Wave Systems Corp. (fka WAVXQ)

[Genz2]

Discrepancies between data sanitization policy creation and execution put data at risk

https://www.helpnetsecurity.com/2020/02/07/data-sanitization-policy/

Although 96 percent of the 1,850 senior leaders within large organizations have a data sanitization policy in place, 31 percent have yet to communicate it across the business, according to a Blancco survey.

Twenty percent of respondents also don’t believe their organization’s policies are finished being defined. Overall, over half of organizations (56 percent) do not have a data sanitization policy in place that’s being effectively communicated across the full company on a regular basis. This is increasing the risks of potential data breaches.

Not taking direct responsibility for IT asset erasure – 22 percent of employees are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. Another 22 percent place this responsibility with their line manager.

If data sanitization policies haven’t been communicated to either party effectively, the chances of sensitive information being leaked as a consequence of insufficient erasure increase dramatically.

Leaving equipment languishing in storage areas

87 percent of global enterprises admitted not sanitizing assets as soon as they reach end-of-life, while 31 percent reported taking more than a month to sanitize these devices. This puts companies at risk of equipment loss, theft, and data breaches.

Performing offsite erasure

34 percent of enterprise organizations are sanitizing PCs and laptops offsite at end-of-life. Working with a third-party provider to sanitize equipment offsite isn’t necessarily a bad thing, but it does present certain risks, particularly if organizations don’t have complete visibility into the chain of custody for their IT assets and have no way to prove that the data on their assets wasn’t compromised during the transportation process.

Any external contractor needs to provide detailed audit trails for the entire chain of custody and certified erasure at end-of-life for these assets.

Lacking clear ownership of data sanitization policies

Although 68 percent of respondents felt that ownership of data sanitization policies is clearly communicated within their organization, when asked who was responsible for their implementation, 18 percent of enterprises stated the DPO, 18 percent the Head of Operations, 17 percent the Head of IT Operations and 11 percent the CISO.

This lack of clear ownership could suggest enterprises consider data sanitization to be a “‘checkmark”’ exercise that must be done to satisfy compliance or operational requirements and that they are not taking data risks seriously.

“The lack of robust data sanitization policies across global enterprises is alarming,” said Fredrik Forslund, Vice President, Enterprise and Cloud Erasure Solutions at Blancco.

“If they fail to formulate and communicate these policies effectively, at every stage of the data lifecycle, they risk putting significant amounts of potentially sensitive data at risk. It is vital they put processes in place, with clear ownership, and auditability for control, assigned to their senior leadership team to mitigate these risks.”

Flexible workers least likely to comply with data sanitization policies

A third of the enterprises surveyed also felt that flexible workers were the least likely to comply with data sanitization policies, while 40 percent believed contractors or freelancers were the least likely to understand or comply with their data sanitization policy.

There is not only a lack of clear ownership around the implementation of data sanitization policies but also a lack of accountability regarding how enterprises are complying with them.

The responsibility is spread across different job roles including the Head of Compliance (30 percent), Head of IT Operations (15 percent), Head of Operations (14 percent), Head of Legal (11 percent) and DPO (9 percent), leaving enterprises open to compliance breakdown and fines.

Key U.S. and Canada findings

Thirty-three percent of respondents in the U.S. and Canada also believe that flexible workers, who work at home or remotely, are the least likely to comply with data sanitization policies – implying that they may pose a security risk.

Thirty-two percent of employees in enterprises in the U.S. and Canada are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. Nineteen percent place this responsibility with their line manager.

More than a third (32 percent) of enterprises in the U.S. and Canada also stated that they are placing their Head of Compliance in charge of complying with their data sanitization policies which is encouraging. However, only nine percent are giving this responsibility to their DPO.

Key U.K. findings

Despite 97 percent of U.K. companies having a data sanitization policy in place, more than a third (37 percent) have yet to communicate it across the business. Overall, nearly half of companies (42 percent) do not have a data sanitization policy in place that’s being effectively and regularly communicated across the organization.

20 percent of employees in U.K. companies are responsible for the management and control of their own end-of-life IT equipment when they leave the organization. 35 percent place this responsibility with their line manager.

Worryingly, 58 percent of U.K. enterprises also reported not being aware of when their organization’s IT security policy was last updated and 56 percent aren’t clear about what it contains, the highest percentage points from all the countries surveyed.
==================================================================
https://www.wavesys.com/products/wave-self-encrypting-drive-management

Excerpt:

Enterprises choose Wave to manage SEDs

Why? From our single console, you can manage all your organization’s self-encrypting drives (SEDs) easily and remotely, whether they number in the hundreds, or hundreds of thousands.

SEDs are the most secure, best-performing and most transparent encryption option for protecting data on laptops. These drives automatically encrypt all data written to the drive, so you don’t have to decide what’s important enough to encrypt. They also perform this encryption in the hardware of the drive, so you don’t end up with the performance issues software full-disk encryption is infamous for. SEDs are available as HDD or SSD, and are sold by most major drive manufacturers.

Wave’s management solution delivers remote drive initialization, user management, drive locking, user recovery and crypto-erase for all Opal-based, proprietary and solid-state SEDs.
==================================================================
Crypto erase remotely could help with the sanitization needs for an organization, and make them easier and more efficient when using Wave SED management when computers reach their end of life!! Knowing that an organization's data at rest is protected, this is another Wave solution that could ease the level of stress for organizations and organizations' CISOs!!