In an effort to help busy security managers, CISSP Shelley Bard's weekly column will build upon the concept of the perpetual calendar, offering a schedule of reminders for a proactive, strategic
security plan. Also visit our archive of previous columns.
Review policy and paper output, and holdings at least annually.
Among the types of discarded information that should be destroyed: accounts payable and receivable; financial information; business correspondence; drafts and obsolete contracts; obsolete personnel records; arbitration/grievance files; job applications; insurance forms and records; medical records; legal documents; payroll records; classified documents; customer or client lists and records; ballots and obsolete negotiables (bearer bonds, coupons), etc.
We spend so much time protecting our systems that we sometimes forget about the paper result. If your company doesn't enforce a shredding policy, company-confidential or proprietary documents probably end up in the trash. Files with confidential corporate financial or customer information could give your competitors an unfair advantage. If found by "dumpster diving," for example, your company could be sued out of existence. Just last week, a television news station in Orlando, Fla., found the private information of hundreds of medical center patients, including financial records, medical charts and lab tests, in an open dumpster. The records included details of sexually transmitted diseases, psychological problems, even addictions and intimate details about a patient's sex life. State and federal government agencies are getting involved, and patients are considering taking legal action. A doctor is quoted as saying he believed all such documents were shredded; a facility manager blames the person transporting the records to the shredding facility for disposing of them improperly.
Shredding is a cost-effective and secure solution for your record destruction requirements. Some companies recycle the shreds, making you feel better about all the paper you're shredding. You can put shredders on site, or hire a company to shred your documents. Usually they charge by the pound being destroyed and offer locked containers to be placed around your site on a nominal rental basis. Some companies will pick up your documents to take to their shred facility, and some drive to your site and shred your material right in the truck while you're watching. I prefer this method -- as illustrated above, you don't know what really happens once a truck or an employee, removes your documents. Place bins or shredders near printers in data-producing areas like R&D, personnel, payroll, contracts and legal, etc.
A requirement of both HIPAA and Sarbanes-Oxley is that patient records not involved in an investigation, audit or litigation be destroyed on a regular schedule as approved by the proper officials at the facility, so that "there is no possibility of reconstruction of information." Visit the U.S. Department of Health & Human Services' Web site or the official DHHS Web site for Administrative Simplification. Please note, there are more stringent security requirements for destroying Top Secret and COMSEC documents; the National Security Agency mandates that an 8 1/2" x 11" piece of paper be reduced to 12,000+ particle-size pieces. Chances are you don't need that much -- just find a destruction solution that works for your organization while not making it a target for any type of federal or civil actions.
About the author
Shelley Bard, CISSP, is a senior security network engineer with Verizon Federal Network Systems (FNS). An infosecurity professional for 17 years, Bard has briefed and written infosecurity assessments and technical reports for the White House and Department of Defense, special interest groups, industry and academia. Please e-mail any comments to mailto:firstname.lastname@example.org
Opinions expressed in this column are those of Shelley Bard and don't necessarily reflect those of Verizon FNS.
This was first published in February 2004