Thats ok because they use self encrypting drives right? So a person with the drive cant use the data on it correct?

Quite.

I'm intrigued how they were able to identify the drives as belonging to SAP otherwise... they must have been unencrypted or else they'd just look like a bunch of random data at best, or not even let you see the drive at all (if you have ATA-level encryption on).

I suppose in theory they could have connected them to a system and supplied SAP drive encryption credentials and then seen data that nobody without those credentials could have, but it doesn't sound that way. It sounds like plain-text to me.

"I'm intrigued how they were able to identify the drives as belonging to SAP otherwise... they must have been unencrypted or else they'd just look like a bunch of random data at best, or not even let you see the drive at all (if you have ATA-level encryption on)."

Hard to know exactly.

I'm assuming these were Enterprise high-capacity SSDs (so not the "common") made by a vendor that SAP used. It is possible the particular model/models of SSD were only sold to a limited number of enterprise customers and so them being sold on eBay would point to only a small number of enterprise orgs they could have come from.

Many enterprise/cloud providers shred HDDs/SSDs on-site when they come to the end of their operational life and so any such "unusual" models of drive would be unlikely to be resold anywhere.

Also OPAL drive encryption has in the past been broken/bypassed by security researchers, usually not due to flaws in OPAL in general but rather due to vendor implemention-specific flaws.

It is possible that the drives were not encrypted at all (on the assumption that they would be securely wiped when finished with and shredded if end-of-life).

Possibly, they scan the "serial numbers" of all of their drives into some sort of "inventory database" so they can also track their movements and confirm delivery to a secure shredder I hear data centers do stuff like that.

"a SAP spokesperson said the disks contained no personally identifiable information"

Given that the drive bought on eBay contained data on 100 SAP employees either SAP employees don't count as persons or the spokesperson is pushing things even further than the standard script for this situation.

"no personally identifiable information (PII)"

Wondering whether this is a literal quote from the SAP spokesperson (unlikely as it was not inside quotation marks) or written by TheReg's Lindsay.

As the SSDs were stolen in Germany (i.e. EU) then what matters is whether they contained any "Personal Data" which is what EU Data Protection Law (GDPR) is about. PII tends to be a USA term which has a narrower definition than "Personal Data" and is not relevant in the EU.

I'd expect Lindsay to know the difference between Personal Data and PII...

This is one of the big problems with the Americanisation of The Register, using an American term here makes things very unclear...

Demonstrably they don't, Because this doesn't happen to people who do.

... at least, not five times in two years.

And SAP wonder why no one wants to "Rise" to their cloud...

Poor saps.

At least they didn't get root...

When we get caught, we take it seriously. Normally, we just assume everything is tickey-boo. Very relaxed about our data warehouse and its appalling physical security until it was discovered to be a weak point. Now it looks like we have a PR disaster on our hands so we need to show that we really do care, honest.

There, FIFY.

No encryption at rest?

The GDPR fine should be large.

Is a lot smaller than SAP, but apparently we are far more secure.

1. All servers, NASes, etc., are inside locked racks. Yes, the racks aren’t anything special, and the locks are pretty flimsy, but it would be obvious if someone liberated a drive.

2. All racks are in locked rooms, using card and touchpad access. And with security cameras inside the rooms and outside, pointing at the doors. Only authorized people are allowed inside. And the cameras would spot some taking a drive.

3. Entrance, and exit, to the building are via security doors in a mantrap system, with lots of cameras.

4. The sysadmins would probably notice missing drives, not least when reviewing the backup logs.

5. The Morgue where we play with dead equipment is right next to the server rooms. And is locked and the door has security cameras.

6. Anyone who pulls any equipment from the server rooms has to sign for it. And sign it back in when done. We definitely do not allow drives to leave the building. Unless they are headed to Iron Mountain for storage or destruction.

7. As getting into the Morgue or the server rooms requires the key card, which is your ID card, you can't even access anything without it being clear whodunit.

8. Backup tapes are stored in fire-resistant cabinets in the Morgue until the guys from Iron Mountain show up to take them to secure storage. The cabinets are, of course, locked. (Yes, we still use tape. It works.)

There is no reason for a drive to be anywhere except the Morgue or a server room, or in transit between them. (Except for brand new drives arriving from outside, of course.) Any drive going out of service is reformatted seven times, if it still works, and destroyed by physically drilling holes through it. Really good recovery people might get some data from the drive, but it won't be easy. Destroyed drives are sent to Iron Mountain and run through their shredder. Now not even a really good recovery service is going to find much.

So how, exactly, did a major corporation manage to let drives get out into the wild, and not once but multiple times?

"2. All racks are in locked rooms, using card and touchpad access. And with security cameras inside the rooms and outside, pointing at the doors. Only authorized people are allowed inside. And the cameras would spot some taking a drive."

Really? If the cameras are pointing at the doors then presumably I can remove a drive from a server and have it in a pocket as I leave.

Now it should still be possible to say "this was when the drive disappeared, and there were only three people who accessed the room then", but drives are no longer large enough to need any skill to hide them.

Research Machines assembly plant had a flooded male lavatory, the cause was a jammed open valve.

One of the contractors had signed out a replacement HDD (Still in its shrink wrapped factory bag), then gone to the lavatory & hidden it in the cistern for later retrieval at the shift end but jammed the valve open.

He was traced from serial number on the HDD, the timestamp of signing for it & the security footage from that point & then going for his data dump.

It's the code for multi-currency they need in Singapore.

Cloud Computing:

Just someone's servers in someone else's building with unknown computer and physical security.

But this wasn't even Cloud. It was their own datacentre! Oops!

" SAP takes data security very seriously... "

So seriously that folks can leave a secure area with kit unchallenged. This reminds me of the famous wikileaks incident where the perp transported secrets out of a SIPRNET environment on writable CDs that he pretended were pop music he'd brought in to play on his phones. The investigation found that the stringent SIPRNET security protocols were not applied to guys they knew: " [1]Personal use was common, widespread and casually accepted – “Defense (Coombs): How was it enforced? Lim: No. You trusted people ”

[1] https://alexaobrien.com/archives/1735

I used to know a guy that would run a scam thusly:

1) pop out a drive on a raid array

2) reseat it

3) wait for the compaq (yes this was ages ago) engineer to turn up, replace the drive and leave the old one in the rack because of the disk retention policy.

4) swipe the 'faulty' drive

No idea if they got flogged on fleabay though