What is dumpster diving?

Introduction

Bad actors will do anything to get their hands on sensitive information or to get into your network. Social engineering is what they use to impersonate someone or install malicious programs like ransomware or other malware. While most of these methods revolve around digital attacks like phishing or vishing, there are also physical aspects to consider as well. One of these attack methods is dumpster diving.

It may seem self-explanatory, but dumpster diving has always been a successful way that bad actors can get information. Some businesses don’t always destroy papers and documents in a secure method, leaving them to simply be thrown away into the garbage. There, it can be scoured by those wanting that information.

What is dumpster diving?

All of our trash has to go somewhere–this includes documents that may no longer be important to the business. As such, some people will simply throw them away, only to be put in the dumpsters to eventually be taken off to a landfill or some other location. These dumpsters are the perfect place for someone to pick up a piece of information or two.

A bad actor will dive into these dumpster and rummage around for important papers that may still have sensitive information on them. While the documents may no longer be of use, they still can contain information that a bad actor can use. They may look for customer names, account numbers, or other things that they might use to impersonate said customers. They could also have employee information, which can be even worse.

Another thing to keep in mind is that these attacks extend beyond mere paper and documents. Some businesses may simply try to throw away physical devices or media like computers, hard drives, or flash drives. These are just as easily picked up by bad actors, leading to an even worse security situation if the devices aren’t properly wiped.

Prevent Dumpster Diving

Even if you have mostly digital record keeping, a paper or document will need to be printed now and then. That means that there will be waste, so it’s important to keep your waste receptacles as secure as any other area of your workplace.

Secure Shredding

One of the best ways to keep your documents from bad actors is to shred them in a secure location or through a third party who specializes in destroying these papers in a secure fashion. A common method for these companies is to use a container or some sort of locked receptacle that can simply turn into a blender. They will shred everything in it and then destroy or recycle the remnants.

Lock and Key

It may seem like an easy fix, but a locked dumpster can prevent a lot of tampering. While locks aren’t always guaranteed to keep everyone out, it can be enough of a deterrent to keep the stray bad actor from trying to peek in. If someone really wanted to get in, they could cut the lock or try to remove it in some other manner.

Wiping Devices

For physical devices and media, it is important to erase all data that may still be on them. Your IT department should be in charge of these things, so be sure to let them know that the device is going to be destroyed. There are plenty of programs and scripts out there that can erase all information, but secure destruction of these devices is also recommended.

Waste Policies

All organizations, especially financial institutions, should have a waste or disposal policy. It should encompass everything that needs to be discarded when it comes to documents or devices that employees or customers use. These should be kept up to date with any changes that might arise, but it’s a good idea to take a look at the policies once a year.

Security Awareness

When it comes to any cybersecurity issues, both physical and digital, it’s important to have security awareness training in place. Humans are, unfortunately, the biggest weakness in any cyber defense. However, with training and reminders of policies and procedures, employees will have this security at the top of mind and will be able to identify and prevent any social engineering attempts.

Conclusion

Dumpster diving is a physical cybersecurity attack where a bad actor will go into waste areas in order to find papers and documents for sensitive information or devices that may not have been wiped of data. If not disposed of properly, the business could be at risk, exposing customer financial information, employee data, and more.

There are many ways to prevent dumpster diving from becoming an issue. One of the best ways to do this is to have security awareness training in place for your employees. Aside from that, other ways include shredding and destroying papers and documents, locking your dumpster and trash areas, and wiping devices when they are no longer in use. If you follow your disposal procedures, you won’t have any issues with this type of physical social engineering.