ALM a key element of data security

Issue 8 2022 Infrastructure

The average cost of a data breach is now nearly R50 million; and breach costs have increased by nearly 20% over the last two years. Recent high-profile breaches and ransomware attacks are a stark reminder to C-suite leaders of how vulnerable their businesses are. Even those with undoubtedly robust security defences can be breached.


Takalane Khashane.

Information security has never been more important. With a growing onus on business owners to protect their data, and increasing data privacy legislation around the world imposing significant fines, the financial and reputational costs of a lax approach run deep. But while cybersecurity is top of mind for the C-suite, many organisations still have a big gap in their security posture – how they manage their physical IT assets throughout every stage of their lifecycle. Good asset lifecycle management (ALM) is foundational to effective data security because even the best cybersecurity system can be futile if you do not integrate, maintain, and most importantly, decommission or dispose of your hardware and devices securely.

Best practice for keeping an eye on your assets

Minimising your exposure to risks and liabilities requires visibility and control over all your assets, both virtual and physical. With the boom in remote working adding to the challenge of keeping track of the devices going in and out of your organisation, it is more critical than ever to follow IT asset management best practices.

Ongoing surveillance, maintenance and risk mitigation of all assets is essential. To begin with, you should have an asset register that documents every piece of hardware introduced into your organisation, its purpose and who is responsible for it. The register should also monitor the equipment’s performance, health and protection, making sure that security applications are working and up to date.

All physical assets should be password protected, preferably with a forced password change policy in place, and when the software on a device is no longer supported by the manufacturer, the device should be upgraded. Using a patch management programme that regularly scans for any security flaws across all assets and any updates necessary for maintaining regulatory compliance is key.

Perhaps the most crucial part is the end-of-life stage. There are criminals who salvage old hard drives from landfills or purchase recycled IT equipment, with the intention of recovering data from them for their own illicit gains. For this reason, it is vital to implement an asset disposition process that tracks the chain of custody and ensures that data is effectively wiped from disused assets – this should be the very first step in the retirement of any asset, yet it is not as straightforward as many people think.

What secure ITAD looks like

IT Asset Disposition (ITAD) should follow a well-defined protocol of a trusted chain of custody, comprehensive data erasure and dismantling into components for repurposing or recycling, or otherwise complete physical destruction. Though it is a common misconception that erasing data is as simple as deleting files or reformatting a drive, in truth, such methods do not guarantee the full deletion of data at all. Specialised data scrubbing software must be used and when destruction is required, the asset must be physically destroyed to the point that it is impossible to recover any data from it.

Third-party contractors can be employed for the disposal process. However, you need to ensure that they demonstrate the use of data wiping software certified to NIST 800-88 standard, can provide auditing reports that verify complete data erasure and provide proof of adequate physical destruction or dismantling of the asset. Non-compliant data erasure methods will leave the asset vulnerable to data recovery that is easily achieved with special software.

Furthermore, third-party handlers should offer a secure and fully visible chain of custody from the moment they take possession of the asset, through to when the destruction of the item is complete. Ideally, this will involve real-time asset tracking in which the asset is scanned and logged onto a system at every stage of its journey until disposal is recorded. Once the asset is destroyed, you should expect to receive a Certificate of Erasure and a Certificate of Destruction for each asset. Following this process reduces the risk of equipment going missing and provides peace of mind that the asset has been disposed of properly, in line with the stringent standards that govern the quality and ethics of recycling such as eSteward and R2.

Cybersecurity is the chief concern in many boardrooms today, but vigilant management of physical assets must never be overlooked. The most advanced cybersecurity system in the world will not be enough to protect your data if a piece of hardware containing sensitive information finds its way into the wrong hands.

ALM is core to any data security framework in the digital age and it is an element that no business can afford to be careless with. Indeed, failing to act can have very real consequences. It can leave an organisation vulnerable to enormous losses, not only from bad actors looking to exploit sensitive information, but also from the heavy fines levied by data protection legislators and the reputational damage caused by failing to prevent an avoidable breach.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

A passport to offline backups
SMART Security Solutions Technews Publishing Editor's Choice Infrastructure Smart Home Automation
SMART Security Solutions tested a 6 TB WD My Passport and found it is much more than simply another portable hard drive when considering the free security software the company includes with the device.

Read more...
Five tech trends shaping business in 2025
Information Security Infrastructure
From runaway IT costs to the urgent need for comprehensive AI strategies that drive sustainable business impact, executives must be prepared to navigate a complex and evolving technology environment to extract maximum value from their investments.

Read more...
Threats, opportunities and the need for post-quantum cryptography
AI & Data Analytics Infrastructure
The opportunities offered by quantum computing are equalled by the threats this advanced computer science introduces. The evolution of quantum computing jeopardises the security of any data available in the digital space.

Read more...
Navigating today’s cloud security challenges
Information Security Infrastructure
While the cloud certainly enables enterprises to quickly adapt to today’s evolving demands, it also introduces unique challenges that security teams must recognise and manage. Vincent Hwang offers insights from the 2025 State of Cloud Security Report.

Read more...
The rise of autonomous data recovery
Information Security Infrastructure
Escalating cyberthreats and attacks constantly put businesses under pressure, increasingly prompting organisations to shift their mindsets towards ensuring continuous operations and thus avoiding downtime and revenue loss.

Read more...
Can we really fight AI cybersecurity threats with more AI?
Information Security Infrastructure
In a world where artificial intelligence (AI) is increasingly being weaponised by cybercriminals, the question of whether we can effectively combat AI threats with more AI is not just a technical inquiry but a pressing global concern

Read more...
Partnership delivers 40% storage savings for surveillance
Surveillance Infrastructure
Large-scale video surveillance users and applications demanding extended storage periods will benefit from up to 40% savings on video storage hardware stacks thanks to a new partnership between IDIS and Secure Logiq.

Read more...
How smart video is transforming storage at the edge
Infrastructure Surveillance
As these technologies come together, they are impacting the architecture of the edge and what we require from data storage. More specifically, they are driving a demand for specialised storage.

Read more...
VPS hosting set to dominate in 2025
Infrastructure
SME market growth and the increasing need for a digital footprint are pushing VPS growth in South Africa, especially since it is now perceived as a viable business tool, scalable by nature, with improved performance.

Read more...
Threats, opportunities and the need for post-quantum cryptography
AI & Data Analytics Infrastructure
The opportunities offered by quantum computing are equalled by the threats this advanced computer science introduces. The evolution of quantum computing jeopardises the security of any data available in the digital space.

Read more...