If you are a government or military contractor, then you already know that you have a lot of hoops to jump through and one of them is ITAR. When it comes to how to e-recycling military and government equipment, you need an ITAR-registered e-recycler. In truth, even if you are not working with the military or the government, you may still need or at least want to work with an ITAR-registered facility. 

Why Do You Need an ITAR Registered E-Recycler?

ITAR is essential for any business or entity that works as a government or military contractor and is required in other industries as well. Most who work in those industries already know, but for those that are concerned about ITAR, we’ve put together some information for you below.

What is ITAR?

ITAR is an acronym, and as you may have already guessed, it is a government acronym. The government does love its acronyms, don’t they? ITAR stands for International Traffic in Arms Regulations and it’s been around since 1976.

It’s also worth mentioning that ITAR is not a certification. Anyone that calls it a certification does not know what they are talking about. ITAR is a set of procedures that should be followed by any ITAR-registered entity that is performing an ITAR-compliant service. This means you are not looking for an ITAR certification but rather an ITAR-registered vendor, e-recycler, or asset disposal service to work with.

Essentially this regulation is designed to restrict and control the export of defense and military-related technologies in an effort to safeguard U.S. national security. Now, you may think, if you don’t have arms like bombs or guns, then this doesn’t apply to you, but that’s not actually the case.

How Does ITAR Define Military-Related?

Honestly, the term military-related technologies can be applied pretty broadly, but here are a few of the big ones that may not be as obvious as guns, missiles, and tanks:

• Military Protective Personnel Equipment
• Military Electronics
• Materials and Miscellaneous Equipment
• Classified Articles
• Articles, Technical Data, and Defensive Services Not Otherwise Enumerated

All of those are taken directly from the regulations themselves and you can see how they can be fairly ambiguous and left up to interpretation. Something as simple as a mundane processor that is built to regulate the HVAC on a military transport truck may fall under ITAR.

For this reason, it is recommended that anyone that produces materials or equipment for government defense or the military, strictly follow ITAR, and that means all your vendors need to follow ITAR as well and only work with ITAR-registered entities.

Benefits of Working With an ITAR-Registered E-Recycler

Even if you are not working with the government, it might be a good idea to work with an ITAR-registered vendor and request ITAR-compliant asset disposal. Following ITAR-established procedures ensures a higher level of security, greater protection against a data breach, and provides peace of mind. For this reason, there are several major companies that only work with ITAR-registered vendors despite not being required to under ITAR.

By Brian Leslie
Faith Technologies

It seems that every week there are news stories about one company being attacked by Ransomware, another hit with Business Email Compromise, and yet another that has been phished. Cybercrime continues to grow, and the impact on businesses is tremendous. Recovering from an attack or breach can be costly. First you have forensic and investigation activities which often include crisis management. Then we move onto costs associated with notifying data subjects and third parties. Business disruption costs also occur from downtime, let alone the cost of potentially losing current customers and new ones.

So how can you stay on top of cyber threats and cybercrime? While there are many activities a company needs to do, Managed Detection and Response (MDR) can be an appropriate place to start.

MDR is a service that allows for a skilled partner to act as extension of your own cyber team. They provide a dedicated Security Operations Center (SOC) to actively monitor your systems 24x7x365. Their primary goals are to detect threats, analyze, investigate and actively respond to them with the intention to thwart them in their tracks.

With the prevalence of ongoing attacks, having a MDR can be highly advantageous. Here are three benefits of leveraging an MDR service.

1. Improve Security Maturity and Effectiveness – MDR providers will leverage people, processes and technology to identify threats. Let’s start with a concept called Indicators of Compromise (IOC). IOCs refer to activity within your network that can be defined as unusual activity. Think of these as potential red flags. An example is a user who lives in North America. Now imagine their corporate account is continuously connecting to your network from another continent. In this scenario it could either be a cyber criminal or maybe just a team member who is traveling. Regardless, this could be defined as an IOC which needs to be investigated. These types of red flags can often go unnoticed without the right technology, processes and people who are trained and dedicated to spot them. This is where both maturity and effectiveness come in. MDR teams will greatly improve your mean time to detect and your mean time to remediate threats and vulnerabilities.
2. Full-Time Coverage with Active Response – With the increased sophistication of cyber criminals, it’s important to place emphasis on quick response. Above I mentioned mean time to detect and mean time to remediate. The bad guys don’t always sleep, so how will you know about that high priority IOC at 2 a.m.? This is where 24x7x365 coverage comes into play. The SOC analysts can act as an extension of your security team and tailor services to your industry and business. Having dedicated SOC analysts performing forensic analysis to validate alerts and eliminate false positives keeps your existing team focused on business priorities. SOC teams can act independently and also get in touch with your internal teams to partner when needed.
3. Demonstrating Accountability and Trust – As cybercrime continues to grow and the bad guys press on, we need to hold ourselves accountable. Companies are obligated to put cyber capabilities in place to detect potential compromise and perform due diligence in acting upon that risk. While no company, big or small, is immune to an incident, we must always be responsible stewards of our systems. We owe it to our customers, who have high expectations of data protection. We owe it to our employees, who rely on us to protect their personal employee information. We owe it to our company, to protect the health of the organization.

Many strategies exist to be able to detect cyber threats. Whether you leverage an in-house model or a combined approach with a partner, there are benefits. If you are not familiar with a Managed Detection and Response model, I encourage you to check it out and see if it’s right for your company.