Company data left on discarded backup tapes is potentially a bigger problem than data left on discarded hard drives. Many companies discard backup tapes before they start experiencing any problems and there is a vigorous market in used tapes and cartridges.
However, Xperien CEO Wale Arewa warns that if the data on those backup tapes and cartridges can pose a bigger problem. “One needs to consider various options for destroying data on backup tapes including degaussing and tape cartridge destruction.”
The most common method of destroying data on tapes is degaussing, exposing the tape to a powerful magnetic field to scramble the data. If done correctly, degaussing effectively destroys the data on tapes and allows reuse of tapes.
Degaussing has to be done professionally, the tapes have to be exposed to a strong enough magnetic field for the correct amount of time to completely destroy the data. Tapes differ significantly in how strong the magnetic field needs to be.
The degausser has to be matched to the specific kind of tape being destroyed, tapes with higher data densities normally need stronger magnetic fields because the magnetic particles are harder to magnetise and demagnetise.
Many companies are tempted to save time and costs by disposing old backup tapes without ensuring the content is properly erased or that the tape is properly destroyed.
Arewa says the common rule is that tapes containing highly confidential data should not be reused. “Those tapes should be physically destroyed after they have been erased. Many tape degaussers offer an option to physically destroy the tape, as well as erasing it by methods such as punching holes in the cartridge.
“Selling used tapes is risky because if not degaussed correctly, some of your company data could still be readable when the tape is resold. However, if a tape is properly erased, it is unreadable and not a danger,” he explains.
One also needs to keep complete and auditable records of what was destroyed and when. Record keeping and auditing is just as important as destroying the data. If a third party is handling the destruction, the company needs to obtain and keep certificates of destruction on the data.
There are a number of companies like Xperien that offer tape erasing and destruction services. Whether data destruction is done through software erasure, hard drive shredding or degaussing, a certificate of data destruction must be provided to validate the quality of service.
A Certificate of Data Destruction is an assurance that every possible measure was taken to safely and securely eradicate and destroy all data compliant with government and industry regulations.
“We also purchase used tapes, destroy the data on them, including providing certificates of destruction, and resell the media or donate it to a specified charity,” he adds.