What happened?
On 20/9/2022, the US Securities and Exchange Commission (SEC) announced that Morgan Stanley Smith Barney (MSSB) agreed to pay USD 35 million to settle findings that it violated rules on protecting and disposing of customer information (the Safeguards Rule and Disposal Rule under Regulation S-P). MSSB neither admitted nor denied the findings.
According to the SEC, from around 2015 MSSB hired a moving and storage company with no experience in data destruction to decommission thousands of hard drives and servers holding customers' personally identifiable information. MSSB did not adequately supervise this work over many years. The company sold thousands of devices to a third party, some of which were resold on an online auction site with customer data still inside. MSSB recovered some of them, which contained thousands of customers' unencrypted records, but did not recover most of the rest.
The SEC also noted that during a hardware upgrade, a records reconciliation found 42 missing servers that might contain unencrypted data. Devices at branches that were capable of encryption had their encryption software left disabled for years. The incident affected about 15 million customers over roughly five years.
Lessons for enterprises
- The data lifecycle does not end when a device is retired. Decommissioning, repair and replacement of equipment are points where data easily slips away.
- Handing work to a third party does not hand over responsibility. The enterprise must still check capability, supervise and obtain proof of data destruction.
- Encryption only works when it is switched on. A feature that is available but not enabled does not protect data.
A data-centric approach
When files are encrypted and bound to usage-rights policy from the moment they are created, a storage device leaving the organization does not necessarily mean whoever finds it can read the content, because the decryption keys and file-opening rights sit in the management system, not on the device. Enterprises still need an asset-inventory process and evidenced data destruction. See also the product and How DLP, DRM and encryption differ.
Three questions for a self-check
- Who handles your old devices, failed hard drives and decommissioned servers, and do they provide a certificate of data destruction?
- Does the enterprise keep an inventory of storage devices so that lost devices can be detected?
- Is data on workstations and at branches encrypted by default?
