What Is Dumpster Diving?

Dumpster diving is searching discarded material for useful information. It is unglamorous, legal in many jurisdictions once waste leaves the premises, and it continues to produce results because organisations throw away a great deal more than they intend to.

For an attacker preparing a social engineering approach, it is a cheap source of exactly the internal detail that makes a pretext convincing.

What gets found

Internal directories and organisational charts. Memos and printed correspondence with real project names and terminology. Invoices and purchase orders showing suppliers and systems in use. Password reset notices and account setup letters.

Discarded hardware and media, which is the most serious category. Also visitor logs, badge printouts, network diagrams and support tickets — each individually minor and collectively a briefing document.

Paper disposal, done properly

Cross-cut shredding rather than strip-cut, since strip-cut output is reassemblable and has been reassembled in practice. Secure collection bins that are locked and not merely labelled, placed where people actually discard things.

A certificated destruction service for volume, with the chain of custody documented. And a default that says confidential disposal is the normal route, since a policy requiring people to classify each page will not be followed.

Media and hardware are the larger risk

Drives, phones, laptops, backup tapes, copiers and multifunction printers all retain data, and copiers are routinely forgotten — they contain drives holding images of everything scanned and printed.

Deletion and quick formatting do not remove data. Cryptographic erasure, full overwriting or physical destruction do. Where a third party handles disposal, a certificate is worth only as much as the custody chain behind it.

The physical side

Waste awaiting collection is frequently in an unsecured yard or shared area, which is where it is accessible. Securing that area, and shortening the time material waits there, removes most of the opportunity.

Lease returns deserve specific attention. Equipment going back at end of term leaves with whatever is on it unless sanitisation is an explicit step, and it frequently is not.

Making it part of decommissioning

Disposal failures are usually process gaps rather than careless individuals. Adding sanitisation as a mandatory, recorded step in system and device decommissioning is what closes them.

That record is also what a regulator will ask for, and it cannot be reconstructed once the equipment has gone.

The online equivalent produces more

The same reconnaissance objective is now largely met without visiting anywhere: documents indexed by search engines, metadata in published files revealing usernames and software versions, code repositories containing internal hostnames, and credentials committed to public repositories.

Reviewing what is publicly discoverable about your organisation covers the same ground more efficiently than securing the bins, and both are worth doing. The physical route persists because it reaches material that was never intended to be published at all.

Where to start

Establish what happens to your multifunction printers and copiers at end of lease. It is the most commonly missed data-bearing device and the one that has seen the most content.

See retention and secure disposal. GuardsArm runs compliance auditing.