The new version of MAC OS X, 10.10 (Yosemite) is expected to be released today, Thursday October 16th, and is currently incompatible with the ClearPass registration system and potentially other services at Rowan.

University Policies

University Policies

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

ROWAN UNIVERSITY POLICY


Title: Electronic Media Disposal Policy
Subject: Information Security 
Policy No: ISO: 2013:04 
Applies: University-wide 
Issuing Authority: Information Security Office - Director of Information Security
Responsible Officer: Vice President for Information Resources and Chief Information Officer
Date Adopted: 07/01/2013
Last Revision: 07/26/2018
Last Review: 07/26/2018


I.     PURPOSE

The purpose of this policy is to establish a standard for the proper disposal of media containing electronic data. The disposal procedures used will depend upon the type and intended disposition of the media. Electronic media may be scheduled for reuse, repair, replacement, or removal from service for a variety of reasons and disposed of in various ways as described below.

II. ACCOUNTABILITY

Under the direction of the President, the Chief Information Officer and the Director of Information Security shall implement and ensure compliance with this policy. The Vice Presidents, Deans, and other members of management will implement this policy in their respective areas as needed.

III.  APPLICABILITY

This policy applies to all members of the Rowan community who access and use the University's electronic information and information systems. This policy and Rowan's "Code of Conduct" also govern access and use of the University's electronic information and information systems originating from non-Rowan computers, including personal computers and other electronic devices. The access and use of electronic information provided by research and funding partners to Rowan is also governed by this policy.

The use of information systems acquired or created through use of University funds, including grant funds from contracts between the University and external funding sources (public and private), are covered by this policy. This includes University information systems that are leased or licensed for use by members of the Rowan community.

IV. DEFINITIONS

  1. "Electronic Media" – Physical object on which data can be stored, such as hard drives, zip drives, floppy disks, compact discs, CD-ROMs, DVDs, USB drives, memory sticks, MP3 players (iPod), Personal Digital Assistants (PDA's), digital cameras, smart phones and tapes.
  2. "Sensitive Information" – Sensitive information is classified as Protected Health Information (PII), Confidential information, or Internal Information as defined in the Rowan University Information Classification Policy.
  3. "Sanitization" – To expunge data from storage media so that data recovery is impossible. The most common types of sanitization are destruction, degaussing, and overwriting.

V. REFERENCES

Rowan University - Information Classification Policy ISO: 2013:07

VI. POLICY

  1. All electronic media must be properly sanitized before it is transferred from the custody of its current owner. The proper sanitization method depends on the type of media and the intended disposition of the media.
  2. Overwriting Hard Drives for Sanitization
    1. Overwriting is an approved method for sanitization of hard disk storage media. Overwriting of data means replacing previously stored data on a drive or disk with a random pattern of meaningless information. This effectively renders the data unrecoverable, but the process must be correctly understood and carefully implemented.
    2. Overwriting consists of recording data onto magnetic media by writing a pattern of fluxes or pole changes that represent binary ones (1) and zeros (0). These patterns can then be read back and interpreted as individual bits, 8 of which are used to represent a byte or character. If the data is properly overwritten with a pattern (e.g., "11111111" followed by "00000000") the magnetic fluxes will be physically changed and the drives read/write heads will only detect the new pattern and the previous data will be effectively erased. To purge the hard drive requires overwriting with a pattern, and then its complement, and finally with another pattern (e.g., overwrite first with "00110101 ", followed by "11001010", then "10010111"). Sanitization is not complete until the three overwrite passes and a verification pass are completed.
    3. A variety of software packages are available on the open market that properly performs this function. Examples include, but are not limited to, "Killdisk" and Semantec's "Gdisk" (part of the Ghost product).
  3. Destruction of Electronic Media
    1. Destruction of electronic media is the process of physically damaging a medium so that it is not usable by any device that may normally be used to read electronic information on the media such as a computer, tape reader, audio or video player.
  4. Clearing Data
    1. Clearing data such as formatting or deleting information removes information from storage media in a manner that renders it unreadable unless special utility software or techniques are used to recover the cleared data. Because the clearing process does not prevent data from being recovered by technical means, it is not an acceptable method of sanitizing media intended for disposal outside of the University.
  5. Disposal of Hard Drives
    1. Disposal of Hard Drives to Other Departments or outside the University
      1. Prior to disposal, operable hard drives must be overwritten in accordance with the procedures in paragraph A above. The owner must be able to certify that the hard drive was properly sanitized. Written certification should include the make, model, and serial number of the hard drive and the date that the procedure was performed. Equipment designated for surplus or other disposal must have a label affixed stating that the hard drive has been properly sanitized. The label should be a high visibility color that is easily recognizable.
    2.  Transfer of Hard Drives within a Department
      1. Before a hard drive is transferred from the custody of its current owner, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. It is recommended that all electronic media be sanitized per paragraph A above; however, since the media is remaining within the department, the hard drive may instead be formatted prior to transfer. Since, special recovery tools must be used by an individual to access the data erased by this method any attempt by an individual to access unauthorized data would be viewed as a conscious violation of HIPAA regulations and Rowan University Information Security Policy.
    3.  Sending a Hard Drive out for Repair or for Data Recovery
      1. The vendor repairing or recovering data on the hard drive must have signed an appropriate Business Associate Agreement and/or Security Contract Language with the Rowan University, stating that they will take proper care of the data. Once data is recovered or the hard drive is repaired the original hard drive must be returned to the owner so that the owner can dispose of it per this policy for proper disposal of hard drives.
    4. Repairing a Hard Drive Under Warranty
      1. In the special situation where a hard drive under warranty has failed and the manufacturer requires that the failed disk drive be returned, an appropriate Business Associate Agreement and/or Security Contract Language between the manufacturer and Rowan University must be in place before the drive can be shipped to the manufacturer. If the manufacturer will not sign a Business Associate Agreement, then the old drive must be properly destroyed and the owner of the system must cover any costs associated with purchasing a new drive.
    5.  Disposal of Damaged or Inoperable Hard Drives
      1. The owner must first attempt to overwrite the hard drive in accordance with the procedures in paragraph A above. If the hard drive cannot be overwritten, the hard drive must be disassembled and mechanically damaged so that it is not usable by a computer.
  6. Disposal of Electronic Media Other Than Hard Drives
    1. Transfer of Electronic Media Other Than Hard Drives Within a Department
      1. Before electronic media is transferred from the custody of its current owner, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be reformatted if the media type allows it or erased if formatting is not possible.
    2. Disposal of Electronic Media Outside the University
      1. All electronic media other than computer hard drives must be rendered unusable before leaving the University. Use of certified commercial disposal systems such as "Shred-it" is encouraged.

VII.  NON-COMPLIANCE AND SANCTIONS

Violation of this policy may subject the violator to disciplinary actions, up to or including termination of employment or dismissal from a school, and may subject the violator to penalties stipulated in applicable state and federal statutes. 
 
   By Direction of the CIO:



__________________________________
Mira Lalovic-Hand,
VP and Chief Information Officer

  • No labels