Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 13 down vote favorite
2

If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization?

What kinds of media sanitization methods are recommended for this scenario? Any references or links to industry standards would be nice.

share|improve this question

3 Answers

up vote 8 down vote accepted

What you must ask before you continue:

Is risking the release of the sensitive data worth the amount of money made from the sale of the device?

If not, destruction is your safest bet. If so, remove harddrive, EPROMS/memory, and the image drum, and sell for parts.

In my current environment, the only accepted answer by my employer is 100% destruction, but YMMV.

share|improve this answer
up vote 8 down vote

When I worked for the .gov, the answer was to take it apart looking for storage media (which you remove and take care of). If it's still serviceable afterwards, then off to salvage (for sale or recycling) it goes!

I'm sure that they did something different (aka, tossed it in a shredder) for machines that held the scary stuff, I don't know.

share|improve this answer
2  
This is a good reason to standardize on those printers and fax machines, too. You can make a book of "here's where the hard drive is in this copier" and not spend 5 hours breaking each one down. – Bill Weiss Jan 6 '11 at 19:20
@Bill and yet, up until recently we've heard so many stories about sensitive documents being reprinted on trashed or donated printers... – AviD♦ Jan 6 '11 at 20:16
2  
It is still funny how many times you see organisations remove the hard drive but miss EPROMS or other non-volatile memory, or even image drums which could still contain data! – Rory Alsop♦ Jan 6 '11 at 20:29
2  
Or when in doubt, use a sledgehammer... – SteveS Jan 6 '11 at 21:30
Avid: no comment :/ – Bill Weiss Jan 6 '11 at 23:14
show 2 more comments
up vote 3 down vote

For large devices, you can negotiate as part of the lease or service contract that the vendor will destroy the data contained within the device on your site.

share|improve this answer
1  
Of course, this will depend a lot on the sensitivity of the data. And I would stress - define every type of destruction required by your contractor (NVRAM, drum, drive etc) and then make sure there is validation/proof of destruction. This step is where many famous failures seem to slip through. – Rory Alsop♦ Jan 8 '11 at 17:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.