drilling down on data destruction

DRILLING DOWN
ON DATA DESTRUCTION:
Considerations for Secure Disposition
of Data Bearing Assets
P : 888-676-4992
E : [email protected]
Head Office
94 Fenmar Drive
Toronto, ON, M9L 1M5
Collection Facility
33B Capital Drive
Nepean, ON, K2G 0E7
www.revrecycling.com
Destruction Centre
2 Paget Road
Brampton, ON, L6T 5G3
Drilling Down on Data Destruction:
Considerations for Secure Disposition of Data Bearing Assets
A couple of generations ago, a mention of data destruction might conjure images of office workers
feeding documents into shredding machines. With the advent of the personal computer, Internet and big
data, things have become a little more complex. Today, data destruction refers to destroying magnetic
and optical media, including disks, tapes, and flash media such that the information cannot be read,
accessed or used. In this white paper, we’ll discuss the factors to consider when you need to dispose of
your data bearing devices, and the various means at your disposal. As we shall see, simple deletion is
not a reliable means of data destruction.
Considerations
When you or your corporation mark data for destruction, you face the challenge of guaranteeing that
the data is irretrievable by any reasonable means. You also must take into consideration whether the
media and devices holding the data are to be destroyed or reused. In Canada, the principal destruction
standard is ITSG-06, which covers the various levels and methods of data destruction.
Digital Destruction
vs. Physical Destruction
Onsite or Offsite and Chain
of Custody
There are two main categories of data destruction.
Depending on a company’s level of risk and
In the first, the devices and media will be reused to
sensitivity of information, they will need to
store fresh data. In the second type, the devices
choose between an onsite service or an offsite
and media will not be re-used, and therefore can
service. Onsite services offer a higher level of
be subjected to physical destruction.
security but cost more. Offsite services, add the
Certifications
Whichever method chosen, a client should ensure
element of transportation of in-tact devices and
thus a potential risk during transportation.
that the service provider agrees to provide a
Recycling vs. Disposal
Certificate of Destruction with the serial number
When dealing with physical destruction, you may
of each device. There are many companies that
have an added option of end of life disposal.
will agree to provide data destruction services
Depending on the type of media being destroyed,
with the means to prove the service was done
there may not be a true recycling option and
properly. Nowadays, a well-managed company
incineration or landfill may be the only choice.
would be remiss to engage a service provider
that does not have certain certifications such as
R2 and/or NAID AAA. These certifications ensure
that the data destruction service provider has the
correct systems and insurance in place to fulfil
their promises of data destruction.
Legal Requirements
Depending on your industry, there may be certain
legal requirements to ensure the data contained
on the devices you dispose of are properly
destroyed with evidence. This is certainly true
for the health care, government and financial
sectors.
© Revolution 2016 | www.revrecycling.com
Drilling Down on Data Destruction:
Considerations for Secure Disposition of Data Bearing Assets
Digital Destruction
You may want to destroy data without destroying the media or devices holding the data. If you own
the devices, especially expensive storage racks and other large units, you probably want to retain your
investment and leave the devices intact. If you use leased assets, either onsite or remotely, you have
no choice — you cannot destroy the equipment and must rely on clearing and sanitizing the data on the
devices.
Some users mistakenly assume that a simple file deletion will make data unavailable. In truth, deletion
only marks data storage blocks as available for reuse – it does not physically destroy the data. Until
and unless the data storage blocks are overwritten with new information, the old data still exists and is
fairly easy to retrieve.
Sanitization
At the very least, data must be overwritten to the extent that it
cannot be retrieved. This process is commonly called “sanitization.”
In Canada, data overwriting standards call for three passes. In the
first, the data is overwritten with binary zeros, followed by second
pass that writes out binary ones. The third pass writes an ASCII bit
pattern containing zeros and ones. Specialized software is available
to perform the overwriting sequence and then verify that all data
has been destroyed. For confidential or classified information, this
method on its own might be insufficient, and must be combined with
other methods to guarantee total data destruction.
Benefits of sanitization: Maximizes the reuse value of the asset.
Drawbacks of sanitization: Might not meet all corporate disposition policies.
Degaussing
Degaussing may be used on its own or in combination with overwriting.
Degaussing is the process of applying a strong magnetic force to the
media or devices such that all data is erased. Once a media device
is degaussed it cannot be reused. The effectiveness of this method
depends on the strength of the degaussing device’s magnetic field
and the magnetic retention properties of the storage media or device.
Media are rated according to a property called “coercivity,” a measure of
magnetic retentivity. For degaussing to be effective, you must ensure
that the degaussing device is rated for the storage media’s coercivity.
© Revolution 2016 | www.revrecycling.com
Drilling Down on Data Destruction:
Considerations for Secure Disposition of Data Bearing Assets
Benefits of degaussing: Relatively straightforward process that doesn’t require much technical knowhow.
Drawback of degaussing: No way of knowing if the wipe was successful short of reinstalling
and powering on the media device. Destroys any reuse potential.
Physical Destruction
In situations that dictate that the devices and media holding data are to be destroyed, various physical
methods can be applied to help ensure that the stored data is irretrievable.
Shredding
In this method, hard drives are fed into machines that shred
the devices into small pieces of uniform shape and size. The
shredder reduces the media or hard drive into pieces as small
as ¾ inches. As a further measure, the shreds from multiple
sources can be mixed together to help prevent any possible
reconstruction. A disintegrator can be used on a variety of
devices, and involves making non-uniform cuts with enclosed
rotating blades. The disintegrator may be equipped with a
screen to capture larger pieces for re-shredding.
Physical Deformation
In this method, a hard disk drive, CDs, tapes and devices are physically damaged using crushing
appliances. A good example is a specialized pneumatic press that twists and punches the platters of
a hard disk drive. The crushing device must inflict sufficient damage such that each platter surface is
warped or shattered beyond use. This method is quick and suitable for the destruction of large amounts
of data.
Benefits of physical destruction: Provides visual confirmation that the media device has been destroyed.
Drawbacks of physical destruction: Eliminates any reuse potential.
© Revolution 2016 | www.revrecycling.com
Drilling Down on Data Destruction:
Considerations for Secure Disposition of Data Bearing Assets
Conclusion
Your company’s data may be sensitive, personal, valuable and confidential. Whatever the case, there are
methods available that make it virtually impossible to access or retrieve your data. Depending on your
needs, media can be sanitized and made ready for reuse, or more destructive methods can be applied.
Your method of choice depends on the nature of the data, the media, the device, whether you want to
reuse the equipment, your corporate governance policies and your time and budget requirements.
Revolution Recycling is one of the few companies in Canada that can apply many of the methods
described above depending on your needs. We do so efficiently and cost-effectively. Contact us today
for a customized quote.
© Revolution 2016 | www.revrecycling.com