Re: Lost and Found

["James C. Farr '05" <jfarr () UTICA EDU>]

Malware is one of our concerns as well.  Do you ever make an attempt to
determine who it belongs to and or what is on the device?

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Richard Hopkins
Sent: Friday, February 05, 2010 10:33 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Lost and Found

--On Tuesday, February 02, 2010 5:05 PM -0500 "James C. Farr '05"
<jfarr () UTICA EDU> wrote:

> Each of our institutions probably has a lost and found box where people
> turn in things like flash drives.
>
> In the past we look for identifying information so we can return the
> device to the happy owner.
>
> That is all well and good, but what if that flash drive had confidential
> data on it?
>
> We have no idea who saw that drive while it was missing.
>
> Does anyone scan lost and found storage devices (either manually or with a
> tool) to search for reportable information like Social security numbers?
>
> If so what processes are you using?

There's also the possible issue of malware on the flash drives. We treat
them as "hazardous waste" and arrange for them to be securely disposed of
(after an appropriate time period).

Cheers,

Richard

http://www.bris.ac.uk/infosec