The Danger of Inadequate Data Disposal, Revealed by Cyber Forensic Analysis
In the digital world the most dangerous mishap is cyber crime or cyber threats. As we are learning about these threats and crime, we are becoming more and more conscious about them and always trying to ensure the security of our data in the digital devices.
But a new forensic analysis has revealed that despite firms and individuals becoming increasingly conscious of the importance of cybersecurity, inadequate data disposal and digital devices is posing a potentially catastrophic threat. Simply deleting data from the hard drive of a device before disposal is not sufficient, according to analysis from professional services firm Alvarez & Marshal (A&M).
The firm conducted in-depth forensic analysis across six used devices purchased on an online marketplace that found sensitive and highly personal data on 80% of the devices. They were able to recover 5,875 user-generated documents across the six devices.
The majority of those items came from carved data (i.e., deleted data on the hard drives of the laptops), with a few documents still sitting on the hard drives, undeleted.
The data contained highly personal and sensitive information; such as scans of valid passports, as well as various appraisal forms and job application forms detailing personal identifiable details including full names, National Insurance numbers, addresses, emails, date of births, and other sensitive data. In addition, 366 files analyzed on the devices by the A&M team included business-related keywords.
The project’s aim was to expose the dangers of inadequate data disposal in business and private settings and demonstrate how failure to properly dispose of redundant IT equipment can lead to data breaches, which not only violate data protection laws, but can also result in financial fraud, with devastating impacts on companies’ finances and reputation.
The Director at A&M, Graeme Buller explained that the rise of bring-your-own-device (BYOD) and remote working are increasingly blurring the lines between personal and business use of devices, exacerbating concerns around data security and the lifecycle management of IT assets.
While only 6% of the files recovered in our analysis contained business-related information, the very fact that they made their way onto these personal devices is sincerely worrying. If released into the wrong hands, even what appears to be small, harmless data can have a devastating impact on a company.
Buller added that the softwares they used in these projects are easily available in the market, which is a shocking fact. This highlights how vulnerable the devices really are (even when we believe them to be ‘clean’) and demonstrates the risk that fraudsters and other malicious actors with moderate forensics skills pose today.
He continued that the key here is making sure all devices are wiped correctly and observing a rigorous data disposal management process. He also told a few best practices to properly delete the information from the company’s device. They include: strongly enforcing data security policies, establishing and maintaining a secure data destruction policy, adapting policies for the new business reality, ensuring all data is securely and effectively wiped and ensuring company wide training.
