WEEKLY SECURITY PLANNER
Week 10: Are you throwing out company secrets? (Part 1 -- physical records)
Shelley Bard, CISSP
02.19.2004
Rating: -4.50- (out of 5)
|
In an effort to help busy security managers, CISSP Shelley Bard's
weekly column will build upon the concept of the perpetual calendar, offering a schedule of reminders for a proactive, strategic security plan. Also visit our archive of previous columns.
When
Review policy and paper output, and holdings at least annually.
What
Among the types of discarded information that should be destroyed: accounts payable and receivable; financial information; business correspondence; drafts and obsolete contracts; obsolete personnel records; arbitration/grievance files; job applications; insurance forms and records; medical records; legal documents; payroll records; classified documents; customer or client lists and records; ballots and obsolete negotiables (bearer bonds, coupons), etc.
Why
We spend so much time protecting our systems that we sometimes forget about the paper result. If your company doesn't enforce a shredding policy, company-confidential or proprietary documents probably end up in the trash. Files with confidential corporate financial or customer information could give your competitors an unfair advantage. If found by "dumpster diving," for example, your company could be sued out of existence. Just last week, a television news station in Orlando, Fla., found the private information of hundreds of medical center patients, including financial records, medical charts and lab tests, in an open dumpster. The records included details of sexually transmitted diseases, psychological problems, even addictions and intimate details about a patient's sex life. State and federal government agencies are getting involved, and patients are considering taking legal action. A doctor is quoted as saying he believed all such documents were shredded; a facility manager blames the person transporting the records to the shredding facility for disposing of them improperly.
Strategy
Shredding is a cost-effective and secure s
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
olution for your record destruction requirements. Some companies recycle the shreds, making you feel better about all the paper you're shredding. You can put shredders on site, or hire a company to shred your documents. Usually they charge by the pound being destroyed and offer locked containers to be placed around your site on a nominal rental basis. Some companies will pick up your documents to take to their shred facility, and some drive to your site and shred your material right in the truck while you're watching. I prefer this method -- as illustrated above, you don't know what really happens once a truck or an employee, removes your documents. Place bins or shredders near printers in data-producing areas like R&D, personnel, payroll, contracts and legal, etc.
More information
A requirement of both HIPAA and Sarbanes-Oxley is that patient records not involved in an investigation, audit or litigation be destroyed on a regular schedule as approved by the proper officials at the facility, so that "there is no possibility of reconstruction of information." Visit the U.S. Department of Health & Human Services' Web site or the official DHHS Web site for Administrative Simplification. Please note, there are more stringent security requirements for destroying Top Secret and COMSEC documents; the National Security Agency mandates that an 8 1/2" x 11" piece of paper be reduced to 12,000+ particle-size pieces. Chances are you don't need that much -- just find a destruction solution that works for your organization while not making it a target for any type of federal or civil actions.
About the author
Shelley Bard, CISSP, is a senior security network engineer with Verizon Federal Network Systems (FNS). An infosecurity professional for 17 years, Bard has briefed and written infosecurity assessments and technical reports for the White House and Department of Defense, special interest groups, industry and academia. Please e-mail any comments to mailto:securityplanner@infosecuritymag.com
Opinions expressed in this column are those of Shelley Bard and don't necessarily reflect those of Verizon FNS.
Last week: Banners in support of system monitoring
Next week: Are you throwing out company secrets? (Part 2 -- Data
destruction)
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
