DRILLING DOWN ON DATA DESTRUCTION: Considerations for Secure Disposition of Data Bearing Assets P : 888-676-4992 E : [email protected] Head Office 94 Fenmar Drive Toronto, ON, M9L 1M5 Collection Facility 33B Capital Drive Nepean, ON, K2G 0E7 www.revrecycling.com Destruction Centre 2 Paget Road Brampton, ON, L6T 5G3 Drilling Down on Data Destruction: Considerations for Secure Disposition of Data Bearing Assets A couple of generations ago, a mention of data destruction might conjure images of office workers feeding documents into shredding machines. With the advent of the personal computer, Internet and big data, things have become a little more complex. Today, data destruction refers to destroying magnetic and optical media, including disks, tapes, and flash media such that the information cannot be read, accessed or used. In this white paper, we’ll discuss the factors to consider when you need to dispose of your data bearing devices, and the various means at your disposal. As we shall see, simple deletion is not a reliable means of data destruction. Considerations When you or your corporation mark data for destruction, you face the challenge of guaranteeing that the data is irretrievable by any reasonable means. You also must take into consideration whether the media and devices holding the data are to be destroyed or reused. In Canada, the principal destruction standard is ITSG-06, which covers the various levels and methods of data destruction. Digital Destruction vs. Physical Destruction Onsite or Offsite and Chain of Custody There are two main categories of data destruction. Depending on a company’s level of risk and In the first, the devices and media will be reused to sensitivity of information, they will need to store fresh data. In the second type, the devices choose between an onsite service or an offsite and media will not be re-used, and therefore can service. Onsite services offer a higher level of be subjected to physical destruction. security but cost more. Offsite services, add the Certifications Whichever method chosen, a client should ensure element of transportation of in-tact devices and thus a potential risk during transportation. that the service provider agrees to provide a Recycling vs. Disposal Certificate of Destruction with the serial number When dealing with physical destruction, you may of each device. There are many companies that have an added option of end of life disposal. will agree to provide data destruction services Depending on the type of media being destroyed, with the means to prove the service was done there may not be a true recycling option and properly. Nowadays, a well-managed company incineration or landfill may be the only choice. would be remiss to engage a service provider that does not have certain certifications such as R2 and/or NAID AAA. These certifications ensure that the data destruction service provider has the correct systems and insurance in place to fulfil their promises of data destruction. Legal Requirements Depending on your industry, there may be certain legal requirements to ensure the data contained on the devices you dispose of are properly destroyed with evidence. This is certainly true for the health care, government and financial sectors. © Revolution 2016 | www.revrecycling.com Drilling Down on Data Destruction: Considerations for Secure Disposition of Data Bearing Assets Digital Destruction You may want to destroy data without destroying the media or devices holding the data. If you own the devices, especially expensive storage racks and other large units, you probably want to retain your investment and leave the devices intact. If you use leased assets, either onsite or remotely, you have no choice — you cannot destroy the equipment and must rely on clearing and sanitizing the data on the devices. Some users mistakenly assume that a simple file deletion will make data unavailable. In truth, deletion only marks data storage blocks as available for reuse – it does not physically destroy the data. Until and unless the data storage blocks are overwritten with new information, the old data still exists and is fairly easy to retrieve. Sanitization At the very least, data must be overwritten to the extent that it cannot be retrieved. This process is commonly called “sanitization.” In Canada, data overwriting standards call for three passes. In the first, the data is overwritten with binary zeros, followed by second pass that writes out binary ones. The third pass writes an ASCII bit pattern containing zeros and ones. Specialized software is available to perform the overwriting sequence and then verify that all data has been destroyed. For confidential or classified information, this method on its own might be insufficient, and must be combined with other methods to guarantee total data destruction. Benefits of sanitization: Maximizes the reuse value of the asset. Drawbacks of sanitization: Might not meet all corporate disposition policies. Degaussing Degaussing may be used on its own or in combination with overwriting. Degaussing is the process of applying a strong magnetic force to the media or devices such that all data is erased. Once a media device is degaussed it cannot be reused. The effectiveness of this method depends on the strength of the degaussing device’s magnetic field and the magnetic retention properties of the storage media or device. Media are rated according to a property called “coercivity,” a measure of magnetic retentivity. For degaussing to be effective, you must ensure that the degaussing device is rated for the storage media’s coercivity. © Revolution 2016 | www.revrecycling.com Drilling Down on Data Destruction: Considerations for Secure Disposition of Data Bearing Assets Benefits of degaussing: Relatively straightforward process that doesn’t require much technical knowhow. Drawback of degaussing: No way of knowing if the wipe was successful short of reinstalling and powering on the media device. Destroys any reuse potential. Physical Destruction In situations that dictate that the devices and media holding data are to be destroyed, various physical methods can be applied to help ensure that the stored data is irretrievable. Shredding In this method, hard drives are fed into machines that shred the devices into small pieces of uniform shape and size. The shredder reduces the media or hard drive into pieces as small as ¾ inches. As a further measure, the shreds from multiple sources can be mixed together to help prevent any possible reconstruction. A disintegrator can be used on a variety of devices, and involves making non-uniform cuts with enclosed rotating blades. The disintegrator may be equipped with a screen to capture larger pieces for re-shredding. Physical Deformation In this method, a hard disk drive, CDs, tapes and devices are physically damaged using crushing appliances. A good example is a specialized pneumatic press that twists and punches the platters of a hard disk drive. The crushing device must inflict sufficient damage such that each platter surface is warped or shattered beyond use. This method is quick and suitable for the destruction of large amounts of data. Benefits of physical destruction: Provides visual confirmation that the media device has been destroyed. Drawbacks of physical destruction: Eliminates any reuse potential. © Revolution 2016 | www.revrecycling.com Drilling Down on Data Destruction: Considerations for Secure Disposition of Data Bearing Assets Conclusion Your company’s data may be sensitive, personal, valuable and confidential. Whatever the case, there are methods available that make it virtually impossible to access or retrieve your data. Depending on your needs, media can be sanitized and made ready for reuse, or more destructive methods can be applied. Your method of choice depends on the nature of the data, the media, the device, whether you want to reuse the equipment, your corporate governance policies and your time and budget requirements. Revolution Recycling is one of the few companies in Canada that can apply many of the methods described above depending on your needs. We do so efficiently and cost-effectively. Contact us today for a customized quote. © Revolution 2016 | www.revrecycling.com
© Copyright 2026 Paperzz