ALM a key element of data security

Issue 8 2022 IT infrastructure

The average cost of a data breach is now nearly R50 million; and breach costs have increased by nearly 20% over the last two years. Recent high-profile breaches and ransomware attacks are a stark reminder to C-suite leaders of how vulnerable their businesses are. Even those with undoubtedly robust security defences can be breached.

Takalane Khashane.

Information security has never been more important. With a growing onus on business owners to protect their data, and increasing data privacy legislation around the world imposing significant fines, the financial and reputational costs of a lax approach run deep. But while cybersecurity is top of mind for the C-suite, many organisations still have a big gap in their security posture – how they manage their physical IT assets throughout every stage of their lifecycle. Good asset lifecycle management (ALM) is foundational to effective data security because even the best cybersecurity system can be futile if you do not integrate, maintain, and most importantly, decommission or dispose of your hardware and devices securely.

Best practice for keeping an eye on your assets

Minimising your exposure to risks and liabilities requires visibility and control over all your assets, both virtual and physical. With the boom in remote working adding to the challenge of keeping track of the devices going in and out of your organisation, it is more critical than ever to follow IT asset management best practices.

Ongoing surveillance, maintenance and risk mitigation of all assets is essential. To begin with, you should have an asset register that documents every piece of hardware introduced into your organisation, its purpose and who is responsible for it. The register should also monitor the equipment’s performance, health and protection, making sure that security applications are working and up to date.

All physical assets should be password protected, preferably with a forced password change policy in place, and when the software on a device is no longer supported by the manufacturer, the device should be upgraded. Using a patch management programme that regularly scans for any security flaws across all assets and any updates necessary for maintaining regulatory compliance is key.

Perhaps the most crucial part is the end-of-life stage. There are criminals who salvage old hard drives from landfills or purchase recycled IT equipment, with the intention of recovering data from them for their own illicit gains. For this reason, it is vital to implement an asset disposition process that tracks the chain of custody and ensures that data is effectively wiped from disused assets – this should be the very first step in the retirement of any asset, yet it is not as straightforward as many people think.

What secure ITAD looks like

IT Asset Disposition (ITAD) should follow a well-defined protocol of a trusted chain of custody, comprehensive data erasure and dismantling into components for repurposing or recycling, or otherwise complete physical destruction. Though it is a common misconception that erasing data is as simple as deleting files or reformatting a drive, in truth, such methods do not guarantee the full deletion of data at all. Specialised data scrubbing software must be used and when destruction is required, the asset must be physically destroyed to the point that it is impossible to recover any data from it.

Third-party contractors can be employed for the disposal process. However, you need to ensure that they demonstrate the use of data wiping software certified to NIST 800-88 standard, can provide auditing reports that verify complete data erasure and provide proof of adequate physical destruction or dismantling of the asset. Non-compliant data erasure methods will leave the asset vulnerable to data recovery that is easily achieved with special software.

Furthermore, third-party handlers should offer a secure and fully visible chain of custody from the moment they take possession of the asset, through to when the destruction of the item is complete. Ideally, this will involve real-time asset tracking in which the asset is scanned and logged onto a system at every stage of its journey until disposal is recorded. Once the asset is destroyed, you should expect to receive a Certificate of Erasure and a Certificate of Destruction for each asset. Following this process reduces the risk of equipment going missing and provides peace of mind that the asset has been disposed of properly, in line with the stringent standards that govern the quality and ethics of recycling such as eSteward and R2.

Cybersecurity is the chief concern in many boardrooms today, but vigilant management of physical assets must never be overlooked. The most advanced cybersecurity system in the world will not be enough to protect your data if a piece of hardware containing sensitive information finds its way into the wrong hands.

ALM is core to any data security framework in the digital age and it is an element that no business can afford to be careless with. Indeed, failing to act can have very real consequences. It can leave an organisation vulnerable to enormous losses, not only from bad actors looking to exploit sensitive information, but also from the heavy fines levied by data protection legislators and the reputational damage caused by failing to prevent an avoidable breach.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Five IT trends to watch in 2023
IT infrastructure
The efforts made by South African companies in 2021 and 2022 have positioned them well for the next wave of growth and innovation — or for continued economic disruption.

Boost enterprise data resilience
Arcserve Southern Africa IT infrastructure
Arcserve Unified Data Protection 9.0 offers unified, multi-tenant cloud-based management, enhanced data availability, durability, and scalability with Cloud Object Storage, and expanded support for Oracle DB and Microsoft SQL Server.

SAN market set for growth
Technews Publishing News IT infrastructure
Storage-area network (SAN) market to hit US$ 26,86 billion in revenue by the end of 2029 due to factors like widespread adoption of Hybrid SAN-NAS solutions.

Advanced server performance and energy efficient design
Editor's Choice IT infrastructure Products
Dell PowerEdge server portfolio expansion offers more performance, including up to 2.9x greater AI inferencing while Dell Smart Flow design and Dell Power Manager software advancements deliver greater energy efficiency.

CA Southern Africa unmasks container security
Technews Publishing IT infrastructure Cyber Security
Adoption of software containers has risen dramatically as more organisations realise the benefits of this virtualised technology.

Best practices for cybersecurity and network health in 2023
Axis Communications SA IT infrastructure
Securing a network from outside threats while making it easily accessible to employees can be challenging. What are the tell-tale signs of poor network security, and what should organisations do to secure their networks?

Fast, reliable and secure cloud services
Technews Publishing Editor's Choice Cyber Security IT infrastructure
Security and speed are critical components of today’s cloud-based services infrastructure. Cloudflare offers a range of services supporting these goals beyond what most people think it does.

Integrate, integrate, integrate
IT infrastructure
Security and speed will always war for dominance in DevOps but it’s time to integrate the two as the landscape becomes increasingly fractious and complex.

The benefits of Managed File Transfer
IT infrastructure Products
Blue Turtle Technologies looks into how a Managed File Transfer platform benefits businesses, as opposed to the usual FTP or SFTP suspects.

Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.