Wow. Major Security Breach and Cleaning Up the Mess

[LillFilly]

I must be vague on this one, but it's still a doozy! Where I am posted as security, IT switched out some old computer towers with new ones. The old ones went into a bin by a loading dock alongside bins of recycle, scrap material, etc. By no means were these bins in a defined secure location. Apparently, in the past few days, somebody helped themselves to the hard drives in the old towers. They must have gone out a side door and not through the main gate, because we would have noticed someone leaving with them. The problem is...IT NEVER WIPED THE HARD DRIVES! Yes, sensitive company information had been sitting in a box of scrap for almost a month and security never had a clue - Luckily, this is by no means our fault, as there's no way we would have known to watch this stuff and there was no way to do it as the bins are in a high traffic employee area. Why they did not secure the old computers until they had erased them is beyond me, but I get the feeling that one of the IT guy messed up, badly. We have a vague time frame of when the stuff went missing, and have been checking camera footage trying to catch a glimpse of anything helpful. It doesn't help that our site is under major construction and we have dozens of outside workers walking through ever day too. Wow. I'll be seeing if we've made any discoveries next week.

[BeeMused]

One word summary: OUCH!!!!!
I hope the thief just wanted the drives, or the company will have a huge problem soon! <shudder>

[wolfie]

Unlikely - someone stealing ONE drive might have wanted it as a drive for themselves. Stealing ALL of them shows that it's for resale. If they wanted to sell stuff as hardware, the RAM and CPUs have a higher dollar value per unit time to remove than hard drives (they just pop out, hard drives are screwed in).

With all the hard drives, and nothing else, being taken, it looks like they were stolen for the data on them.

[Ophbalance]

Wiping isn't good enough... as the BOFH has indicated in the past, the only way to be sure is to take a mallet to them . I give up a ton of old computer hardware to a co-worker of mine that recycles/revives old kit. All the old HDDS, however, were given the 5 pound sledge treatment before the went to the local recycle center.

[lordlundar]

Wiping isn't good enough... as the BOFH has indicated in the past, the only way to be sure is to take a mallet to them .

Ah, ever the rookie.

(for the record, a powerful magnet over the platters is the most effective method short of melting them. Unless you're taking the mallet to the platters themselves, the casing will prevent any serious damage. Some drives even have a package of magnetic pellets that spread over the platters when ruptured.)

That said, IT really dropped the ball on this one. The drives should have been sent to a refurbishing company which does proper data wipes and rebuild drives for this very purpose.

[sstabeler]

Ah, ever the rookie.

(for the record, a powerful magnet over the platters is the most effective method short of melting them. Unless you're taking the mallet to the platters themselves, the casing will prevent any serious damage. Some drives even have a package of magnetic pellets that spread over the platters when ruptured.)

That said, IT really dropped the ball on this one. The drives should have been sent to a refurbishing company which does proper data wipes and rebuild drives for this very purpose.

that's why you keep using the mallet until you can confirm the platters are destroyed. (Although you are right that it can be a significantly less effort to open the HDD up and remove the platters. Especially since I'm 99% sure there is some resale value in the controller boards. ( basically, most "dead" HDDs are dead due to the controller board going bad, not the platters themselves. Therefore, if you can replace the controller board, you can revive an otherwise dead HDD and recover the data)

[crazylegs]

that's why you keep using the mallet until you can confirm the platters are destroyed. (Although you are right that it can be a significantly less effort to open the HDD up and remove the platters.

It's very satisfying taking a mallet to the dead drive though - I do it to all my comps until I get to the platter then cut/tear/otherwise destroy them.

[Daskinor]

I bin them inside the server room. Once I get a nice stack I spend an afternoon taking them apart.

However there is a push to use ceramic platter drives. There is a nice hole on the drives where you can ram a screwdriver in and shatter the platters.

[LillFilly]

Update.

I had an idea and checked craigslist; no luck. I then thought what the hey, check ebay. Luckily, IT had one hard drive of that kind left and so could supply specs. I searched for newest listings and listings in our area. What do you know? One seller happens to be selling exactly what we are missing, and in the same quantity. Apparently, it happened that another type of hard drive was taken as well. Oh, another seller is selling that one too. And they're both in-city local. I've suggested the idea that we get someone unknown to 'purchase' some of the drives so we can get the name and address of the sellers, and maybe get a match. Just call me Sherlock

[Jay 2K Winger]

Update.

I had an idea and checked craigslist; no luck. I then thought what the hey, check ebay. Luckily, IT had one hard drive of that kind left and so could supply specs. I searched for newest listings and listings in our area. What do you know? One seller happens to be selling exactly what we are missing, and in the same quantity. Apparently, it happened that another type of hard drive was taken as well. Oh, another seller is selling that one too. And they're both in-city local. I've suggested the idea that we get someone unknown to 'purchase' some of the drives so we can get the name and address of the sellers, and maybe get a match. Just call me Sherlock

I think it's time for.... THE GIF!

[LillFilly]

Updated update:

Ok, well at first my boss was a little iffy about the information I'd found so pointed-out exactly what and how I'd gone about my investigation. He sent the information and listing to the higher-ups, then calls me to his office. Looks like I'm up for a commendation . Turns out the listing belongs to an employee and that they may have been selling company stuff for a long time. In short, my boss told me that I am awesome. Isn't it crazy what following a hunch can do?

[Jay 2K Winger]

Mr. Grinch, what say you about Filly's tactics?



"Exxxcellent..."

[Gizmo]

Well done!

[BeeMused]

Hey Sherlock!!!! That was a well done investigation!

[mhkohne]

Updated update:

Ok, well at first my boss was a little iffy about the information I'd found so pointed-out exactly what and how I'd gone about my investigation. He sent the information and listing to the higher-ups, then calls me to his office. Looks like I'm up for a commendation . Turns out the listing belongs to an employee and that they may have been selling company stuff for a long time. In short, my boss told me that I am awesome. Isn't it crazy what following a hunch can do?

Was he selling stuff that hadn't been thrown away as well? Or was just improperly raiding the trash bins? One kind of presumes that everything going out of that company is somewhat sensitive, so he shouldn't have been doing it, but if he was at least limiting himself to the trash pile, one can't get as upset as if he were raiding the spare parts room!