeremy, you’ve been doing this a long time. you’re an expert in many things. Hardware asset management, many things. Software asset management. So I appreciate you, sharing some things both with me and folks that watch the Securis YouTube channel. I guess the question is, some people are, are thinking about some of the things, some of the problems that you solve and they think that you might be able to help them. Where where can they reach you? 

Jeremy Boerger

Well, you can find us on our website, boergerconsulting.com. weird German spelling though, that’s B o e r g e r, otherwise you end up at McDonald’s. 

Kurt Greening

Now ITAM coaches, does that also get to your company to or…

Jeremy Boerger

ITAM coaches. Yes. So and this might be the right time to talk about that. We’re looking at doing a little bit of expanding and doing a brand name. So the ITAM coaches, URL will point to us as well. 

Kurt Greening

All right. Awesome. Well, hey, thank you again, Jeremy Burger. really appreciate your insight. suggest that, people pick up your book. That ITAM pragmatic Method, or follow your blog because there’s a lot of good advice. I know, I read that it seems like maybe weekly or every other week you’re putting out good content. So I think thats another way to try to keep up to speed with all things I.T Asset management.

Jeremy Boerger

Iit is it is a moving target to keep up with the details and the best business practices. So, you know, we’re happy to help educate where we can, and partner you know that’s really kind of, if there’s a closing thought, having someone help you out, can be very beneficial. So consider it. Gartner already released an article saying it’s a good idea, Forrester followed in suit, as they do. You don’t have to do this alone. 

Kurt Greening

All right? Sounds wonderful. Thank you so much.

Jeremy Boerger

My pleasure. Kirk. Good luck to you.

The Federal Financial Institutions Examination Council (FFIEC) provides guidelines to help financial institutions manage risks, including those related to data destruction. Compliance with FFIEC rules is critical for financial institutions to ensure data security, regulatory compliance, and the protection of sensitive information that may reside on their IT Assets.

The key aspects of FFIEC guidelines related to data destruction include:

 

1. Risk Management Framework

• Financial institutions must implement a comprehensive risk management program that includes policies for the secure disposal of data.
• Risk assessments should identify potential vulnerabilities in data destruction processes.

 

2. Secure Data Disposal Requirements

• Institutions must ensure that sensitive customer data, financial records, and confidential information are securely destroyed when no longer needed.
• Secure disposal methods should align with industry best practices, such as shredding, degaussing, or physical destruction of media.

 

3. Compliance with Privacy and Security Regulations

• Data destruction policies should be aligned with relevant laws, such as the Gramm-Leach-Bliley Act (GLBA), which mandates safeguards for customer information.
• Financial institutions must follow FFIEC guidelines in combination with the FTC Disposal Rule, which requires proper disposal of consumer information.

 

4. Third-Party Due Diligence and Vendor Selection

• The financial institution must conduct thorough due diligence before selecting a vendor to ensure the vendor has the necessary security controls, certifications, and experience in data destruction. The vendor should also clearly define its responsibilities for data destruction, including methods, timing, and acceptable levels of data sanitization.
• Vendors should comply with relevant regulations, such as:
  • Gramm-Leach-Bliley Act (GLBA) Safeguards Rule
  • FTC Disposal Rule
  • Bank Secrecy Act (BSA)
  • NIST Guidelines (e.g., NIST 800-88 for media sanitization)
• Institutions should assess a potential vendor’s financial stability, reputation, security controls, and data destruction methods.

 

5. Audit and Documentation

• Institutions should maintain detailed records of data destruction activities, including logs of what was destroyed, when, and by whom.
• Regular audits should be conducted to ensure adherence to data destruction policies and regulatory compliance.

 

6. Physical and Electronic Media Disposal

• FFIEC guidelines emphasize the secure destruction of physical documents and electronic storage devices, such as hard drives, USB drives, and backup tapes.
• Proper methods include overwriting, cryptographic erasure, and physical destruction.

 

7. Employee Training and Awareness

• Employees should be trained on the institution’s data destruction policies and the importance of securely handling sensitive information.

 

Adhering to FFIEC guidelines on data destruction helps financial institutions prevent data breaches, maintain customer trust, and avoid regulatory penalties. When a financial institution outsources data destruction services to a vendor, the FFIEC (Federal Financial Institutions Examination Council) requires the institution to ensure that the vendor complies with applicable regulations and security standards.

Key compliance requirements for vendors performing data destruction services include:

Contractual Obligations

FFIEC guidelines stress that contracts with vendors must include provisions to ensure data is securely destroyed. Essential contract elements include:

• Defined Scope of Services: Specify which types of data and media the vendor will destroy (e.g., paper, hard drives, electronic media).
• Security Standards: Vendors must follow industry best practices for secure destruction, such as NIST 800-88, NISPOM 32 CRF Part 117 (which has replaced DoD 5220.22-M) data sanitization, and NAID AAA certification standards.
• Confidentiality and Non-Disclosure: Ensure vendors adhere to strict confidentiality agreements.
• Chain of Custody: A documented process for handling, transporting, and destroying data to prevent unauthorized access.
• Audit Rights: The institution must retain the right to audit the vendor’s operations and security controls.
• Breach Notification: Require vendors to report any security incidents or potential data breaches immediately
• Indemnification: The contract should include provisions for indemnification in case of data breaches or non-compliance caused by the vendor.

Secure Data Destruction Methods

The vendor must use approved destruction methods to ensure data cannot be recovered. These include:

• Secure Handling: Vendors must handle sensitive data securely during collection, transport, storage, and destruction.
• Access Controls: Strict access controls should limit personnel access to sensitive information.
• Data Destruction Methods: Vendors must use secure, industry-recognized methods of data destruction that render the data unrecoverable (e.g., Overwriting, degaussing, or cryptographic erasure to comply with NIST standards).
• Verification: The vendor should provide proof of destruction, such as certificates or reports for each asset. (see section below)

Documentation and Certification

Vendors must provide detailed documentation to demonstrate compliance, including:

• Certificate of Destruction (CoD): A formal document certifying the data destruction process was completed securely and in compliance with applicable regulations.
• Destruction Logs: Itemized records of destroyed data, including dates, locations, and methods used.
• Audit Reports: Regular internal audits of data destruction processes to ensure ongoing compliance.

Ongoing Monitoring and Compliance Reviews

• Financial institutions must monitor vendors continually to verify continued compliance with FFIEC guidelines.
• This includes periodic audits, site visits, and performance evaluations to assess security practices.
• Vendors should undergo periodic compliance training and updates to meet evolving regulatory requirements.
• Incident Response: The vendor should have a documented incident response plan for data breaches or non-compliance issues.

Regulatory Compliance Alignment

Vendors should:

• Be transparent about their processes.
• Demonstrate their security controls and compliance with regulations.
• Provide proof of secure data destruction.
• Cooperate with the financial institution’s ongoing monitoring and audit procedures.

By following these FFIEC guidelines, financial institutions can mitigate the risks associated with outsourcing data destruction, ensure regulatory compliance, and protect sensitive customer information.

Creating a comprehensive Request for Proposal (RFP) for IT Asset Disposition (ITAD) services is crucial for organizations seeking to securely and efficiently manage the retirement of their IT assets. A well-structured RFP clarifies your company’s unique needs and ensures potential vendors can provide tailored solutions that align with your objectives.

Understanding IT asset disposition (ITAD) Services

IT Asset Disposition involves the processes required to responsibly retire outdated or unwanted IT equipment such as computers, phones, storage drives, and other office electronics. These devices often contain sensitive data, so these services should ensure compliance with stringent environmental and data security regulations. Partnering with a qualified ITAD provider helps mitigate risks associated with data breaches and environmental liabilities.  Read on to learn more about what to ask in an RFP for ITAD Services.  

Key Components of an ITAD RFP

1. Introduction and Company Overview:
   • Purpose of the RFP: Clearly state the objective of the ITAD services needed.
   • Company Background: Provide insights into your organization’s size, industry, and IT infrastructure to help vendors understand your needs.
2. Scope of Work:
   • Services Required: Detail the ITAD services you need, such as data destruction, asset remarketing, recycling, and reporting.
   • Volume and Types of Assets: Specify the quantity and categories of IT assets to be disposed of, including computers, servers, mobile devices, etc.
3. Vendor Qualifications: E-waste companies have caused horrific environmental disasters.   When fly-by-night companies struggle financially, they have been known to cut corners, resulting in superfund sites and data breaches.   Examples include subcontracting to the lowest-cost downstream vendors and failure to follow strict security procedures.  We recommend checking:
   • Experience and Expertise: Request information on the vendor’s history in IT asset disposition services and their expertise in handling similar projects. 
     • Does the vendor have a Certified Secure Destruction Specialist® (CSDS®) on staff?
     • Are they committed to continuous improvement and innovation in their services? 
     • Are they willing to share high-level reports on financial stability?
     • How long has the company been in business?  
   • Certifications: Does the vendor hold relevant certifications, such as: 
     • R2v3 Environmental Compliance:  Ensure the vendor follows environmentally responsible recycling methods and has certification from R2v3. This certification requires the vendor to have an Agreement for Responsible Disposal of Sensitive Materials for all downstream vendors. 
     • Mobile and Plant-based NAID AAA certification: NAID is a third-party association that provides unannounced audits annually to validate media sanitization companies’ security processes and compliance. The vendor should have NAID certification (not just membership in Isigma). 
     • Defense Logistics Agency (DLA): Program managers should require a disposition vendor to be certified by the DLA to transport military critical data. This vetting process helps protect data during transport to minimize data breach risk. The program manager should also confirm that the disposition vendor’s certification is current and has not expired.
     • Department of Transportation: Is the vendor certified to transport e-waste materials?
     • Additional certifications: ISO 14001 (environmental), ISO 9001(QMA), and ISO 45001(safety) certifications.
     • Is the vendor a GSA contract holder?
   • Compliance: Different compliance standards may apply depending on the client industry. Make sure your vendor ensures your compliance with whichever applies to you.
     • Compliance standards that relate to all industries include: NIST 800-88, OSHA, the FACTA Disposal Rule, the Identity Theft and Assumption Deterrence Act, the US Safe Harbor Provisions, the PCI Data Security Standard, and the Basel Action Network.
     • Compliance standards that relate to Healthcare companies: HIPPA, HITECH, FDA Security Regulations (21 C.F.R. part 11).
     • Compliance standards that apply to Financial Services Companies: The Sarbanes-Oxley Act, the Gramm-Leach-Bliley Act, the Bank Secrecy Act, and the Patriot Act of 2022.
     • Compliance standards that apply to government agencies or contractors:  NISPOM 32 CRF Part 117 (which has replaced DoD 5220.22-M) data sanitization, DFARS, NIST SP 800-171 (Requirement 3.8.3), and CMMC 2.0. Certificates of Destruction are provided as critical proof for DCMA DIBCAC audits and cybersecurity risk mitigation efforts. GSA Bulletin FMR B-34 e-waste standards.
   • Service Capabilities: Does the vendor cover the regions where your company operates? Do they offer both on-site and off-site data destruction and asset disposal? Is the vendor capable of scaling the service to handle large volumes? Does the vendor have logistics and transportation capabilities for asset collection needs?  Are Secure Storm Cases or lockable bins available for safe asset collection and storage? 
   • Customer Service: Is customer support available and responsive?  Will you be assigned a dedicated project manager? Can site visits be arranged to determine logistic and security requirements?
4. Data Security Measures:
   • Data Destruction Methods: Inquire about the processes to ensure complete data erasure or destruction. Are methods used up to strict NSA standards? Are certifications and compliance standards met and/or exceeded? (see above) Does the vendor stay current with the most technologically advanced methods of destruction? How much experience does the vendor have with classified, CUI or other federal government data?
     • Software Wiping – Is wiping done with certified data erasure software? 
     • Shredding  – Is shredding available for various devices and drives both on and offsite? 
     • Degaussing – Does the vendor have NSA-approved degaussing equipment? Can mass quantities of media be degaussed quickly?
     • Disintegration – Is Vendor able to disintegrate to an NSA approved 2mm? 
     • Incineration – Is incineration available for SAP Classified Data
     • Mobile – Are all data destruction methods available at the client site?
   • Chain of Custody: Seek details on how the vendor secures the handling and tracking of assets from collection to final disposition.
   • Employees: Are employees pre-screened and given background checks with fingerprints and drug testing? Is there Intense and ongoing Employee Security Training?
5. Reporting and Documentation:
   • Detailed and Timely Reporting: Does the vendor measure the timeliness of inventory reporting, and do reference checks validate their metrics?
   • Accurate Reporting: Can the vendor prove scanning accuracy or more than 99% and demonstrate a methodology to correct errors
   • Weight and LEED Reporting: Does the vendor provide weight and LEED Reporting?
   • Double Check: Does the vendor provide a two-step verification of captured data?
   • Audit Trail: Does the vendor provide a comprehensive audit trail for all processed assets?
   • Client Portal: Does the vendor provide a client portal for access to inventory reporting, allowing for search by variables such as serial numbers, asset tags, etc?   Does the portal support single sign-on?
   • ITAM Integration: Does your organization require integration with an IT Asset Management system like ServiceNow?
   • Certificate of Destruction: Does the vendor provide a Certificate of Destruction that verifies data destruction and environmentally compliant recycling?
   • Detailed Reporting: Ensure you receive comprehensive reports outlining each asset’s disposition process and outcomes.
6. Service Level Agreements (SLAs):
   • Performance Metrics: Define the expected service levels, including timelines for asset pickup, data destruction, accuracy, and reporting
7. Pricing Structure:
   • Cost Breakdown: Request a detailed pricing model, including any fees for transportation, data destruction, and other services.
   • Value Recovery: Inquire about the vendor’s approach to asset remarketing and how recovered value is shared. Evaluate your vendor’s market reach and ability to sell refurbished assets. When assessing value recovery, be sure the ITAD vendor is an experienced NAID AAA and R2v3 certified ITAD service provider who can ensure proper data sanitization and recycling. Ask about the vendor’s capabilities to repair or refurbish sanitized assets to maximize value and minimize e-waste.
8. References and Testimonials:
   • Client Testimonials: Check reliable sources such as Gartner reviews for references from previous clients, particularly those in similar industries or with comparable project scopes.
   • Interview References: Develop a list of questions in advance, such as those about accuracy, security, volumes, security procedures, etc.
9. Site Visits or Trial Runs:
   • Conduct a site visit to the vendor facility or schedule a trial project and have your team audit the vendor’s work.

Best Practices for Developing Your ITAD RFP

• Be Specific: Clearly articulate your requirements to enable vendors to provide precise and relevant proposals.
• Encourage Transparency: Seek openness from vendors regarding their processes, certifications, and any potential subcontractors involved.
• Evaluate Sustainability: Consider vendors’ commitments to environmental sustainability and how their practices align with your company’s green initiatives.
• Assess Flexibility: Determine the vendor’s ability to scale services and adapt to your organization’s evolving needs.

By meticulously crafting your IT asset disposition RFP with these components and best practices, your company can identify a partner that meets your technical and security requirements and aligns with your organizational values and goals. This strategic approach ensures a successful IT asset disposition process, safeguarding data and contributing to environmental sustainability.

 

How Securis is Increasing Accuracy and Efficiency with Cutting-Edge Scanning Technology

Inventory accuracy is a cornerstone of effective IT Asset Management and Disposal (ITAD). Securis has recently invested substantially in state-of-the-art handheld mobile computers in our ongoing pursuit to provide industry-leading asset-tracking accuracy. Our latest investment propels us even further towards delivering the most accurate and efficient IT asset inventory tracking available.

Introducing Zebra TC58 Scanners Advancing Asset Tracking

Securis has recently upgraded our handheld scanners to Zebra TC58s, a powerful, enterprise-class handheld mobile computer designed to streamline and improve inventory management. The TC58 is fantastic at capturing barcodes, even if they are damaged or poorly printed. Powered by a robust Qualcomm Snapdragon 8-core processor, the TC58 enables faster and more efficient operation, allowing it to handle demanding applications effortlessly, ensuring a seamless and efficient scanning process.

Enhanced cameras in the TC58 (16MP rear and 5MP front) make it easier to capture high-quality images for proof of delivery, asset tracking, or inspection tasks. The enhanced cameras have improved the ability of our DriveSnap AI technology, our AI-powered asset label scanning innovation that enhances speed and accuracy in asset scanning and provides a photo record of each scanned asset slated for destruction. 

Beyond speed and accuracy, these handheld mobile computers align with our broader technology upgrades to tackle persistent IT Asset Management and Disposition challenges. Two key issues historically plaguing the industry are duplicate scanning and matching drives to their respective storage controllers, servers, and cabinets. Our enhanced scanning capabilities directly address these pain points, significantly improving efficiency and accuracy.

Eliminating Duplicates: Enhancing Accuracy and Efficiency

Mistakes are inevitable when scanning thousands of assets daily. Industry data suggests that scanning accuracy typically falls below 85%. A common issue is the inadvertent duplication of scanned items, leading to time-consuming investigations.

Our new scanning technology has significantly improved duplicate detection, allowing us to eliminate errors and streamline operations. This advancement has dramatically reduced the time required to investigate discrepancies, ensuring our clients receive the most accurate reporting possible. As our Mobile Device Administrator Michelle Armon notes, “Not having to worry about duplicate items being scanned has significantly increased our efficiency around asset scanning and brings us closer to our goal of 100% accurate reporting.”

One-to-Many Matching: A Tailored Solution for Client Needs

One of the most significant challenges in ITAD is ensuring that every asset is correctly matched to its corresponding storage device before being securely disposed of. Many of our clients, particularly those in the banking and financial services sectors, require assets to be matched to their storage cabinets for compliance and financial reasons.

For example, financial institutions often track their IT assets using asset tags and serial numbers. Before destruction, they must confirm that all drives in a storage cabinet have been purged or destroyed according to NIST 800-88 standards. Furthermore, some clients receive trade-in credits when they return storage arrays or servers to vendors such as IBM, HP, or Dell. Our new scanning technology facilitates the seamless matching of one storage array or cabinet to all associated drives, providing comprehensive and accurate inventory lists tailored to client requirements.

The Future of IT Asset Management at Securis

Implementing our new scanning technology marks a significant leap forward in our mission to provide the industry’s most precise and reliable IT asset inventory tracking solutions. By addressing key challenges such as duplicate scanning and one-to-many asset matching, we are enhancing our clients’ security, compliance, and efficiency.

Securis remains committed to setting new standards in IT Asset Management and Disposition as we continue to evolve and invest in cutting-edge solutions. Our latest advancements in scanning technology are just one example of how we strive to provide unparalleled service and innovation to meet our clients’ evolving needs.

Stay tuned for more updates as we push the boundaries of what’s possible in IT asset inventory management!

Sustainability Meets National Security-Interview  Transcript

Attendees

Kurt Greening, EVP Securis

Richard “Dick” C. Schaeffer, Jr

Mr. Schaeffer is a former Senior Executive with the National Security Agency (NSA), with almost 50 years in the Information Security, Cyber Security, and Intelligence space. Since retiring in 2010, Mr. Schaeffer has continued to pursue his passion for improving the security of U.S. and partner interests in the Cyber domain. He started a private consulting firm, Riverbank Associates, LLC, located in Severna Park, Maryland, bringing visionary leadership, management, technical experience and expertise to his client’s challenges. His client base has included a full range of private sector companies from small start-ups, middle market companies, large system integrators, commercial businesses, and international entities.  He also leads the Paladin Strategic Advisory Group and is a Principal in Endeavor Technology Group.

Bill Downer

Bill is a Managing Director at Rare Element Solutions, a company that was formed to solve supply chain challenges for the U.S. Department of Defense.   Before starting Rare Earth Element Solutions Bill was vice president of national programs at Seagate Government Solutions, a provider of data management solutions to federal agencies.  Downer previously held several sales-related directorial roles in companies such as Sun Microsystems, DEC, StorageTek, Quantum, Mellanox Technologies and DataDirect Networks. Downer earned a master’s degree in business administration from Averett University and a bachelor’s degree in religious studies from Randolph-Macon College.

 

Transcript

Kurt Greening: Welcome Dick and Bill. For anyone who doesn’t know,  my name is Kurt Greening and I am an executive VP with Securis. We’re an industry leader in drive shredding and IT asset disposal. And today we’re here to talk about two important issues, sustainability and national security. For those of you who may or may not know Bill and Dick, I’ll just read a quick bio, and if I miss anything, maybe the two of you can help me a little bit.

Kurt Greening: But Dick Schaefer actually is a former executive with the National Security Agency, NSA, and he spent almost 50 years in the information security cyber security, and, intelligence., and he’s still pretty active these days, doing things like working for Riverbank Associates, working for Paladin.

Kurt Greening: in terms of investing in some up-and-coming technologies. and he’s also a principal in Endeavor Technology. Did I miss anything Dick you want me to point out?

Richard Schaeffer: No, that’s it.

Richard Schaeffer: I’m an old guy who’s been seen a lot.

Kurt Greening: Awesome. That’s great.  And Bill, it’s great to have you on as well. I’m excited to introduce people to Rare Element Solutions which is a company that recently has been created to solve supply chain issues for the US Department of Defense.

Bill Downer: Yeah.  Thanks, Kurt.

Kurt Greening: And I know you’ve been around also for a while working for people like Seagate, Sun, DAX, Storage Tech, Quantum if there’s an expert out there in the data storage industry, I think your resume kind of screams that. So I’m really excited to have you on and introduce people to what Rare Element is doing. So, maybe if I could start with you, to help our audience, can you explain to people how supply chain became a national security issue or became an issue that maybe more people are now aware of today?

Richard Schaeffer: Yeah, I think it’s more the latter. Supply chain has always been a national security issue. whether that is in the aerospace and defense, whether that’s in intelligence, whether anytime the US government has built something to execute or conduct a mission, the things that go into the technology that supports those missions has always been critical. we haven’t always thought about it in the context of supply chain.  We would design things, we would order material, we would build things, we would test them, we would deploy them. and eventually they’d reach end of life and they’d probably end up in a warehouse somewhere or I started out life in the Marine Corps. we were the folks that got everything after the other services were done using them.

Richard Schaeffer: So we learned how to do a lot with very little. But over the last 10 years the concept of understanding protecting the supply chain has become more and more important.  And then I think during the COVID era when all of a sudden the containers sat on ships in harbors on the west coast or on the east coast and components couldn’t be brought ashore because of the shortage of personnel or the inability to move the material off the docks and so forth.

Richard Schaeffer: people became more aware of just what it meant when you couldn’t order get material, build things, deliver things, and so forth. and there’s always been an issue with at end of life, how do you ultimately take something that has been a critical mission component? I’ll say all my years at NSA we worried about national security systems.  of those systems that procified that process classified information or were part of weapon systems and you worry how do you destroy devices that are part of that ecosystem such that if an adversary was to obtain those devices they couldn’t extract anything from them that was useful.

00:05:00

Richard Schaeffer: and NSA was responsible for setting the standards for how that was done. the discipline to do that I’m not always sure was at the highest level that it needed to be because I think IG’s and others would find warehouses where there was equipment stored that probably should have been destroyed years ago or things were done just out of expediency the people who were actually doing it weren’t even aware of the requirements for how things should be processed.

Richard Schaeffer: But I think we’re in a time now in a phase when supply chain’s important and it’s important to think about supply chain from whether it’s mining or that that creates the aluminum, titanium, other metals from which gearboxes or other kinds of devices that go into aerospace and defense components or whether it’s the sand that forms the silicon devices from which micro electronic devices are produced and then ultimately at the end how those things are recovered. I think it’s a much much bigger issue today but it’s not new.

Richard Schaeffer: It’s the attention we’re bringing to the capabilities that we can bring to that environment and then ultimately how do we ensure that we’re maximizing the value chain that’s part of this whole process as well.

Richard Schaeffer: So probably more than you wanted on just the national security aspects of it but it’s an extraordinarily complex topic. not well understood by a lot of people who are outside of the immediate area impacted by supply chains.

Kurt Greening:. Perfect. Yeah, thanks for that. Bill when I talk to a lot of people about sustainability, they’re thinking about Earth Day recycling cans, can I buy an electric car? But maybe an area that they might be less familiar with is electronics. How does electronics play a role in sustainability?

Richard Schaeffer: Well I’ll start and then maybe kick it over to Bill. As I pointed out earlier, NSA is responsible for the destruction piece.  So, there are materials that we’re able mine in partner, countries that become the feed stock, if you will, for the microelectronic devices. we used to produce a lot of them here. actually NSA used to have its own foundry. we used to build our own chips.

Richard Schaeffer: NSA doesn’t do that anymore. there are a few microelectronic fabrication facilities here in the US. Maybe there will be more in with thrust of the current administration, but a lot of that comes from offshore. and so the devices are fabricated, they’re manufactured, they’re delivered, and then they’re put into systems here. And it used to be that when we destroyed something like a solid-state drive or a hard drive or something like that, we crush it up and then take it to a landfill. it became part of the terrain.

Richard Schaeffer: and that was done because we didn’t have the ability to recover the devices, even the precious metals in a lot of cases. you look at a printer wiring board today, there’s silver there, there’s gold there, and a lot of cases, we just crush it up and it goes to the landfill. and you say now are there ways in which we can actually at a reasonable price point recover some of that material so that we can feed it back to the front end of that big supply chain loop.

Kurt Greening: Yeah, maybe we’ll talk about the economics at the end. Bill, any thoughts or things you want to add to that?

00:10:00

Bill Downer: No, and I agree with Dick and his opening remarks that there was a lot of focus coming to this prior to COVID and the pandemic and where a lot of our materials for what the US government uses and the banks and everyone else were coming from China.  But to Dick’s point, the pandemic really put a microscope on so much when we could no longer get it into the country.

Bill Downer: we really became very evident of where the products or the sub-asssemblies or materials are coming from and as a result created rightfully so an alarm around where are these things coming from and how much at risk was the US because it didn’t really understand all the dynamics of the supply chain and now it has really become very much a focus

Bill Downer: which I think is great. sorry it had to be a pandemic that brought us to this point but for good outcome as a result

Kurt Greening: To the good outcomes, what are some of the things, strategies or programs that the US government is employing to solve some of these issues?

Kurt Greening: I don’t know, Dick, you want to take that one?

Richard Schaeffer: Yeah. Let me start. And again, I’ll let let Bill chime in here as well. I think it’s okay. The US government now recognizes that there’s an issue. the problem is and we do with so many big challenges in the federal government, there’s a lot of people who are involved. And whenever there’s a lot of people involved, it usually ends up where no one’s in charge. So if you think of supply chain security today, everybody’s got a little piece of it. Everybody in the federal government. So you’ve got the Department of Defense, yeah, they’ve got a big role. You’ve got Department of Homeland Security, they’ve got a role. Department of Commerce has a role. and in defense, if you look down amongst all the defense departments and agencies, everybody’s got a little role. And there there really isn’t,  there are there are policies, there are regulations, there are best practices, but there really isn’t a US government champion who is what I would call the great advocate for both the materials and the processes and who can set priorities.

Richard Schaeffer: So if if we need I’ll do something simple like if we need aluminum for manufacturing of aerospace and defense systems that can be air breathers, it can be satellites, it can be remotely piloted vehicles, unmanned aerial systems, drones, it can be a whole series of things. and there’s probably 20 different kinds of aluminum. if you go to the mines and you say, “Okay, I think it’s oxite that you create aluminum Okay, here, here’s a mine, we mine the ore, we process it somewhere. We create the alloys of aluminum by adding stuff to them and then they go off to be satellite components or airframe components whatever they do. Oh and some of this stuff has to be of a form where it can be machined, where it can be and so the manufacturer, the supply chain for that from the mining all the way through to the delivery of the components is there’s probably 10 or 15 departments and agencies that are involved in that whole process. The health and human services from an OSHA standpoint, what can people do? what can’t they do?

Richard Schaeffer: but there’s nobody who’s sort of sitting at the top saying aluminum is a critical component to aerospace and defense and we need to ensure that we’ve got input into that supply chain into the beginnings of manufacturing the creation of the material and then in the end how do we recycle  that stuff? Okay, we’ve got an F-15 that’s longer serviceable. we were flying A4s when I was in Vietnam and when they got shot up, we took them out in South China Sea and a big CH53 would carry them out there and dump them in the ocean or dump them in the sea and they’re probably disintegrated by now. That wasn’t very effective.

00:15:00

Richard Schaeffer: But it’s kind of a government mindset if there’s nobody saying here’s the priorities, here’s the processes, here’s what we need to do in order to be able to create, here’s what we need to be able to do to at end of life to recover, and here’s how all the agencies will play together in order to make that all happen. We just don’t have that today.

Kurt Greening: Yeah, great great background.

Kurt Greening: So, you gave us some examples of, planes and weapon systems and aluminum. Bill, you’re kind of our resident expert here on the interview on data storage. Tell me about What do hard drives have in inside of them that make them so valuable to the DoD?

Bill Downer: So to Dick’s point, a lot of the connectors use precious metals. in fact, the platters have been different materials over time, whether they were aluminum or glass. and all of that is recyclable, well both of those particular things are very recyclable, but at the end of the day data storage is about zeros and ones and historically how we’ve created the data on any storage device. The zeros and ones has to do with magnetism and using magnets.  And as we get more and more sophisticated, as we shrink these things down, you made more and more sophisticated magnets, which has led us to building the magnets out of rare earth metals. because everything Dick said earlier about the difficulty in mining those ores, the difficulty in processing them, they have become more and more valuable. And that’s why responsible retirement and reclamation becomes such an imperative because those materials are so hard to

Kurt Greening: Thanks for that. Dick, you kind of answered this question that, telling us there’s at least 15 different agencies in the federal government helping with this problem. I have some knowledge that DOE is also helping with some research grants and in this area. Is there anything that stands out there in terms of work that’s exciting?

Richard Schaeffer: I’m probably not as sort of current on Yeah,…

Kurt Greening: And that’s an area outside of your experience.

Kurt Greening: I mean, I know that they’re one of the 15. yeah, right.

Richard Schaeffer: I would just say, from a DOE perspective I mean, the US government has long used the DOE labs as I’ll say think tanks, and basic research components to explore of doing kind of a simple term ways of doing things.

Kurt Greening: Yeah. Yeah.

Richard Schaeffer: Anytime we had a hard problem, whether it was nuclear fusion or fission or whether it is possibly recovery of material, we’ve used the national labs as think tanks within the government classified environments in many cases to explore solutions to big hard problems and so the ability to create those solutions is interesting, but it’s not very helpful if you can’t get them out and then make them commercially viable. And tech transfer is always hard.

00:20:00

Richard Schaeffer: But if you can find ways to move the science, move the process from the laboratory to the commercial entity that can create a value proposition for executing the process, then what we’ve got is a winner. We’ve got government investment in a national lab creating a solution to a problem that can then be productized and turned into a moneymaking commercial entity which then satisfies the need of a large group of people not just a couple of scientists inside a lab.

Kurt Greening: That’s a good point Dick. So, speaking of winners and commercial viability, Bill, what made you think that you needed to start a company to help solve this problem?

Bill Downer: It’s funny and it perfectly goes off what you just talked about. While still working at Seagate Federal, they were looking for a more responsible way to they’re very much into doing the responsible things for the Earth.  And I got tasked by my manager to go figure out what was going on in responsible retirement and reclamation around hard drives. It led me to do a year-long research to look at various technologies.

Bill Downer: What I found was multiple DOE labs had developed differing technologies to get the magnets out of hard drives and to effectively get the materials back to a certain state. and we evaluated all those and the DOE and I’ve been on the hill a number of times since while I was doing this project. they started doing a lot of this research in 2010 before it was quite the crisis that it is now. and they have now created these various technologies. They have made them licensable to commercial firms, so we stood up a firm purpose-built to go take some of these DOE technologies and prove them out commercially but in particular with a focus on how to help DoD and the intelligence community responsibly retire the equipment from those sites in a certain manner, and to get the materials into the strategic reserve that has been set up for the rare earth elements. And so a perfect cycle to take both in from terms of chain of custody. These are devices owned by the government and giving back whatever products are produced back to the government for their own use.

Kurt Greening: I love it, solving some of both the economic problems, the data security problems as well as sustainability.

Kurt Greening: Is there anything more that you want to say about the methods that you plan to use or more detail? You talked about how you’re going to recover and then store the rare earth. Anything more you want to say about either of those, Bill?

Bill Downer: Yeah, I would say that we’re not fixated on just doing this with hard drives. DOE has done a great job of research reclaiming rare earth elements from all manners of magnets in everything, whether it’s in EVs or it’s in windmills or whatever. the windmills are a huge issue on how we retire those and what we do with them.  So we’re looking at all manners of technology that have been developed by the US government labs and how to build a commercial capability that allows us to do a full life cycle of anything that has been pot bought and paid for by the government whether it’s the research or it’s the actual devices.

Kurt Greening: Perfect. thank you for that answer, Bill. Dick    , I understand you worked at the NSA. You were explaining a little bit of this to me earlier. You mentioned it’s the center for storage device sanitization try to get it right I think now it is under what is called the cyber direct directorate can you talk about any of the standards that NSA has developed or maybe working in concert with some of the NIS standards that protect the DoD and also the DIB or  the defense industrial base when it comes to cyber security risk associated with end of life electronics,

00:25:00   

Richard Schaeffer: So again I’m going to use this term life cycle.  If there is a national security system, so a system that processes classified information, then NSA as in its national manager role sets the standards for destruction. So they set the standard for we’ll use Bill’s example of a hard drive. they’ll tell you, you’ve got a  big, you’ve got to try to remove all of the information that’s on the drive. So, you want to degauss it, you want to make  sure that you’ve done as much as you can do. we talk about writing ones and zeros to the platters. that’s a method. but ultimately you’re gonna grind that thing up. you’re going to turn it into essentially a handful of metallic particles and what NSA will say this is how small those particles have to be.  And so they will set the specification for the machine. Think of it as a grinder. so you’re going to throw it into a grinder, and it’s gonna, a bunch of particles are going to come out the bottom and they’re going to be of a size that NSA will say we have a high degree of assurance that no one could recover information from that device when processed through this cycle this writing of ones and zeros or degassing or grinding and ultimately you’re left with something and NSA will do that  for not just hard drives, but they’ll do it for micro electronic devices, solid state drives, and so forth.

Richard Schaeffer: The challenge is so people in the national security community are aware of those specifications because they’re part of that community, but they also form a corpus of best practices that private sector that has sensitive information on their devices should also be following.  So it’s in this life cycle and this happens quite often, it’ll be the Department of Defense or the intelligence community will create a process because of classified information data objects that are very sensitive and ultimately as the private sector looks at that and says it’s not classified in a national security sense but it’s damn important to me. it is the lifeblood of my company and therefore I’m going to treat that information, those data objects in the same way that the US government might treat their classified information. I’m going to be assured that in the end, nobody can recover that information and steal my intellectual property or whatever.

Richard Schaeffer: So gradually things leak from the defense and intelligence space into the private sector become common usage and the nation is better off from it. We don’t do enough, and this is where I get back to nobody being in charge.  Nobody’s really pulling all the pieces together and saying, Yes, we have national security information, but we also have very industrial information. We have very sensitive health care information and we’ll all have to ensure that we’re treating all of these categories of data appropriately.

00:30:00

Richard Schaeffer: And ultimately scale means everything. if Bill’s company is only processing a thousand hard drives a week,  that’s one price point. But if somebody said, Bill, I need you to process a 100,000 a week.” He’s going to get a whole lot more efficient in the way that he does that.  And then the output which is sort of these rare earth elements that are ultimately recovered from these processes, become more plentiful. They become less expensive.

Richard Schaeffer: And by the way, there’s more of them that can go back into I don’t care whether they come out of the private sector or whether they come out of the national security sector. If I can feed them back into that national need for rare earth elements, I’m minimizing then the amount of material that we’ve got to import from other countries. and so there’s this term life cycle takes on a much more significant meaning because it’s Bill and rare earth elements is sort of sitting almost at the end of that life cycle.

Richard Schaeffer: something has to be done probably to process that material to get it back into the national stockpile. But that becomes a very critical part of the supply chain not just for government, but for private sector as well. And I use private sector to mean everything that’s not US government.

Kurt Greening: Thank you for that Dick. We do have some educated customers that come to us here at Securis, and they will ask us about the National Industrial Security Program operating manual. many times they will quote, 32 CFR part 117. some of my older customers will still ask about DoD 5220, which is pretty outdated. but you talk about what’s spilling into the private sector.

Kurt Greening: You know, traditionally what I hear from civilian agencies is that they are following NIST publication 800-88. but I’m also hearing that from banks and hospitals in the private sector.  So the good news is the work that the taxpayer is funding around cyber security that is flowing out into organizations that are protecting citizen data our financial systems energy sector etc.

Richard Schaeffer:  Let me just give you one additional piece of good news or what should be good news. NSA creates specifications, NIST creates specifications. and I’ll say people inside the system understand those things but you don’t understand the specifications for the tires that are on your car right?  You just go to Goodyear, and you buy a set of tires, or you go to Firestone or whoever you go to. you go there and you buy a set of tires for your car, that’s the endpoint.  That’s where we’ve got to get this to where people don’t need to know the specifications. They don’t need to know sort of, is the grinding machine, does it meet this spec?

Richard Schaeffer: What they need to know is that for the national good, they’re taking their outdated, no longer usable microelectronic devices and they’re putting them into a process that ultimately ends up doing good for the nation. And again I’m looking for this grand pooba, who’s going to be the sage on the mountain, but we don’t talk about it in that way. we talk about it in terms of the geek speak for those organizations that are mandated to do it, most of whom do.

Richard Schaeffer: But if we made it easy, if we made it economically feasible if we made it so that they felt like they were contributing to the national good in some way, and sort of other hats that I wear, I meet with investors who don’t have a clue about national security. They don’t have a clue about complex IT systems.  But what they say is, “I’ve made a lot of money in my life. It’s real estate or it’s whatever they’ve done.” and I want to contribute to the national good. and so that’s the context, I think, that when we can get companies to understand that they’re contributing to the national good simply by not throwing this stuff into a landfill somewhere.

00:35:00

Richard Schaeffer: and it’s it beyond recycling. it’s actually a contribution to the national and then I think we begin to build scale. We begin to bring prices down. We begin to fill that national supply need for rare earth elements. we do the things that we need to be to become a much more self- sustaining and truly a much more self- sustaining because we’ve got the life cycle part down. Then companies Securus become a critical link in that chain as well because you’re the outward-looking face to the private sector.

Kurt Greening: Yeah, perfect.

Kurt Greening: And I probably should have mentioned the good work that folks over at NSA have done on the evaluated products list for shredders and degausers. So that’s certainly helpful. But maybe I wanted to switch the conversation a little bit. I’ve got a lot of friends who are chief information security officers, sisos, and the defense industrial base.

Kurt Greening: And I’ve had conversations with them and some of the hot cyber security topics today are software supply chain cloud security that’s all the new rage and what you have these folks talking about but do you think that the defense industrial base and the government should be paying as much attention to end-of-life electronics as some of these new hot cyber security issues?

Richard Schaeffer: Without a doubt. I believe that there are devices sitting in warehouses that have highly sensitive industrial secrets on them. I’ll use the term secrets. Maybe that’s a small S but intellectual property I think. So I’m going to give you another example, and it can be edited away but my wife has a friend who does estate sales and so occasionally he’ll need help setting up somebody’s parent dies or grandparent or some friend or some there’s nobody left and they hire a company to come in and sort of run an auction or run a sale and get rid of all the stuff. So, she did this a couple of weeks ago and she comes home and she says, “You’re not going to believe this”. This guy who died had a box and I think there were 27 hard drives in a cardboard box. and the guy who runs the estate sale said we’ll sell them for $2 a piece or $5 a piece or whatever it was. and I said, go tell Duke, don’t you dare. I said, ‘You have no idea what is on those hard drives. What if you’re selling somebody’s pornographic library? worse, what if it’s child pornography on there?

Richard Schaeffer: What if there is? You have no idea. What they ought to do is take them to a place that’s going to grind them up and shred them and get rid of them. And I think that situation occurs, all over the country probably a thousand times a day. It’s probably not pornographic libraries, but it’s probably personal banking information. social security numbers, all sorts of personal information and it’s so easy for somebody to go to a sale. I mean, these estate sales are all over, go to a high netw worth area, go to an estate sale and buy a used computer and see what’s on it.  

00:40:00

Kurt Greening: Yeah Dick you’re right. So I-Sigma did a study and bought electronics off of eBay. More than 40% of them had either corporate or personal personally identifiable information on them. Rapid 7, who’s a cyber security company, they bought infusion pumps off of eBay that were in hospitals and they were able to get the wireless configuration data from seven hospital chains. So, you’re right, those things are a risk. So, I’m going to ask one last question and then maybe we’ll call it a wrap. this has been awesome. Thank you, Dick, and thank you, Bill.

Kurt Greening: So, Bill, not too long ago, maybe, I think in the last two years, it was probably going back to your time at Seagate, you started to approach Securis to, help what now became, your company, and I’ll post the link in the show notes to help the DoD solve this issue that is at the intersection of supply chain, cyber security, and sustainability. what made you decide to partner with Securus on this?

Bill Downer: So just like I did a due diligence on all the various reclamation technologies, I did a similar thing on information technology asset disposal companies and the name of Securis came up multiple times for the quality of the recordkeeping, the responsible method in which they did the work, and the fact that you were doing work for both the federal and state and local governments.  And I became such a fan, and this predates you, Kurt, that I actually hosted multiple tours, I’m not sure if you’re part of these, but we hosted the industrial policy people for supply chain from the Pentagon. We hosted Defense Logistics Agency who’s responsible for the strategic reserve.

Bill Downer: we hosted the Department of Energy industrial or advanced manufacturing group and it’s interesting to me every time I was at a meeting with various government executives often that were set up by Dick what we found was that many of the people that set the policies around the supply chain around defense logistics had never visited an asset disposal facility. and so I brought them out and typically they’d say, ” I’ll give you 45 minutes and I’m out.” Couple of times, Dan and I had to run them off the facility at the end of the day because they didn’t leave because they had so many questions and here they are setting policy around responsible destruction and reclamation and yet have not had an opportunity to tour such facility.

Bill Downer: Given your proximity to the beltway, your company, it is ripe for bringing people out from various headquarter locations in the federal government to see a very responsible company do what you do. and how you do worry about the full supply chain, and keeping the proper records and keeping up to speed and being a leader in the certifications required in that industry. You are always ahead of the game. And so it was easy for me to become an advocate and host those tours. And y’all did a great job of hosting the various government representatives so they could learn more about how their policies were affecting industry.

Kurt Greening: Thank you, Really appreciate having you on, your partnership, what you’re doing for sustainability, what you’re doing to protect our national security interest, and looking forward to more great work on solving these problems.

Richard Schaeffer: Yeah. Thank you,  And I just leave you with you should be unapologetic and ruthless in demanding of your government, and my government, the  best process, the best approaches, you’re you live it day to day. You know what works. You know what doesn’t work. You know what what works well, what needs to be fixed.And you should be demanding of the government solutions that actually work for the masses, not just for the people as Bill pointed out, people that set the policy who’ve never actually done the work to understand what do those policies actually mean. So, be unapologetic and be ruthless.

Kurt Greening: With that, we’ll end.

Kurt Greening: Thank you for that advice, Dick.

Richard Schaeffer: Thank you.

The transcript and the full video of the conversation between Kurt Greening, EVP at Securis, Greg Crabb, and Nick Crabb of TEN EIGHT Cyber appear below. 

Contact Information

Gregory Crabb:  https://www.linkedin.com/in/gregorycrabb/

Nicholas Crab: https://www.linkedin.com/in/nicholas-crabb/

Kurt Greening:  https:https://www.linkedin.com/in/kurtgreening

Website Information

Securis:   https://securis.com/

Ten Eight Cyber:   https://teneightcyber.com/ 

Assessment mentioned in the video:  https://assessments.teneightcyber.com/

 

Kurt Greening, Securis: 

For those of you who don’t know me, my name is Kurt Greening, and I am an EVP with Securis. Securis is an industry leader in IT asset Disposal. Today, we are here to discuss how to lower the risk associated with the disposal of organizational I.T. assets. Gregg, before we get into that topic, can you briefly introduce yourself and tell me who TEN EIGHT Cyber is?

Greg Crabb, TEN EIGHT Cyber: 

Absolutely. Thank you so much, Kurt. My colleague Nick and I work together here at TEN EIGHT cyber. We’re a cybersecurity advisory firm focused on empowering organizations to build resilience against cyber threats. And we provide a variety of different offerings. Today we’ll talk about what we’re doing in order to be able to support organizations, in conducting assessments against, proper I.T asset management practices. And, we provide a variety of other advisory services, anything from incident response and management to third-party risk management. So thanks for having us, Kurt. Really excited to collaborate, and Nick and I are really excited to support you.

Kurt Greening, Securis: 

Yeah. Great. Yeah. We’re glad that you’re here. Nick, can you do the same thing? introduce yourself. I understand that over the last few months, you’ve been doing a lot of research, around this space. Maybe you can introduce yourself, but then also share some of the things that you found, in terms of vulnerabilities, breaches, fines, really in the space of  IT Asset management.

Nick Crabb, TEN EIGHT Cyber: 

Yeah, totally. So my name is Nick Crabb. I currently work as a cyber security engineer for TEN EIGHT Cyber, and I create presentations, policies, assessments, and daily threat reports. every day, talking about anything from ransomware to, end-of-life systems and kind of nation-state threat actors. And today I kind of want to go over some end-of-life systems that pose risks to organizations. And I’ve done a little bit of, research on that. And there are two main breaches I kind of want to go over. The first one is the Filefax HIPAA violation. And this is a great example because even after shutting down, Filefax was fined $100,000 for improperly handling 2150 patient records. And they were later sold at a recycling center. And, these threat actors were able to sell that information. And obviously, they had to go to court and HIPAA was able to, fine them for not properly, disposing their assets.

The next one is Morgan Stanley and they were  fined $60 million by the U.S. Treasury Department for failure on IT Asset destruction. And this includes,   proper oversight and decommissioning, two data centers, failure to track customer data and inadequate vendor management. Now, more than ever, I think, companies need to focus on IT Asset Destruction And from when I was researching it from kind of knowing nothing to knowing a lot, now I think, I took a new company perspective.

It’s hard to think about IT Asset destruction when you’re a new company, when you have a small inventory and new equipment. But as the years go on and the equipment that you use gets older and the inventory grows week after week, without secure IT Asset destruction policies and kind of procedures go out the window. And I think, organizations can’t kind of live with the regulatory fines, legal liability and the devastating breaches that the two, kind of examples I went over.

Kurt Greening, Securis: 

Yeah, I agree, I mean, it’s the big companies that, tend to have the lawsuits, tend to have the fines. And obviously that creates the biggest risk of, you know, breaches, employee or customer, data. So that’s a big deal. And, yeah, Nick you didn’t mention that you produced a cyber threat report on a daily basis. I’ve seen that. I will, post in the show notes. You’re on LinkedIn for those who want to follow you, you want to make sure that, there avoiding vulnerabilities and risk in multiple areas. So, thanks for that. Greg, I’m going to throw you a question here. So, maybe people don’t know you’re a former CISO. You served, in the federal government, both in law enforcement and later, as a CISO of the U.S. Postal Service. But one of the things that I’m curious about as I talk to, other CISO’s, I’m just curious why other CISO’s might not be doing more to lower risk in this particular area.

Greg Crabb, TEN EIGHT Cyber: 

Yeah, really good question, Kurt. And I’m going to kind of look at it from a couple of different lenses. The first is competing priorities. CISOs are focusing on so many different things, whether it’s ransomware prevention, supply chain attacks, all of the NIST CSF controls or CIS controls. There’s a lot there, and quite frankly, IT asset disposal gets overlooked. And there are other reasons as well. Because they’ve got so many different things going on, they might delegate that to the IT  help desk function for the organization. You know, you  distribute the technology, you know, you also get rid of the technology. You know, I don’t want to worry about it. You guys do it. And that also speaks to some of those business processes in that  I.T. technology management asset, management track and that many organizations don’t have a comprehensive IT asset inventory, so it makes it difficult for them to track, even if they have assets that need to be decommissioned, right. And that kind of speaks to that cross-departmental responsibility confusion that I, that I alluded to. 

So, you know, and I think, we need to kind of re-examine, I think we’re getting to the point where, from a NIST, and policy perspective, we need to take a look at this whole concept of encrypted hard drives and reexamine that in the face of what threat actors are doing right now is buying, outdated, hard drives and decommissioned hard drives with the hope that, you know, when, quantum cryptography, is developed and the ability to break that encryption, arises. and so we need to look at those policies and think, you know, BitLocker is great right now, but BitLocker, in the face of, the quantum threat will not be sufficient. And, you know, is that five years from now is that ten years from now, we don’t know. But I don’t want any of the information that’s on my drives exposed ten years from now because we didn’t take care of our assets properly today.

Kurt Greening, Securis: 

Yeah. I definitely agree with the competing priorities. And, you know, I don’t think we’re on this call to beat up CISO’s because they get beat up enough and, you know, just, I think just watching Nick’s threat report every day, can make it difficult to get sleep at night. So, thanks for that. So, Nick, in  the vein of trying not to be beat up organizations, you know, we talked about some of the risks and where organizations have made mistakes, but there’s probably more people that are doing things right than making mistakes. Can you provide a few examples? in terms of the research that you’ve done or companies that you’ve talked to and things that you’re seeing them do right in terms of I.T. Asset Management?

Nick Crabb, TEN EIGHT Cyber: 

Yeah, totally. So these are more kind of, general examples, companies that are getting their IT Asset destruction process correct, are typically the ones not in the news. And that makes a lot of sense. So, to ensure secure and compliant IT Asset destruction I think it’s important to align with NIST 800-88. From my journey learning about NIST 800-88 was significant, and I’ve learned a lot through that. And I think some leading practitioners are Amazon,  financial institutions, and government agencies, and they implement strong asset tracking and secure disposal processes. And I think that’s very important for organizations to secure all their assets after end-of-life. So organizations that maintain a comprehensive inventory and enforce proper destruction protocols not only enhance security but also build customer trust and regulatory compliance.

Kurt Greening, Securis: 

Yeah, I agree, Nick. I haven’t reviewed Amazon’s policies, but I have reviewed Microsoft’s policies. And they’re pretty good in this area. I’ve also worked with some banks that have incredible, I.T. asset management, policies. They have really good oversight of third-party, ITAD vendors. So there are definitely some people out there getting it right, and people that in the industry that we can learn, some best practices from.  Now, Greg, switching gears and going back to you, how does getting I.T. asset management, right, relate to cybersecurity best practices?

Greg Crabb, TEN EIGHT Cyber: 

Several lenses that, Nick kind of, opened us up into, I think I want to expand on and, first and foremost, it’s risk reduction. Right. Improperly disposed of I.T assets are targets for cybercriminals, and, a CISO’s role is to reduce risk for the organization. So, making sure that, a proper I.T. asset management practices are in place are critical. The next is really looking at this from a zero-trust perspective. When you look at both the data pillar, and the device pillar, they converge at  I.T. asset destruction. Right. When you look at, you know, the, termination of those life cycles, are at I.T. asset destruction. And so, to have a proper zero trust, organization, based on those principles, I think you really need to look at, I.T. asset destruction as an endpoint for those, and then, obviously, the regulatory compliance aspects Nick’s talked about HIPAA. Organizations that face GDPR, and the FFIC regulations, obviously with what Nick reported on relative to Morgan Stanley, those are excellent examples of, kind of the regulatory, compliance requirements that exist in this area. So, you know, those are kind of the lenses that I’m thinking about relative to some of the cybersecurity best practices.

Kurt Greening, Securis: 

Okay. Yeah. Great. that’s helpful. Greg, I got another question for you. So, I talked to a couple of lawyers about this area and some other risk management professionals, and they referred to a, I guess, a term of having defensible IT asset management policies. Can you help our audience understand what they might be referring to?

Greg Crabb, TEN EIGHT Cyber: 

Yeah. So, I think any regulated agency or, maybe that’s the DOD supply chain for CMMC perspective or the financial services from a FFIEC perspective, defensibility, documentation, compliance and verification, those kinds of terms rings through. So, do you have a well defined asset management lifecycle, including,  asset destruction policies and procedures? Are you complying with those policies and procedures? And do you have a means to verify that the performance of those controls are done in a complete manner? And so, I think it goes back to, like I say, documentation compliance and verification.

 Kurt Greening, Securis: 

And Greg, I would guess that proper oversight of third-party vendors would be included. In those three things.

Greg Crabb, TEN EIGHT Cyber:

Absolutely. You know, just, I guess I generally alluded to it when I mentioned CMMC, that’s a that’s a whole supply chain related, body of compliance requirements. And so, by all means, having a proper, third party, visibility and assurance is necessary. When you think about the complexities of the supply chain and, any technology service provider or financial institution or, or government contracting context,

Kurt Greening, Securis: 

Perfect, great answer, I think. I think I have a better understanding now. Nick, So I’d love to hear from you again. I understand that you and your team have actually developed an offering that’s going to help busy CISO’s lower this risk in the area in particular. I think what got me excited is I talked to a number CISO’s and they said similar things are busy. you know, one said, hey, you know, the most amount of time my team has spent on it is to set up a policy and then, you know, expect that the team follows it. But, you know, this particular individual did acknowledge, hey, if there was something else I could do, like, maybe hire a third party to help me with this. He seemed really open to it. So, could you describe the offering that you developed or the assessment that you developed and then maybe let people know how they could get started with ten eight cyber if, you know, they think, hey, I probably need to improve my I.T. asset management or my I.T. disposition practices, but I maybe I don’t know my level of risk, or I don’t really know what things I should be improving on first. You know, how could they approach your team?

Nick Crabb, TEN EIGHT Cyber: 

Yeah, totally. So I just want to preface first. They’re definitely cost-effective. TEN EIGHT is currently offering a few different I.T. asset disposal assessments with various tiers aligning with large and small organizations. The introduction assessment is our first one. It’s very basic, with 12 questions allowing the company to answer them on their own, and then a consultation will be scheduled with TEN EIGHT to go over and kind of go in and talk about their, depth and the specific gaps they have in the company’s answers. We then create in a report an analysis on how the company can best improve based on that. We then have larger assessments that allow TEN EIGHT to go into the organization, which we can be on-site or on a call, and we can talk about how an organization can create a comprehensive I.T. asset destruction process based on the company’s personnel, policies, and procedures. And this is all aligning with NIST 800-88. The easiest way to get started with us is to visit our website to set up an introduction meeting with TEN EIGHT and we get to start with the company right away and kind of help them develop a strong I.T. asset destruction process that is safe and secure for not only them, but their clients as well.

Kurt Greening, Securis:

Sounds like an easy choice. And and to get to TEN EIGHT cyber, I believe it’s, is it www.teneightcyber.com or can you help me with your, I will post it in the show notes. 

Greg Crabb, TEN EIGHT Cyber:

It’s, www.teneightcyber.com

Kurt Greening, Securis: 

Thanks, Nick. Thanks, Greg. I think I learned something. I think that there’s an opportunity here, with a relatively small, financial and time investment that organizations can lower their, their risk in this area. And and I think CISOs can have one less area to stress about. So really appreciate you guys, and, thanks so much.

Greg Crabb, TEN EIGHT Cyber:

Thank you, Kurt. Really grateful for the opportunity. and collaborating with Securis.

Nick Crabb, TEN EIGHT Cyber: 

Yeah. Thank you I appreciate it.