Uptime Institute’s Tier Classification: Everything You Need to Know

July 25, 2023 at 7:01 pm by Amanda Canale

Just as Security Engineered Machinery has been the global standard when it comes to high security data destruction solutions, the Uptime Institute’s Tier Classification has served as the international standard for data center performances. The classification evaluates data centers’ server hosting availability and reliability, and for the past 25 years, the Uptime Institute has had over 2,800 certifications in over 114 countries across the globe.

With the Uptime Institute’s Tier Classification, comes four tiers that are centered on data center infrastructure and define the criteria needed for maintenance, power, cooling, and fault capabilities: Tiers I, II, III, and IV.

Before we dive into the Uptime Institute’s Tier Classification, I want to run through some data center vocabulary:

Uptime

Uptime is the annual amount of time that a data center is guaranteed to be available and running. This time increases in degrees of “nines,” or a 99% availability guarantee. A data center with 99.671% uptime offers far less availability and reliability than one that has 99.982% uptime. 

Essentially, a data center wants to achieve as many “nines” as possible. A 99.9% availability (or “three nines”) will still allow for approximately eight hours of downtime per year. If a data center has 99.999% (“five nines”) then they have less than six minutes of downtime per year, or approximately twenty-six seconds per month.

Downtime

Downtime is the annual amount of time that a data center and its availability will be interrupted. Downtime can occur for a number of reasons: routine maintenance, hardware failures, natural disasters, cyberattacks, and the most common, human error. 

Whenever a data center experiences downtime, there’s a cost: according to the ITIC’s 11th Annual Hourly Cost of Downtime Survey, an hour of downtime can cost some firms and corporations anywhere from $1 to $5 million, not including any potential legal fees, fines, and penalties. The more downtime a data center has, the higher the risk they run of data breaches due to the lack of or little protection and security monitoring they have during this time. It’s also important to mention that downtime not only affects the data center employees: downtime prevents outside customers and clients form accessing services and information, too. So even if a data center experiences downtime that does not result in a data breach, it can have very real monetary and reputational consequences.

Redundancy

Redundancy is a data center component designed to duplicate primary resources and power in the case of failure. These fail-safe systems can be in the form of backup generators, uninterruptible power systems (UPS), and cooling systems, to ensure that data centers can continue to run if another component fails.

Now, let’s dive into each tier!

Tier I

Tier I is a data center at its most basic level of availability. This first tier offers no guarantee of redundancy and at a minimum, offers data centers an UPS for power spikes, lags, and outages. Most small businesses and warehouses that lack around-the-clock operations with minimal power operate at a Tier I level. Tier I facilities operate on a single distribution path for power and cooling, which can easily be overloaded or fall susceptible to planned and unplanned disruptions. In return, Tier I offers 99.671% redundancy, meaning that there is a maximum of 28.8 hours of downtime per year, allowing a lot of vulnerable room for any kind of disruption and subsequent breach. 

Tier II

Tier II facilities offer a bit more uptime, with a 99.741% rating, equaling no more than 22 hours of downtime per year. Like Tier I facilities, Tier II’s operate on a single distribution path for power and cooling but offer other options for maintenance and disruption mitigation. Some of these features include engine generators, cooling units, pumps, and heat rejection equipment. While not by much, this little bump in availability can guarantee data center’s reliability, but it still does not fully protect them from unexpected shutdowns.

Tier III

Unlike Tier I and II facilities, Tier III’s are generally utilized by larger businesses and offer more than one redundant distribution path, meaning that the infrastructure has the capacity and availability to fully support the IT load and offer backup to ensure performance and reliability. This spike in reliability allows for 99.982% of uptime, resulting in less than or equal to 1.6 hours of downtime per year.

While this tier is significantly more reliable, it is not completely fault tolerant. Tier III allows for routine maintenance without impacting service, but are still vulnerable to outages, spikes, and power lags. 

Tier IV

Tier IV is the most sophisticated tier and is typically used by enterprise corporations. This tier offers twice the operational capacity (or 2N) as well as additional backup components (or +1), for ultimate reliability. In this tier, every critical component of the data center’s primary infrastructure is duplicated and fired at max capacity, meaning that even in a disruption, operations are able to continue. 

Tier IV facilities offer a 99.995% uptime per year, or less than or equal to 26.3 minutes of downtime. While this level of classification can be the most expensive to implement, it is the one generally populated by government organizations and larger enterprise corporations.

data-protection-officer

Conclusion

The Uptime Institute’s Tier Classification demonstrates that in any data center setting and scale, it is absolutely vital to have redundancies in place in order to have the lowest amount of down time possible. Data centers should strive to reach the highest tier in order to maintain their high levels of performance, availability, and reliability.

In equal vitality, ultimate data center security also requires a detailed and clear data decommissioning program as part of their operations plan to ensure other safety, security, and operational safeguards are in place. The best way to achieve that level of security is with an in-house destruction plan for HDDs, SSDs, and other data center media types. When implemented improperly, data centers can fall subject to breaches and experience extreme financial loss and irredeemable public trust. At SEM, we offer NIST 800-88 compliant degaussers, crushers, and shredders that are versatile enough to fit in any environment and scale along with auditing and documentation systems. 

Since our inception in 1967, SEM has served as the industry leader in high security, comprehensive end-of-life data destruction solutions that ensure the protection of sensitive, classified, and top secret information within the government, intelligence community, and commercial markets. Our solutions are specifically designed and manufactured to comply with the most frequently cited and stringent of regulatory requirements and compliance mandates, including the National Security Agency’s (NSA) Evaluated Product List (EPL) — which is used to determine if a data destruction device is approved to destroy the US Government’s top secret and classified materials. 

Over the years, many data centers have pivoted to having the most secure data-decommissioning policy, in-house destruction. By using devices like the SEM 0300 shredder line, EMP1000-HS degausser, 2SSD, and iWitness documentation tool – data centers data is more secure than ever when the drives reach end of life.  

The fact of the matter is: the further we get into the Digital Age, the more criticality there is in protecting our most sensitive of data. Corporations, businesses, and enterprises all require a data center that can deliver reliability comparable to their uptime requirements and an in-house data destruction plan.

How NOT to Destroy Employee Personally Identifiable Information

April 25, 2023 at 8:00 am by Amanda Canale

Employee personally identifiable information (PII) is filled with critically private and personal information, such as financial information, healthcare information if provided by the employer, pay stubs, addresses and phone numbers, and more, so it should always be destroyed with the utmost care. 

Before we get to how not to destroy these types of files, it’s important we discuss how long you should keep them for. When it comes to personnel records, retention periods can vary. For instance, the Department of Labor Correspondence and the Internal Revenue Service (IRS) require any financial statements, documents from the IRS and Department of Labor Correspondence themselves, and plan and trust agreements to be kept three to four years, or even longer depending on the case.

However, when it comes to normal employee files, applications, contracts, and other employee personal information, they should be kept for two to three years from the date of termination. What about their compensation documentation? Keep these on file for three to five years from the termination. (This is important to remember!)

Now, let’s get to the fun part – the destruction!

Ripping Up

While ripping paper into confetti-sized pieces can be a great way to relieve some stress, we don’t necessarily recommend this tactic when getting rid of your most recent fire’s employee file. Even if you weren’t too crazy about your coworker, if not destroyed with high security end-of-life destruction equipment, their information could easily fall into the wrong hands, and your coworker could be the next to fall victim to identity theft – which nobody deserves. Don’t believe us? Take for instance the DARPA Shredder Challenge, where people quite literally competed to reassemble 10,000 shred particles for a large grand monetary prize. While the average person would much rather do anything else than spend 600 hours putting shred pieces back together, the same cannot be said for hackers and thieves; if it’s going to grant them access to your most sensitive information, then chances are they will rise to the occasion!

Shredded paper with text.

Recycling and/or Throwing Away

While we support the green initiative in wanting to recycle end-of-life PII documents, unfortunately this isn’t possible. Again, if it’s not a good idea to rip up your employee’s files, it’s not safe to simply throw it out or recycle. Sadly, the majority of our waste and recycling ends up in landfills and dumpsters which are typically gold mines for hackers and thieves. In addition, recycling and waste are not always transported securely, which makes it easy for people to intercept and have access to your most private and identifiable information.

It is always best to err on the side of caution when it comes to end-of-life data destruction. When it comes to specifically destroying employee files, it is best practice to use a secure, in-house method, like our Model 244/4 high security paper shredder. 

The Model 244/4 is our most popular high security paper shredder. Why? This solution is NSA evaluated and listed by the NSA/CSS EPL and meets DIN 66399 Level P-7 standards. Our 244/4 provides a rugged performance with an NSA one hour durability of 17 reams per hour while encased in a quiet system, making it the perfect choice for small or mid-size department use. 

Want even more security? Our Model 344 offers an even more secure shred size than the current mandate for the National Security Agency (NSA) requires. We like to call the 344’s final particle size as P-7+. This device is the only high security paper shredder on the market that offers a particle size of 0.8mm x 2.5mm (that is 50% smaller than the current National Security Agency requirement!) 

By adopting a shredding policy, you are making the most cost-effective, safe, and secure decision to take preventative measures to ensure that your past and current end-of-life employee information does not fall into the wrong hands.

Centralized vs. Decentralized Destruction: What’s the Difference?

April 17, 2023 at 2:36 pm by Amanda Canale

As with most new technology, ideas, and solutions, there are pros and cons. In this month’s blog, we’re breaking down the main similarities and differences between centralized and decentralized destruction environments.

Centralized Environment

A centralized environment is, essentially, one space where all of the magic happens. Whether it is a centralized record center or destruction environment, everything that happens and everything being stored are in one location. 

For example, let’s refer back to our Level 6 Data Centers: Best Practices in Security blog. The sixth level of the Google data center is known as a centralized destruction environment because all the destruction occurs in one, central space. At this level, security is at an all-time high, with very few personnel having access. 

 

 

Another example of a centralized environment, but in this case a record center, is a single space where all records are kept. It could be a doctor’s office where all patient files are kept or a cloud-based system where all files and documentation are stored. Since centralized environments hold a substantial amount of information, they are typically organized by separate teams or personnel with a very high level of clearance.

CENTRALIZED ENVIRONMENT PROS:

One main pro when it comes to a centralized environment, in this case destruction, is that all of your destruction occurs in one place. There isn’t a concern for whether a drive was left on someone’s desk or an end-of-life document was misfiled since there is a system in place that requires all end-of-life drives and documentation to be in one place at the same time. This allows for a highly organized destruction plan and seamless organization system.

With a centralized environment typically comes extra security (remember, all your eggs are in one basket!), which just adds an additional level of protection. This can be in the form of more security cameras, keypads and ID badges, physical security guards, and more. Not only do centralized environments come more protected, they also allow for more opportunities for control.

CENTRALIZED ENVIRONMENT CONS:

By putting one’s eggs all in one basket, while it offers a sense of control and safety, it can also have its drawbacks. Hypothetically speaking, if someone was able to breach that centralized location, they have the world at their fingertips since everything is in one place. Servers can be hacked into, destruction solutions can be tampered with, and precious information can easily be stolen. However, this is also why extra security measures are taken, whether the environment is centralized or not.

Decentralized Environment

On the contrary, a decentralized environment is where all of the records or destruction occurs across multiple rooms, spaces, or even floors. A decentralized environment could be the same doctor’s office mentioned earlier, but where patient personal health information (PHI) is kept spread out among various storage locations, workstations, multiple servers, etc. 

DECENTRALIZED ENVIRONMENT PROS:

Decentralized environments allow for data to be stored in more than one place offering more accessibility, and allowing those who need to access the data to be closer to it. By having their data in multiple and closer locations, there’s no need for long walks across the data center or building, or extra physical layers of security.

Depending on how sensitive the information is, a decentralized record center can sometimes offer more protection since there are multiple points of access and entry, which mean more opportunities for a hacker to fail.

DECENTRALIZED ENVIRONMENT CONS:

With multiple points of entry and access, also come…more money. Decentralized networks, destruction, or record environments require more upkeep, more maintenance, more storage, and more security. 

 

The consequences of improper data destruction are endless. By opting for in-house, centralized destruction, companies have complete oversight and can be certain that your information has been securely destroyed.  At SEM, we offer an array of various high-quality NSA listed/CUI and unclassified data destruction solutions, and are experts in designing and creating, implementing, installing, and servicing centralized destruction facilities across the globe. Whether it’s for the federal government, one of their agencies, or a commercial data center, we do it all. Learn more about our scalable and customizable solutions here. 

Paper Shred Sizes (and What They Mean)

March 30, 2023 at 2:14 pm by Amanda Canale

When destroying any end-of-life data, whether it be paper, hard drives, solid state drives, or other forms of media, there are very strict guidelines and laws that address how classified, top secret, and controlled unclassified information (CUI) should be disposed and securely destroyed. These requirements are determined by the National Security Agency (NSA) and the National Institute of Standards and Technology (NIST). 

For further context, the NSA mandates specific final particle sizes for top secret and/or classified data, regardless of the media form. They then evaluate and list end-of-life data destruction solutions that follow these mandates for destruction. (For a list of media destructions solutions evaluated and listed by the NSA, click here, and for more information what each data classification type really means, click here.)

While the federal government and government organizations are strict when it comes to how one should destroy end-of-life information, commercial companies and industries like healthcare, finance, banking, and more, are less stringent with their destruction instructions, with some left open to interpretation. 

Enter the DIN Standards. Also known as Deutsches Institut für Normung, DIN originated at the German Institute for Standardization in 1917 as a non-government organization that serves as the national standard when it comes to improving the rationalization, safety, environmental protection, and quality assurance between the government and the public. DIN is not often mandated but their guidelines serve as a widely accepted global standard while providing clarity to otherwise vague end-of-life information destruction mandates. 

DIN 66399 standards specifically provide end-of-life destruction particle size guidelines for information that resides on a wide range of media – including paper – and that specifies protection categories. (You can find more in-depth information about DIN standards here.) 

Even as we get further and further into the Digital Age, there is still such a high demand for paper. Some may say that paper is dead, but we know that paper will never really be dead. While the industries I listed above are not holding government secrets, they still store a lot of their sensitive and unclassified information on paper; information that needs to be securely destroyed or could result in severe consequences if it lands in the wrong hands.

Now that you have all of this background information, let’s get into why you’re here – what constitutes as a secure paper shred size? 

Seven Specific Security Levels 

P = Paper media requirements

Protection Category

Media Paper

Security Level

Security Level Particle Size Requirement

Class 1

P

1

12mm strips or maximum particle surface area of 2,000mm²

Class 1

P

2

6mm strips or maximum particle surface area of 800mm²

Class 1

P

3

2mm strips or maximum particle surface area of 320mm²

Class 2

P

4

Maximum cross-cut particle surface area of 160mm² with a maximum strip width of 6mm = 6 x 25mm

Class 2

P

5

Maximum cross-cut particle surface area of 30mm² with a maximum strip width of 2mm = 2 x 15mm

Class 3

P

6

Maximum cross-cut particle surface area of 10mm² with a maximum strip width of 1mm = 1 x 10mm

Class 3

P

7

Maximum cross-cut particle surface area of 5mm² with a maximum strip width of 1mm = 1 x 5mm

Here’s what each of these security levels look like:

DIN Level P-2 Paper Shred with penny for size comparison
DIN Level P-2 Paper Shred
DIN Level P-3 Paper Shred with penny for size comparison
DIN Level P-3 Paper Shred
DIN Level P-4 Paper Shred with penny for size comparison
DIN Level P-4 Paper Shred
DIN Level P-5 Paper Shred with penny for size comparison
DIN Level P-5 Paper Shred
DIN Level P-6 Paper Shred with penny for size comparison
DIN Level P-6 Paper Shred
DIN Level P-7 Paper Shred with penny for size comparison
DIN Level P-7 Paper Shred
DIN Level P-7+ Paper Shred with penny for size comparison
DIN Level P-7+ Paper Shred, a 50% smaller particle size than NSA mandate for paper, produced by SEM Model 344.

As you can tell based on the table and photos above, P7 is the smallest, most secure particle size (aside from the 0.8mm x 2.5mm particle from our Model 344, which is half the size mandated by the NSA for classified paper). Essentially, the smaller the particle, the harder it is to put back together. 

Why would you want to put a bunch of paper shreds back together? To get top secret information, of course! 

Allow us to introduce the DARPA Shredder Challenge. The challenge was created by a research and development agency of the U.S. Department of Defense back in 2011. The DoD invited top computer scientists and puzzle enthusiasts to essentially reconstruct paper shreds for a grand prize. 

The challenge ended when the winning team, who went by the name, “All Your Shreds Belong to US”, created an algorithm that automatically reconstructed the 10,000 pieces of paper based on various physical aspects of the shred, such as shred angle, shred size, and paper marks. Other teams used strategies ranging from crowdsourced-style methods to relying heavily on manual reconstruction. 

When it comes to end-of-life data destruction, it is always best to err on the side of caution. By opting for in-house data destruction methods, you and your company or agency are making the most cost-effective, safe, and secure decision. At SEM we have an array of high-quality NSA listed/CUI and unclassified paper shredders to meet any regulation and mandate, ensuring all of your end-of-life paper stays end-of-life. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.

Data Privacy Day

January 30, 2023 at 5:10 pm by Amanda Canale

Every year on 28 January, the National Cybersecurity Alliance (NCA) dedicates the entire week and 28 January specifically to bring awareness to the public on data protection and data security best practices. Even though we are diving deeper and deeper into the Digital Age, there’s still a large population of people who are not tech savvy, or frankly, even tech literate. The annual international campaign is called Data Privacy Day (DPD), and heavily focuses on educating people, both individuals and businesses, on how to comply with privacy laws and regulations. Moving forward, this will help the public know how they can better protect and manage their personally identifiable information (PII).

Millions of people across the globe are unaware of the various ways their PII is being used, collected, and shared, with many not knowing it’s also being sold by third parties. It’s this reality specifically why the NCA targets anyone with any sort of online presence. How did Data Privacy Day get its start? This internationally recognized day was initially established in 2008 in North America as an extension of Data Protection Day in Europe, which has been in effect since 1981. It is the first legally binding international treaty to recognize data privacy concerns. 

Last year, the NCA expanded Data Privacy Day into a week-long initiative called Data Privacy Week. The week-long campaign, lasting from 24-28 January, is filled with various steps, goals, and webinars individuals and organizations alike can make and attend as a way of encouraging transparency about how their PII is being used. 

You can find a full list of Data Privacy Week events here on the NCA’s website. Below, we break down the major takeaways both individuals and organizations should take from the week-long event.

Data: The Story of You

While you may not think your information is important or valuable, there are plenty of people out there who would do almost anything to obtain it. When it comes to keeping our PII and personal health information (PHI) safe, it is crucial to think of your personal data as the most valuable thing you own. If you were hiding some flashy, expensive, and highly coveted family heirloom, you would do anything to protect it, right? Think of your personal information as that heirloom; it is the most precious thing you have. Critical information such as your IP address, purchase history, and location can offer hackers a wealth of knowledge as to your income, spending habits, card information, and where you live. 

Know what to expect in the privacy/convenience tradeoff

Think about the last time you downloaded an app. What kind of information did you have to grant the app access to in order to use it? Share your geographic location? Grant access to your contacts and photo albums? For example, why does a puzzle app need access to my contacts and location in order for me to play? By allowing access to these very personal and private forms of information, you may be offering up much more than necessary.

When releasing or posting any private or personal information, it is best to make informed decisions on what you should do: weigh whether or not the information they are asking for is really necessary, how the benefits weigh against the tradeoff, and, honestly, if you really need the app at all. 

Adjust your privacy settings

If you decide to deem that puzzle app worthy of your phone storage and time, try to take an extra moment or two to review the app’s privacy and security settings, and adjust them to your comfort level as necessary. (I know, who even reads an app’s Terms and Agreements anymore, right? Wrong! You should!) While you’re at it, delete those apps you no longer use. In addition to taking up useless storage on your phone, they could also still be collecting data about you and your habits. 

You can get a head start with NCA’s Manage Your Privacy Settings page to get more information.

Protect your data

While data privacy and data security are not interchangeable, they are in fact a packaged deal. By adopting these practices, such as creating long and intricate passwords, utilizing multi-factor authentication when possible, and using a password manager you can continue to keep your passwords and information secure and up to date. 

Organization Level: Respect Privacy

As an organization, your consumers’ and customers’ private data should be your utmost concern. By respecting their data and being transparent, an organization instills trust which will in turn enhance reputations and company growth. 

Conduct an assessment

In a “post-COVID” world, more than 15% of total U.S. job opportunities are now remote. Regardless of if your organization operates fully remote, in a hybrid model, or is even located outside of the continental United States, it is important to understand the privacy laws and regulations in which your business operates and to ensure they are being followed. Especially when working with remote or hybrid employees, it’s best to reevaluate your security measures, access to individuals’ personal information, what that personal information may be and if it is still relevant to keep on file, and to maintain oversight of any outside partners and vendors as well to ensure they are not misusing your consumers’ information. 

Adopt a privacy framework

By adopting a privacy framework that works best for you and your consumers, an organization can help mitigate potential risk and implement a privacy culture within your organization. The NCA recommends reviewing the following frameworks to start: NIST Privacy FrameworkAICPA Privacy Management Framework, and ISO/IEC 27701 – International Standard for Privacy Information Management.

Educate employees

By creating an office culture surrounded by data privacy and data security, you are educating your employees on not only how to keep their personal information safe but how to better serve your consumers and their information. Engage staff by asking them how they view your current privacy culture, implement mandatory training and webinars, and consistently assess your current standards. 

In addition to these methods, transparency about how your collect, use, and share consumer information is crucial. Be up front and honest with your clients, users, or consumers about what they can expect their information to be used for and offer them other settings to protect their information by default.

And lastly, when your information-bearing media reaches end-of-life — whether hard drives, portable IT storage, or even paper — securely destroy it to prevent leaks and data breaches down the road.

Cybersecurity Awareness Month

September 29, 2022 at 7:27 pm by Amanda Canale

In 2004, the U.S. President and Congress declared Cybersecurity Awareness Month to be held every October. This would heavily encourage, educate, and assist citizens in staying safe online and teach them how to protect their information. Every year, the NCSA creates an engaging and informative campaign in order to raise awareness about cybersecurity and this year’s theme is “See Yourself in Cyber.”

Enable Multi-Factor Authentication

While data privacy and data security are not interchangeable, they are in fact a packaged deal. Implement and enforce best practices such as creating long and intricate passwords and utilizing multi-factor authentication when possible. What is multi-factor authentication? It’s just adding one more small step of the login process. 

First step: log in as usual. 

Second step: complete a second task to confirm your identity. (Think of it as bringing your license and a recent utility bill to confirm your identity at the bank.)  

The second step in the multi-factor authentication process is usually providing a special PIN code that was texted or emailed to you, or opening an authentication app. This is just an extra layer of security you can use when accessing sensitive information.

 

Use Strong Passwords

Verizon Data Breach Investigations found in a 2020 study that approximately 81% of all data breaches are caused by hackers easily accessing their sought after accounts. How are they able to easily access them, you ask? Two words: weak passwords. 

When companies, managers, and individuals fail to adhere to password guidelines, do not offer password training to your team and fail to educate themselves, and forgo multi-factor authentication procedures, businesses continue to put their cybersecurity at risk.

If you’re now second guessing your own passwords, good. If you’re not, we’re judging you a bit. (Don’t worry, we won’t leave you stranded.) Weak passwords are any sort of phrase or term that is common, short, and/or predictable such as the owner’s name, birthday, or the literal word, “password.” Instead, experiment with a longer password made up of a mix of upper and lowercase letters, numbers, and symbols to help keep your password and data safe. Essentially, the more complex the password, the harder it is for cybercriminals to hack your information.

 

Recognize and Report Phishing

We’re all humans and we all make mistakes. It’s inevitable! Unfortunately, mistakes have consequences. According to a 2019 study, more than 80% of reported data security incidents were caused by phishing attacks. When you interact with a suspicious email link, an attachment, and even senders, your risk of falling victim of a phishing scam rises every time. In today’s modern digital age, hackers have become upped the creativity when it comes to these sneaky scams. If an email or email address looks a bit off to you, it’s always best to either delete or send to your IT department to investigate.

Update Your Software

Regardless of the industry you’re in or kind of organization, having up-to-date, proper cybersecurity protocols and methods in place (in addition to proper in-house end-of-life data destruction!) should always be a priority. It is far too easy for hackers to access and steal sensitive data when your cybersecurity software is not up to date. Check with your business’s IT department or do your own research to make sure you are not ignoring any updates or downloading unauthorized software. It’s also important to note that one should never disable their software’s security features, especially if it is on a work-issued computer or laptop. Your online shopping can wait until you are in the safety of your own protected network and home.

To find out more about Cybersecurity Awareness Month, visit their website here.

Infamous Casino Data Breaches

July 7, 2022 at 6:13 pm by Amanda Canale

While many industries were negatively impacted by the 2019 coronavirus pandemic, one industry not only survived, but thrived: the commercial gambling industry. The casino and commercial gambling industry made approximately $44 billion in 2021, shattering their previous 2019 record. Given this major spike, experts are predicting that the gambling industry will become a neon target for future thieves and cyberattacks.

In our previous blog, Just How Secure Are Casinos?, we broke down the varying security measures casinos take in the form of RFID software located in playing chips, license plate recognition, and other advanced software to ensure that no stealing or cheating occurs. Fortunately, this advanced technology allows the casinos to remotely render chips and other materials worthless if someone were to steal them and allows personnel to have eyes on gamblers at all times.

However, unfortunately, these measures do not completely prevent casinos from being hacked. We’ve broken down a few of the more infamous casino data breachers below and included best practices to ensure that your data stays protected.

Clubillion

In summer 2020, the gambling app, Clubillion, found that their database had been “leaking data” from millions of the app’s customers. The app was contacted on March 23, 2020 but the database was not secured until April 5, 2020. What makes this data breach different than other similar data breaches is that the database was updated with up to 50GB (or 200 million records) worth of information daily. These records logged every player’s actions, their personally identifiable information (PII), private messages, and even IP addresses.

A rep from Clubillion stated that, “on a single day, tens of thousands of individual Clubillion players were exposed.” In addition to a loss in reputation and customers, the popular gabling app may be subjected to other scrutiny and fines from GDPR regulators and GooglePlay and app stores.

Slot Machine One Handed Bandit Game. Rolling Drums. Casinos and Gambling Industry.

Federal Group

In April 2021, Tasmanian casino operator, Federal Group, found themselves in the midst of a cyberattack after their pokies machines (otherwise known as slot machines) and hotel booking systems began to malfunction. At the time of the breach, the casino group was unsure if credit card details stored in the hotel booking system were also compromised and have yet to publicly release that information.

International privacy and security consultant, Terry Aulich, stated that he was “extremely disappointed” with the business’ cyber defenses and warned other Tasmanian organizations to learn from Federal Group’s mistakes. Between Federal Group’s two casinos, patrons had spent upwards of $53.7 million on pokies in the eight months leading up to the breach. 

MGM Resorts International

MGM Resorts International became the victims of a data breach in summer 2019, but it was not made public until February 2020 after a third party published an article detailing the breach. The breach had compromised the records of over 10.6 million guests dating back from 2017. The cyberattackers were able to hack into the resort’s cloud server and then was posted to a public hacking forum. 

Guest PII such as full name, home and email addresses, phone numbers, and birthdates had all been breached, but luckily did not include financial or payment card information. The breach wasn’t also just limited to guests; victims ranged from tourists and travelers, to media reporters and journalists, to company executives and employees. 

At SEM, we offer secure, in-house destruction. With our low and high volume disintegrator solutions, casino materials and solid state boards can be easily destroyed to a predetermined and consistent particle size. As we know, casinos house a lot of sensitive information regarding personnel, patrons, financial information, and advanced technology that should be secured, even in end-of-life. 

Depending on the needs of the casino, SEM has every device necessary to properly and efficiently disintegrate chips as intended since our inception in 1967. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.

For more information on our casino solutions, visit our website here

Just How Secure Are Casinos?

June 10, 2022 at 4:46 pm by Amanda Canale

Even in the midst of a worldwide pandemic, the commercial gambling and casino industry made approximately $44 billion in 2021, surpassing the previous record set in 2019. According to the American Gaming Association (AGA), in-person slots and table games are leading the industry’s recent growth. Given the exponential growth, and (quite literally) billions of dollars on the line, experts predict that the casino industry will be a flaming red target for hackers and thieves.

You’re probably thinking, “what information is even stored on casino chips, playing cards, and dice?” Frankly, quite a lot.

Even more so, casino chips are not the only items that are loaded with information; the same goes for playing cards, dice, and personnel access cards. In this blog, we break down the varying security measures casinos take and how a proper destruction plan your casino can better protect your assets.


Radio-Frequency Identification (RFID)

Casino chips may seem like a cheap piece of plastic, but what many do not know is that these seemingly simple items carry loads of information and are packed with advanced technology. These chips are embedded with radio-frequency identification (RFID), which is used to track them and broadcast unique serial identifiers over radio frequencies. RFID technology identifies and tracks every chip for authenticity, tracking history, and to ensure there is no forgery, cheating, or stealing. Additionally, each casino carries uniquely branded chips, including color combinations, marked edges, and UV markings that are impossible to recreate. The RFID-reading technology also detects when counterfeit chips are being used. 

While you cannot “hack into” casino chips, it’s still possible for people to steal them for money, especially since they are a form of currency within casinos. For example, in 2010, a man stole $1.5 million in chips from the Las Vegas Bellagio casino. However, due to the RFID technology within the chips, authorities were able to remotely render the chips worthless by turning off the chips’ transmitters before the robber could turn them in for cash.

casino chips

License Plate Recognition

Like many secure facilities, casinos have security measures in place tracking you before you even have the chance to park your car. Once your car enters the camera’s frame, the license plate recognition technology scans your plates and converts them into text, which is then compared against the casino’s database. What are they looking for exactly? The software runs your license plate against their records to see if you are a known gambling addict, thief, or on their internal blacklist. This process is to ensure that no undesirable patrons are allowed into the facility.

Angel Eye

Like I stated earlier in this blog, chips are not the only casino materials that are loaded with information. Playing cards carry invisible bar codes that help sensors and security software, such as Angel Eye, track their movement, which ones are being dealt, and to prevent card-switching. The software was specifically designed to prevent card switching, which is prominent in other parts of the world.

When a dealer deals cards, the software tracks the dealt cards through a sensor in the dealing shoe (the container that houses the cards). After this first scan and once the cards are revealed on the table, the dealer presses a hidden button that scans the table and upward facing cards a second time. The Angel Eye software compares them to the initial scan to ensure that the results on the table matches what the computer says. 

TableEye21

TableEye21 is a powerhouse of a security device; it is made up of varying technologies all wrapped into one concise solution. It includes an overhead video camera that tracks the table’s actions and players, includes video analysis software and information sent by the RFID chips, and overlays the video feed with real-time data tracking on cards and chips being used. 

TableEye21 tracks every action on the table, including dealer rounds per hour, trend reports, and the player win percentage. Casino authorities use this information to identify if a player is counting cards, using counterfeit chips and cards, or scheming with the dealer in order to win. 

NORA

NORA stands for Non-Obvious Relationship Awareness software, and it goes hand in hand with all of the security measures we discussed above. Whether a dealer notices something off about a player or the TableEye21 software picks up on odd numerical trends, NORA can be used to scan the casino’s databases for information and recognize relationships between players and dealers alike.

What relationships, you ask? Let me give you an example.

If casino personnel put Brian Jones into NORA, the software will scan all of the casino’s databases and be able to see that Mr. Jones, who applied for a dealer position, is actually Paul Johnson, a notorious poker scammer. In addition, it can connect people entered into NORA based on their similar backgrounds. So once NORA finds out that Brian Jones is really Paul Johnson, it also connects Paul to another player, Zachary Jost. From there, the software connects the dots and finds out that Paul and Zachary were fraternity brothers during their undergrad career and that they were both arrested for the same fraud case.

Another potential outcome is NORA discovering that the dealer and a player used to share the same address and phone number, possibly meaning that they are in on a scam together.

If that wasn’t impressive enough, we should probably mention that it was after 9/11 that the Department of Homeland Security began using the advanced software to help identify relationship links between potential terrorists and criminals. 

This is not an exhaustive list by any means; there are many other security measures and advanced tracking technology that casinos use in order to maintain order and ensure honest playing. However, there is one more security method we’d like to discuss: the destruction of casino materials.

dice-shredding

As of this writing, there are no federal laws concerning data protection that casinos have to abide by. However, casinos and gaming facilities are required to abide by their state’s safeguarding mandates and financial privacy regulations. In order to maintain the stringent policies set in place to prevent fraud and criminal activity, it is crucial for casinos to establish further security measures for the destruction and disposal of these technology-ridden materials. 

In the past, casinos have thrown their chips and cards out with the trash, some even building them into the foundations of casinos out of superstition. But in recent years, casinos have been required to destroy their chips and cards according to predetermined expiration dates. Typically, the expired materials are sent out to a third party destruction facility where they are often dumped into landfills or left vulnerable to thievery by the third party vendors.

At SEM, we offer a better alternative: secure, in-house destruction. With our low and high volume disintegrator solutions, dice, chips, and playing cards can be easily destroyed to a predetermined and consistent particle size. As we know, casinos house a lot of sensitive information regarding personnel, patrons, financial information, and advanced technology that should be secured, even in end-of-life. 

One solution is the SEM Model DS-400, a dual stage turnkey disintegrator that has been evaluated by NSA and meets the requirements of NSA/CSS specification for Paper Disintegrators, CDs, and Key Tape. This compact and portable device is perfect for the destruction of paper, optical media, key tape, casino chips, metal and plastic cards, and more.

Need something with a higher volume? We suggest a SEM VKE Disintegrator system. Our VKE (value kit enclosure) disintegrator systems include your choice of disintegrator, air system, state-of-the-art technologies and features like a customized MX sound enclosure to reduce sound and dust during operation, a solid steel rotor designed to provide 70% more rotor mass than open rotor designs, and user-friendly master control panel.

Depending on the needs of the casino, SEM has every device necessary to properly and efficiently disintegrate chips as intended since our inception in 1967. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.

For more information on our casino solutions, visit our website here. 

Top 4 Ways to Outsmart a Phishing Scam

March 21, 2022 at 6:37 pm by Amanda Canale

Do you have what it takes to outsmart a phishing scam? Let’s find out!

First, a bit about phishing: for those that may not be familiar with phishing, phishing is a phrase used to describe a cyberattack method via email. An email is sent to an individual with the intention of hacking into the recipients’ email, computer, or network. 

Typically, the phishing email will ask the recipient to perform some form of task, whether it is to open an attachment, click on a link, send gift card codes, or send along sensitive information. These links and attachments will be malware-infected and allow the hackers to gain access to your computer, network, and more, and can have detrimental consequences. 

It is important to note that phishing is not a new cyberattack tactic.  Phishing has been one of the most common attack methods and has only become increasingly more complex the further we get into the Digital Age. That said, upgrading your cybersecurity software and educating your staff how to spot and report phishing emails are just two ways to better protect you and your organization’s data. And speaking of educating your staff, read on to learn the top four ways you and your team can spot a phishing email. 

SOX data destruction

Red Flag #1: An Urgent Request for Login Information, Sensitive Information, or Money

Today, it is increasingly easy to get in touch with one another; there’s the telephone, text message, FaceTime, Microsoft Teams chat, Zoom call, calendar invite, and more. It’s safe to say that if your supervisor (or any member of upper management) needs to speak with you on an urgent matter, they’re going to find a way to contact you directly. If an email allegedly coming from your boss or CEO is threatening negative consequences, or even termination, if you do not complete their task, it’s probably a phish. This is a type of scare tactic used to rush the recipient into getting their request completed as soon as possible.

In addition (and it should be common sense), if your boss needs you to send her login information or sensitive information, take a moment and ask yourself, “if this person were really your boss, wouldn’t she have her own access to that information and logins, especially if she is in upper management?” We’re not saying you should ignore every request for information from upper management, but if the request seems a little fishy (pun intended), take a moment to give the sender a quick call or follow up with them in a separate email (using the email address you know belongs to them) to confirm their request.

The same should go for any request for money or gift card activation codes. A colleague, regardless of title and status, should not be requesting monetary items from you via work emails. This is usually a clear sign of a phish and like we suggested above, take a moment to follow up with that person in real time to confirm their request. 

Red Flag #2: Misspelled Name and/or Email Address (When Impersonating Someone You Know)

Now, these attempts don’t come from just any John Doe; hackers do their research to make sure the “sender” looks like it is quite literally coming from your supervisor, company president, client, or…pretty much anyone you know based on social platforms and public company directories.

That being said, it’s now time to break out your magnifying glass and bifocals because we’re moving on to proofreading the urgent request with a fine-tooth comb. Some phishers are lazy so it may be fairly easy to spot a phish simply by doing an in-depth evaluation at the spelling of the sender’s email address (and even the spelling of anyone’s names that are mentioned). 

Since it is not possible for two email accounts to exist under the same domain, hackers have to get creative with the spelling of email addresses when impersonating someone. A quick scan may miss the typos and misspellings so it’s best to take the extra few seconds to make sure the sender is using the correct domain and spelling of their name. Also be on the lookout for the number 1 replacing an  L or an I and other such crafty substitutions.

data-theft

Red Flag #3: Bad Grammar and Overall Spelling Mistakes

Most of the time, phishing scams do not come from a particular person but rather a bot or a spell-check tool that doesn’t always translate well. Be on the lookout for major spelling and/or grammar mistakes, and this red flag will be an easy one to spot.

Red Flag #4: Illegitimate Links

Whatever you do, do not click the blue link! 

One tricky way phishers hook their victims is by using illegitimate links. One can avoid activating any malware-infested links by simply hovering their cursor over the link for a second or two to see a preview of the URL. If the preview is anything different than what the link says it’s supposed to be, then report it to your IT manager for a more in-depth evaluation.

To summarize, sometimes all it takes is a few extra seconds to carefully read over requests (and maybe a “better to be safe than sorry” forward to your IT department) to spot a phish. As a final note, we want to stress that it takes more than a simple spellcheck to keep you and your organization’s information secure. Upgrade your security software, implement two-step verification logins, train your employees, and collaborate with your IT department to find other security methods you can take.

Shredding Security Levels

January 20, 2022 at 8:17 pm by Amanda Canale

When it comes to the destruction of end-of-life media in the US market, there are very strict guidelines and laws that address how classified, top secret, and controlled unclassified information (CUI) should be disposed and securely destroyed, determined by the National Security Agency (NSA) and the National Institute of Standards and Technology (NIST). For example, the NSA mandates specific particle sizes for top secret and/or classified data that resides on all forms of media, and evaluates and lists end-of-life information destruction solutions for this purpose. For a list of media destructions solutions evaluated and listed by the NSA, click here.

However, most other guidelines and laws that apply to other types of government and commercial information do not provide specific destruction particle sizes to insure the most effective solution. Most simply indicate that media should be destroyed with the use of a shredder or other destruction solution. In industries like healthcare, finance, banking, education, and more, the importance of the proper disposal of end-of life media is better defined; however, the particle size specifics tend to be left open to interpretation. 

DIN Standards, otherwise known as Deutsches Institut für Normung, originated at the German Institute for Standardization, a non-government organization that serves as the national standard when it comes to improving the rationalization, safety, environmental protection, and quality assurance between the government and the public. While often not mandated, DIN guidelines serve as a widely accepted global standard that also provides clarity to vague end-of-life information destruction requirements.

Enter DIN 66399. These standards provide destruction particle size guidelines for information that resides on a wide range of media and that specifies protection categories. 

Q: What is the DIN Standard 66399?

A: DIN 66399 has become a globally accepted security standard for the shredding or destruction of all types of data media.

Q: Who is it for?

A: Sets out responsibilities regarding the protective security required for commercial organizations, government departments, and individuals to help make an informed choice of the correct equipment to guarantee all levels of secure destruction.

Introducing the Three Protection Categories

Class 1: for the normal protection required for internal data where disclosure would have a negative impact on a company or a risk of identity theft of an individual.

Class 2: for the higher protection of confidential data where disclosure would have a considerably negative effect or could breach legal obligations of a company; or offer a risk of adverse social or financial standing of an individual.

Class 3: for very high protection for confidential and top secret data which if disclosed could have terminal consequences for a company or government entity, and have a health and safety or personal freedom risk to individuals.

However, at the end of the day these regulations and protection categories are guidelines. Businesses and organizations should always err on the side of caution when it comes to the destruction of end-of-life data. It’s important to remember that a data breach is a data breach no matter the level of impact…and no matter when it takes place. There are no statute of limitations when it comes to compromised data: just because the information wasn’t misused then, doesn’t mean it won’t happen in the future. Therefore it is always best practice to adhere to the above regulations when it comes to your data destruction.

Six Media Categories

The DIN Association also defines six media format categories on where information may reside. They are as follows:

  • P: Paper based products
  • F: Film based products including micro-film, microfiche, slides, etc.
  • O: Optical media including CDs, DVDs, and Blu-ray Disks 
  • T: Magnetic data media like floppy discs, ID cards, magnetic tapes and cassettes, etc.
  • H: Hard drives from computers, laptops, and external devices
  • E: Electronic data media like memory sticks, cards, solid state drives, mobile phones

Seven Specific Security Levels 

Example: P = Paper media requirements

Protection Category

Media Paper

Security Level

Security Level Particle Size Requirement

Class 1

P

1

12mm strips or maximum particle surface area of 2,000mm²

Class 1

P

2

6mm strips or maximum particle surface area of 800mm²

Class 1

P

3

2mm strips or maximum particle surface area of 320mm²

Class 2

P

4

Maximum cross-cut particle surface area of 160mm² with a maximum strip width of 6mm = 6 x 25mm

Class 2

P

5

Maximum cross-cut particle surface area of 30mm² with a maximum strip width of 2mm = 2 x 15mm

Class 3

P

6

Maximum cross-cut particle surface area of 10mm² with a maximum strip width of 1mm = 1 x 10mm

Class 3

P

7

Maximum cross-cut particle surface area of 5mm² with a maximum strip width of 1mm = 1 x 5mm

Maximum Shred Size for Other Media

Class

Film

Max

Optical

Max

Tape

Max

Magnetic

Max

Electronic

Max

Class 1

F-1

160mm²

O-1

2000mm²

T-1

Inoperable

H-1

Inoperable

E-1

Inoperable

F-2

30mm²

O-2

800mm²

T-2

Split

H-2

Damaged

E-2

Split

F-3

10mm²

0-3

160mm²

T-3

2000mm²

H-3

Deformed

E-3

160mm²

Class 2

F-4

2.5mm²

0-4

30mm²

T-4

320mm²

H-4

2000mm²

E-4

30mm²

F-5

1mm²

0-5

10mm²

T-5

160mm²

H-5

320mm²

E-5

10mm²

Class 3

F-6

0.5mm²

O-6

5mm²

T-6

10mm²

H-6

160mm²

E-6

1mm²

F-7

0.2mm²

O-7

0.2mm²

T-7

2.5mm²

H-7

10mm²

E-7

0.5mm²

Q: How does SEM meet these requirements?

A: As a supplier of information destruction systems for the past 50 years, SEM is a leader in providing solutions to meet all destruction levels outlined in the DIN 66399 guidelines. From machines that can shred paper and optical disks to hard drives and data tapes (and more!), SEM has the answer.