When you delete a file from your computer, or from a shared folder on one of your company’s servers, that information is not normally erased. As a general rule, it remains intact until the space it occupies is needed for another file.
When you eventually dispose of your computers and hard drives, you are potentially exposing sensitive and confidential information to people who should not access it. To avoid this problem, IT asset disposition (ITAD) companies offer a range of data destruction services aimed at ensuring absolute data security and helping companies meet compliance standards.
ITAD firms should be able to offer wiping services either through software wiping of the drives, degaussing or physical shredding/destruction. Software wiping is the most environmentally friendly and cost effective – allowing for reuse and resale of the drive to save the environment and return some money back to the client. Many organizations, including those with the most stringent security standards, choose to shred their hard drives. This process physically destroys the drives and makes it impossible to retrieve any of the information they contain. There are two main options when it comes to hard drive shredding services: on-site shredding versus off-site. In this article, we’ll delve into the details of each approach to help you understand which option is better for you.
Understanding Hard Drive Shredding
Before we get into the differences between on-site versus off-site shredding, let’s talk a bit about the hard drive shredding process itself.
To completely eliminate the possibility that someone could retrieve data from your hard drives, the media must be broken down into sufficiently small fragments. Imagine, for example, that you want to maintain the privacy of information on a hard drive that you no longer need. You use a hammer to smash the hard drive, breaking the platters inside into small pieces. If any of those pieces are large enough, a highly motivated expert could potentially recover some of the data.
This topic has come up in several high-profile criminal cases, in which perpetrators have smashed and/or scratched their hard drives in advance, hoping to keep evidence out of the hands of law enforcement. In those cases, the FBI has set out to recover data after the fact, with some success.
The hard drive shredding process, in contrast, is thorough and methodical. ITAD services companies use specialized equipment specifically designed to destroy hard drives and other storage media, breaking it into very tiny pieces and making data recovery impossible. By using an ITAD service provider to destroy data on unwanted IT equipment, companies can maintain compliance with even the most stringent data security requirements.
On-Site Hard Drive Shredding
Many companies prefer on-site hard drive shredding because it allows them to observe the data destruction process in their own environment. This requires that an ITAD company bring portable hard-drive shredders to their client’s location and perform their data destruction services in a customer-controlled environment.
Some companies prefer this approach. Here’s why:
- The customer can witness the destruction process first-hand, so they can be completely confident that their sensitive data has been destroyed. Although off-site hard drive shredding also offers many safeguards and assurances, some clients simply cannot allow their IT equipment to go off-site without first destroying the data it contains.
- Data is destroyed immediately in the case of on-site hard drive shredding. Some customers may simply prefer immediate data destruction, or it may be required to comply with specific regulations or contractual obligations.
- On-site hard drive shredding meets the highest possible standards for secure data destruction. In cases where national security could potentially be compromised, for example, on-site shredding would presumably be the best option. Healthcare organizations and financial services companies often prefer on-site shredding as well, because of its uncompromising approach to data security.
Having said that, there are some drawbacks to on-site hard drive shredding. Costs tend to be higher, and it can be more complicated in terms of logistics.
Off-Site Hard Drive Shredding
With off-site hard drive shredding, the ITAD service provider picks up the devices and securely transports them to a dedicated location where the destruction process occurs. The best ITAD companies use sealed vehicles with GPS tracking and drivers who have undergone thorough background checks and data security training. Many also employ video surveillance to record offloading of decommissioned IT equipment at their facility. By tracking and documenting every step of the process, a reputable ITAD provider can offer clear evidence as to the chain of custody and the completion of the data destruction process.
Off-site hard drive shredding is a more cost-effective approach than the on-site option. It still involves professional handling of decommissioned IT assets, with thorough reporting and a clear audit trail. It is also far more convenient than on-site hard drive shredding, because most of the work happens outside of the client’s facilities.
For companies that can accept reasonable evidence as to the chain of custody, and who are working with a trusted ITAD provider, off-site hard drive shredding may be the preferred choice.
Choosing Between On-Site and Off-Site Shredding
The choice between on-site and off-site shredding usually boils down to a few key factors, including the sensitivity of the data, budget, regulatory requirements, and contractual obligations.
Companies with very high security requirements may lean toward on-site hard drive shredding. Those with slightly less stringent standards can achieve the desired goal without spending additional money, while still receiving adequate assurances that sensitive and confidential data has been fully and irretrievably destroyed.
Whichever option you choose, it’s critically important to select a reputable hard drive shredding service that will respond quickly, custom-tailor solutions to address your unique requirements, and deliver outstanding customer service.
Best Practices for Secure Hard Drive Shredding
Regardless of the method you choose, we recommend adhering to the following hard drive destruction best practices:
- Develop and maintain a written policy for IT asset disposition before you get started, taking into account your compliance requirements, contractual obligations, data security standards, and so on. The policy should also address the need to train employees on data security and the proper handling of IT assets.
- Perform regular audits of the data destruction process. Look for an ITAD service provider that offers detailed reports and ample evidence documenting the chain of custody.
- Look for adherence to industry standards. The best ITAD services companies will have certifications from recognized industry groups, including E-Stewards, Ecovadis, and more.
Conclusion
The choice between off-site over on-site hard drive shredding is usually not terribly complicated. Security tolerance, cost, and convenience are typically the deciding factors. On-site hard drive shredding is the gold standard for the highest security scenarios, but it comes with certain costs. Off-site hard drive shredding, in contrast, is well-suited for businesses looking for efficient, secure, and cost-effective solutions.
