Cybersecurity Doesn’t End When the Device Is Retired
Don’t overlook one of the final steps in protecting your organization’s data.
Your organization probably takes cybersecurity seriously.
Employees are encouraged to use strong passwords. Multifactor authentication helps protect accounts. Software updates are installed to address vulnerabilities. Staff are trained to recognize suspicious emails and phishing attempts.
These are among the core practices promoted by CISA’s Secure Our World initiative during Cybersecurity Awareness Month.
But there is another cybersecurity question organizations sometimes overlook:
What happens to the device when you’re finished with it?
Maybe it’s a company smartphone that has been replaced.
A laptop that has reached the end of its useful life.
A tablet sitting in an IT storage room.
Or perhaps it isn’t your organization’s device at all. It could be a smartphone left behind by a hotel guest, transit passenger, theme park visitor, university student, or someone whose property eventually ended up in a law enforcement property room.
From an operational standpoint, these may simply look like old or unclaimed electronics.
From a cybersecurity standpoint, they’re still data-bearing devices.
And that makes what happens next important.
Cybersecurity Has a Device Life Cycle
Think about how much information can pass through a single smartphone during its lifetime.
Emails. Text messages. Photographs. Contacts. Documents. Account information. Location history. Apps. Saved credentials. Personal conversations.
Organizations devote considerable resources to protecting information while technology is actively being used.
That responsibility shouldn’t suddenly disappear when a device is retired, replaced, abandoned, or legally eligible for disposition.
In fact, the National Institute of Standards and Technology (NIST)’s Guidelines for Media Sanitization specifically addresses sanitization and disposal based on the sensitivity of information contained on media. There is emphasis on greater attention toward establishing an organization-wide media sanitization program as part of the process for disposing of or reusing devices.
In other words, what happens at the end of a device’s life can be part of cybersecurity too.
The Forgotten Cybersecurity Risk Sitting in Storage
Take a look around your organization.
Is there a cabinet filled with old company cell phones?
A shelf of retired tablets?
An IT closet containing outdated laptops?
A property room filled with electronics that have cleared the appropriate retention requirements?
A lost-and-found department with phones that were never claimed?
Those devices may no longer be useful to your organization, but that doesn’t necessarily mean the information stored on them has disappeared.
And simply keeping electronics indefinitely isn’t much of a disposition strategy.
Eventually, someone has to decide what happens next.
Sell them?
Recycle them?
Donate them?
Throw them away?
Whatever the answer, protecting the information associated with those devices should be part of the decision.
Deleting Data Isn’t the Same as Sanitizing It
It’s easy to think that deleting files or performing a basic reset solves the problem.
But proper media sanitization is more deliberate than simply pressing “delete.”
NIST defines media sanitization as a process that makes access to the targeted data infeasible for a given level of effort. Its current guidance encourages organizations to establish appropriate techniques and controls based on the sensitivity of the information involved.
NIST also places increased emphasis on sanitization assurance, including verification and validation of sanitization outcomes, as well as establishing trust when vendors perform sanitization services.
That matters when an organization hands electronics to someone else.
The question shouldn’t simply be:
“Did we get rid of the device?”
It should also be:
“What happened to the data?”
What If the Device Never Belonged to Your Organization?
This is where the issue becomes particularly interesting for hotels, law enforcement agencies, transit systems, entertainment venues, casinos, universities, airports and other organizations that routinely handle lost, abandoned or unclaimed property.
The device may not contain your organization’s information.
But it could contain someone else’s.
Consider a phone left behind in a hotel room.
The hotel didn’t create the photographs stored on it. It didn’t send the text messages. It didn’t create the guest’s accounts.
Yet once that device becomes unclaimed property and eventually reaches the end of the organization’s required holding period, someone still has to decide what happens to it.
Responsible cybersecurity isn’t only about protecting information your organization creates.
It’s also about being a good steward of information that comes into your care.
Before a Device Leaves Your Organization, Ask Five Questions
Cybersecurity Awareness Month is a good opportunity to look beyond passwords and phishing emails and review your organization’s electronics disposition process.
Before selling, donating, recycling or otherwise transferring a data-bearing device, consider asking:
1. Could this device still contain data?
Don’t assume that because nobody is using it, there’s nothing important stored on it.
2. Do we know where the device is going?
Know who will take possession of the electronics and what happens after they leave your organization.
3. How will the data be sanitized?
Understand the process being used rather than assuming deletion or a basic reset satisfies your organization’s security requirements. Protect your organization: Get proof of data sanitation in writing.
4. Is there a process for verifying sanitization?
NIST’s guidance emphasizes sanitization assurance, including verification and validation, as important components of an effective media sanitization program.
5. What happens if the device can’t be securely reused?
There should be a responsible path for devices that aren’t appropriate for reuse.
If your organization can’t confidently answer those questions, now may be a good time to review your process.
Turn a Cybersecurity Responsibility Into Something More
That’s where911 Cell Phone Bank(501(c)(3)) can help.
Organizations across the country donate their retired and legally releasable unclaimed electronics through this 100% free program rather than allowing devices to accumulate indefinitely or disposing of them without a defined process.
Donated electronics are processed through a guaranteed secure device-processing program, helping organizations address the data-security concerns associated with electronics disposition.
All devices are securely processed through our partner, Vibe Wireless, a NAID AAA Certified organization specializing in secure data destruction and device handling.
For participating organizations, that means one decision can accomplish several things.
It can help move unused electronics out of storage.
It can support a more responsible approach to device disposition.
It can help protect the sensitive information those devices may contain.
It can keep electronics out of the waste stream through reuse or responsible recycling.
And when appropriate devices can be repurposed, they help support survivors of domestic violence and human trafficking.
Data security. Sustainability. Social impact.
All from electronics your organization no longer needs.
Protect the Data. Then Let the Device Do Some Good.
Cybersecurity Awareness Month reminds us that protecting information isn’t the responsibility of one employee or one IT department.
It’s an ongoing process.
And that process shouldn’t end simply because a device has reached the end of its usefulness.
Before the next smartphone gets tossed into a drawer…
Before another tablet gets added to the storage room…
Before unclaimed electronics are sold, discarded or forgotten…
Ask one more cybersecurity question:
What happens to the data next?
Then create a process that provides a good answer.
If your organization has retired or legally releasable unclaimed electronics ready for disposition, 911 Cell Phone Bank can help.
Learn more about securely donating electronics at 911CellPhoneBank.org.