Data Sanitization and Disposal: Best Practices
2 likes1,445 views
The document outlines best practices for data sanitization and disposal, emphasizing compliance with laws like FACTA and various industry standards. It details techniques for data destruction such as shredding, degaussing, and wiping, along with myths and misconceptions regarding data sanitization. The document also highlights the importance of proper documentation and certification of destruction to prevent unauthorized data access.
Data Sanitization and Disposal: Best Practices
- 1. Data Sanitization and Disposal: Best Practices Ed Pletner - CEO Christian Lardie - IT Project Coordinator
- 2. Laws, Regulations, & Liabilities ●FACTA: Fair and Accurate Credit Transactions Act ●“any person who maintains or otherwise possesses consumer information for a business purpose” must properly destroy discarded information. ●“must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. ●Civil Liability, Class Action, Federal Enforcement, State Enforcement ●Others: HIPAA, HITECH, PCI DSS, Sarbanes-Oxley, Graham-Leech-Bliley, etc.
- 3. Techniques for Data Destruction • Shredding: Industrial Hard Drive Shredding Machine (ex Ameri-shred) • Degaussing: Magnetic data on a tape or hard disk is neutralized or erased. Makes media unusable and damages the storage system
- 4. Techniques for Data Destruction • Wiping: Overwriting of data with 1s and 0s or non- sensitive data • Free Wiping Software: Ex. Dban, ActiveKillDisk • Advantage: Free and easy to use • Disadvantage: No validation of wipe • Paid Wiping Software: Ex. Tabernus, WipeDrive • Advantages: Error handling of failed drives, Reporting/Logging of successful data erasure • Disadvantage: Costs
- 5. Myths of Data Destruction • A simple re-format/delete is adequate • SSDs should be treated the same as Hard Drives • Hammer to hard drive
- 6. NIST Media Sanitization Guidelines • NIST (National Institute of Standards and Technology) • Updated from older 3-Pass (DOD 5220.22-M) • For ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.
- 7. NIST Sanitization Methods ●Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; typically applied through the standard Read and Write commands to the storage device ●Ex. Software Wipe (1 or more Pass) ●Purge applies physical or logical techniques that render Target Data recovery infeasible using state of the art laboratory techniques. ●Ex. ATA SecureErase; Cryptographic Erase, Degauss ●Destroy renders Target Data recovery infeasible using state of the art laboratory techniques and results in the subsequent inability to use the media for storage of data ●Ex. Shred, Incinerate, Pulverize
- 9. 1. Manufacturer 2. Model 3. Serial Number 4. Media Type 5. Sanitization Description (Clear, Purge, Destroy) 6. Method Used (degauss, overwrite, block erase, crypto erase, shred) 7. Verification Method 8. Signed & Dated Documentation
- 10. CERTIFICATE OF DESTRUCTION THIS IS TO CERTIFY THAT ALL MATERIALS RECEIVED FROM THE BELOW LISTED CUSTOMER FOR DESTRUCTION WERE DESTROYED AND WILL BE RECYCLED IN ACCORDANCE WITH ALL APPLICABLE FEDERAL, STATE, AND LOCAL REGULATIONS. WE FURTHER WARRANT THAT REASONABLE PRECAUTIONS WERE TAKEN TO PREVENT ANY UNAUTHORIZED THIRD PARTY FROM GAINING ACCESS TO THE MATERIALS WHILE IN OUR POSSESSION TO FINAL DISPOSITION Customer Location: ABC Company 123 Street Dr. San Diego, CA 92111 650 Gateway Center Way, Suite I San Diego, CA 92102 858-715-0950 www.avritek.com ________________________ Destruction Certified By Date Generator Location: ABC Company 123 Street Dr. San Diego, CA 92111 Material Description(s): 100 Hard Drives Shredded/Wiped (see attached excel sheet for Serials). REFERENCE #: PT-1244
- 11. Mobile Device Security ●Factory Reset ●Blackberry: Security Wipe ●Android: Encrypt then factory reset ●Apple (iPad & iPhone): Enable Data Protection then “Erase All Content” ●Software Wipe via Tabernus or WipeDrive Mobile ●Reporting ●Utilizes the factory reset partition ●Shred