Morgan Stanley didn't wipe their hard drives before giving them to a third party
1–10 of 38 posts
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#2>MSSB hired a moving and storage company with no experience or expertise in data destruction services to decommission thousands of hard drives and servers
Guess the smartest people in the room weren't in the IT department ... Wonder if they chose that moving and storage company because they were a cheaper option.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#3The real mistake in this trainwreck was that Morgan Stanley didn't encrypt their hard drives.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#4The real mistake in this trainwreck was that Morgan Stanley didn't encrypt their hard drives.
Many devices that a business might throw away in 2015 may not have been devices that supported full disk encryption out of the box.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#5I used to visit the data centers of some very large financial institutions.
The SoP at those places was that hard drives from the data center NEVER left the building except through a device that destroyed them…. Their security guards were really into checking for them and etc.
It was a pretty common rule across those banks and etc at that time, and that was quite a while ago.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#6The real mistake in this trainwreck was that Morgan Stanley didn't encrypt their hard drives.
Many devices that a business might throw away in 2015 may not have been devices that supported full disk encryption out of the box.
I've been using fde since like 2005 or so and I'm not even a bank. Seems like they don't have much excuse?
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#7I used to visit the data centers of some very large financial institutions. The SoP at those places was that hard drives from the data center NEVER left the building except through a device that destroyed them…. Their security guards were really into checking for them and etc. It was a pretty common rule across those banks and etc at that time, and that was quite a while ago.
Same. When I used to work at a hedge the standard procedure was to zero them out first. Then retain the hard drives in a closet. Then someone could come periodically to physically destroy them.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#8Earlier quoted context omitted.
Many devices that a business might throw away in 2015 may not have been devices that supported full disk encryption out of the box.
I've been using fde since like 2005 or so and I'm not even a bank. Seems like they don't have much excuse?
That's at least two years before even the most forward thinking offices started using FDE on PCs. Bitlocker came out in 07.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#9> "Today’s action sends a clear message to financial institutions that they must take seriously their obligation to safeguard such data.”
$35 million fine for 15 million customer's PII. The 'clear message' is that a customer's PII is worth about $2. Meanwhile the customers are on the hook for fraud monitoring in perpetuity.
Re: Morgan Stanley didn't wipe their hard drives before giving them to a third party
#10I used to visit the data centers of some very large financial institutions. The SoP at those places was that hard drives from the data center NEVER left the building except through a device that destroyed them…. Their security guards were really into checking for them and etc. It was a pretty common rule across those banks and etc at that time, and that was quite a while ago.
Same. When I used to work at a hedge the standard procedure was to zero them out first. Then retain the hard drives in a closet. Then someone could come periodically to physically destroy them.
How was the process governed so that drives actually were wiped before going out the door? That’s really the challenge, the humans managing the kit are the weakest link. I do like the comment about drives only able to depart the premises through a shredder.