Another story was reported yesterday in the Vancouver Sun about confidential information being found on tapes the British Columbia government sold. I’m not too surprised considering most organizations do not encrypt personal, or any, information on removable storage media, such as tapes, CDs, USB drives, and so on. I’ve done many outsourced vendor security reviews, and I was initially surprised to see that some of them actually have within their security policies the directive to sell mobile storage media when no longer needed to try and recoup some of the investment made in it. I’ve seen policies go into great detail about how to sell the media, on eBay and in other venues, but completely omit any mention of removing the data first.
Technorati Tags
health privacy
encrypt
personal privacy