For your most sensitive data, seek verification of absolute data destruction and beware of methods that don’t fulfill data sanitization requirements.
How can I know my business data has been completely erased and is irrecoverable even with the most sophisticated methods? We get questions along those lines quite often and our answer goes something like this: absolute data destruction includes more than the secure erasure of data. The solution must also verify its successful completion and produce an auditable, tamper-proof certificate of destruction to prove compliance with global regulations.
In this piece, we’ll quickly outline:
- Why absolute data destruction — and verification — is so crucial
- Methods that do not achieve proper data sanitization
- The components of certified data erasure
Why absolute data destruction — and verification — is so crucial
The significance of absolute data destruction is something no organization can ignore. Gartner, the research and advisory company, argues that data sanitization should be a core C-level requirement for IT organizations.
A host of factors have pushed the issue to the forefront of lifecycle asset management. Those factors include, for example, regulatory compliance, concerns about data privacy and security, and the ever-expanding capacity of storage media. The rapidly growing market for IT asset disposition (ITAD) has, at the same time, attracted a range of new players. Those players may say they have the necessary expertise but lack the certifications to back it up. Claiming a device has been sanitized does not make it a fact. Can skilled individuals find usable residual data? Can they recover the data using advanced forensic tools?
What the industry authorities say
To distinguish between empty claims and a job done right, you need certified results. And we’re not alone in saying that. Listen to these three industry authorities:
- Gartner advises organizations to require their ITAD partner to provide a certificate of data destruction. The certificate should include a serialized inventory of the data-bearing assets sanitized. In addition, Gartner says ITAD contracts should give you the right to audit the data sanitization processes/standards to ensure compliance with your security and industry standards, like NIST 800-88.
- Speaking of NIST 800-88: A central feature of the globally recognized data sanitization guidelines by the U.S. National Institute of Standards and Technology is the recommendation to verify and certify results when sanitizing data storage assets.
- The International Data Sanitization Consortium (IDSC) maintains all three primary means of data sanitization (physical destruction, cryptographic erasure, data erasure) should include an attestation documenting results.
Proper data sanitization protects your company from potential public relationships disasters and stiff fines for regulatory violations. The environment and your bottom line also benefit when you achieve greater sustainability and greater value from extending the life of your data storage assets. (For more on how the choice of data sanitization method affects IT asset recovery, read this post.)
Methods that do not achieve proper data sanitization
Data deletion equals absolute data destruction, right? Well, the answer is actually no. The multitude of terms used to describe the process of removing data from a storage device can be confusing. They may sound like they would fulfill the requirements for proper data sanitization although they really don’t. But data sanitization — the process of deliberately, permanently and irreversibly removing or destroying the data stored on a memory device to make it unrecoverable — does not include the following methods:
- File shredding: This method is often equated with data erasure. But file shredding is not an approved method for data sanitization because of the lack of verification. The destruction of data on individual files and folders by overwriting the space with a random pattern is not enough. (Note: File shredding should not be confused with shredding by physical destruction which is an approved sanitization method. Includes shredding hard drives, smartphones, printers, laptops and other storage media into tiny pieces by large mechanical shredders or by degaussing).
- Data deletion: Despite its definitive sound, deletion leaves data recoverable since the method only hides data on the storage device.
- Reformatting: Reformatted disk drives are no match for anyone with free or paid forensic tools. The data is, after all, still there.
- Factory Reset: Providing the data is not rooted, a factory reset removes all user data and restores a device back to factory settings, primarily on mobile devices, tablets, and IoT technology. The method still results in incomplete data sanitization, according to IDSC.
The components of certified data erasure
Whether you need it for added peace of mind or because regulations demand it, a tamper-proof certificate is your final verification of absolute data destruction in compliance with NIST 800-88.
At GER, we authenticate data destruction through the issuance of data destruction reports and certificates, including an end-of-use certificate, DLA Form 1822, a Certificate of Destruction (COD), and a Certificate of Sanitization (COS) that capture and list serial numbers of sanitized drives.
For your most sensitive data, opt for witnessed destruction, which includes sealed and monitored transportation, witnessed delivery verification, and witnessed destruction by shearing, shredding, or pulverizing. If on the other hand, you seek to recoup value in secondary markets, software-based data sanitization will leave your assets in good condition for resale.
Regardless of your choice, attestation and accountability should be top priorities of your ITAD partner.
Read more:
