Cyberstudy
PDF p.188 In progress

Secure Data Destruction

Open PDF at p.188 22 flashcards

Summary

PDF p.188

Secure data destruction is essential for maintaining security, compliance, and proper resource management. It involves destroying data at the end of its retention period, during decommissioning of storage devices, or to comply with legal and regulatory requirements.

In plain words

Supplementary — not from your PDF

Data must be destroyed at the end of its retention period, when regulations such as GDPR or HIPAA require it, and before storage devices are disposed of or reused. Hard drives can be overwritten with zeros or multi-pass patterns. SSDs need ATA Secure Erase, because overwriting can miss cells. Sanitization makes a device safe to reuse; destruction (shredding, crushing, incinerating, degaussing) makes it unusable. A certificate from a third party documents that it was done.

Detailed explanation

PDF p.188
  • Circumstances for Data Destruction
    • End of Data Retention Period: Destroy data according to internal policies and external regulations.
    • Legal and Regulatory Compliance: Adhere to GDPR, HIPAA, and other regulations requiring data deletion.
    • Storage Optimization: Periodically destroy obsolete data to maintain efficient storage utilization.
    • Decommissioning Storage Devices: Ensure data is destroyed before disposal or repurposing to prevent unauthorized access.
  • Methods for Data Destruction
    • Hard Disk Drives (HDDs)
      • Data Wiping: Overwriting with zeros or multiple patterns.
      • Complex Patterns: Multiple passes to thwart data recovery attempts.
    • Solid-State Drives (SSDs)
      • ATA Secure Erase: Commands designed to sanitize all stored data, including inaccessible memory cells.
  • Asset Disposal
    • Sanitization
      • Definition: Removing sensitive information to prevent unauthorized access.
      • Techniques: Data wiping, degaussing, encryption.
      • Importance: Protects sensitive information and ensures compliance.
    • Destruction
      • Physical Methods: Shredding, crushing, incinerating storage devices.
      • Electronic Methods: Overwriting data multiple times, degaussing.
      • Purpose: Ensures data cannot be retrieved or misused.
    • Certification
      • Definition: Documentation and verification of data sanitization or destruction.
      • Third-Party Involvement: Provides impartial evaluation and compliance evidence.
  • Overwriting HDD Data
    • Process: Sets each bit to zero (zero filling) or uses more secure methods with multiple passes.
    • Security: More secure methods involve passes of zeros, ones, and pseudorandom patterns.
    • Time: Overwriting can take considerable time depending on the number of passes.

Important terms

taken from the text above
End of Data Retention Period
Destroy data according to internal policies and external regulations.
Legal and Regulatory Compliance
Adhere to GDPR, HIPAA, and other regulations requiring data deletion.
Storage Optimization
Periodically destroy obsolete data to maintain efficient storage utilization.
Decommissioning Storage Devices
Ensure data is destroyed before disposal or repurposing to prevent unauthorized access.
Data Wiping
Overwriting with zeros or multiple patterns.
Complex Patterns
Multiple passes to thwart data recovery attempts.
ATA Secure Erase
Commands designed to sanitize all stored data, including inaccessible memory cells.
Sanitization
Removing sensitive information to prevent unauthorized access.
Physical Methods
Shredding, crushing, incinerating storage devices.
Electronic Methods
Overwriting data multiple times, degaussing.
Certification
Documentation and verification of data sanitization or destruction.
Third-Party Involvement
Provides impartial evaluation and compliance evidence.
Time
Overwriting can take considerable time depending on the number of passes.
HDDs Hard Disk Drives SSDs Solid-State Drives

Examples & real-world scenarios

Supplementary — not from your PDF
  • ATA Secure Erase on SSDs before redeploying laptops.
  • Shredding failed drives from a database server.
  • A destruction certificate from a certified disposal vendor.

Scenario

A company sells old laptops after only deleting files and formatting. Buyers could recover the data. Proper sanitization (secure erase) or destruction, with certificates, was needed.

Common mistakes

Supplementary — not from your PDF
  • Assuming 'delete' or a quick format removes data.
  • Overwriting SSDs as if they were HDDs. Use secure erase commands instead.

Practical skills

Supplementary — not from your PDF
  • Pick a sanitization or destruction method for a given media type and reuse plan.

What I should remember

Key Points PDF p.188
  • Circumstances for Data Destruction
    • Retention Period: End of data retention.
    • Compliance: GDPR, HIPAA.
    • Storage Optimization: Destroy obsolete data.
    • Decommissioning: Secure data destruction before disposal.
  • Methods for Data Destruction
    • HDDs: Data wiping, complex patterns.
    • SSDs: ATA Secure Erase.
  • Asset Disposal
    • Sanitization: Data wiping, degaussing, encryption.
    • Destruction: Physical (shredding, crushing), electronic (overwriting, degaussing).
    • Certification: Documentation and third-party verification.
  • Overwriting HDD Data
    • Zero Filling: Basic method.
    • Secure Methods: Multiple passes.
    • Time: Depends on number of passes.