Decommissioning and Disposal

One thing we want to be concerned about is asset disposal. How do we decommission or deprovision an asset when we're done with it? It's a critical part of security.

One thing a hacker will do is buy used equipment, and then what they'll do is they'll go onto the hard drive and see what information they can grab off of that hard drive on that machine. In fact, that's actually a really easy process to do, at least the ones that were unencrypted. We're encrypting more and more hard drives now, but even with that we want to make sure we're doing this in a very secure manner, so we need to go through a proper disposal so we make sure that no information is left on these machines.

The biggest issue with this is just the data on devices when we get rid of it. Imagine if we had a firewall or a switch or some network device that had all of our secure information on it and we got rid of it, and then that got into the wrong hands. They may know how to hack our network now. Or maybe it's sensitive customer data that was on a laptop that now is in the wrong hands. So what we need to do is, when we dispose of a device, do it securely. We could do two different things: we could either sanitize it or do destruction.

Allocation Tables and Deleted Data

A lot of storage systems work off of allocation tables. What allocation tables are is a way to find data on a disk. A disk is broken down into clusters, and if you save a file, that file, let's say file one, might be stored across many different clusters. Then within the file allocation table it'll create a record of where file one is stored, and a pointer to where all of file one is stored at.

What happens is when you delete data from a disk, what it will do is it will delete it in the allocation table, but it doesn't necessarily delete it from the disk itself. All we need to do is have software go and discover this file, and now we can recover that file. It's a very easy process to do, and this is why we need to destruct our data in a very secure manner.

Sanitizing Magnetic Media

Here's an example of magnetic media. I don't want to get too in depth into this, but essentially what we're doing is we're saving ones and zeros using a magnetic pole, and depending on which direction that magnetic pole is going it'll be either a one or a zero. That's how our things are saved.

Now even if we go and overwrite this with other data, so maybe we write over it with a series of zeros and ones, so 0 1 0 1 0 1, what happens is that for the most part we've got a pretty secure method of erasing this data, but there could be minute traces of this data left, like a residue, this little bit of amount that's left with it. So what we actually do is we take multiple passes. We go across it, and even if we did zeros and ones the first time, maybe we do ones and zeros the second time, and we do several passes across here until we are guaranteed, or almost 100% guaranteed, that this data really can't be retrieved after that. So this is the sanitation process, and we'll do multiple wipes of these ones and zeros, writing it to the disk in order to wipe the data and make sure it's completely secure before we dispose of the device.

When it comes to magnetic media, this is what that device looks like. There's a little arm that goes and finds this data on this disk, and this disk spins around. But this actually takes a while to do, to erase the data on here, to put all those ones and zeros. There are other, faster ways of doing this. A different way to do this is to use a much bigger magnet, a big huge magnet that throws these polarities back and forth multiple times to really degauss, or erase, all of these ones and zeros on this disk right here. So that would be another way of doing that.

Physical Destruction

Another way that we could do this is we could actually physically destroy this device so you couldn't read from it. Maybe I take a hammer and I smash it with a hammer, or maybe I take a drill and try to drill it. But I can tell you that this also takes a while to do. This is really hard material on here, and to drill through this takes a while to do.

To physically destroy this, they also have specific shredders that will shred these devices. You can stick it in there and it'll shred it just like a paper shredder, and shred it into a bunch of little components so that way you couldn't read the data off of it.

Now this could take me a while to be able to destroy this hard drive. To write ones and zeros could take a little while. If I use a degausser, I have to have the degausser. If I'm going to shred it, I have to have the shredder. So I might have to have special equipment in those cases. There are ways that I can erase this myself, but a lot of them take a long time.

Using a Third Party

Maybe it takes me a couple of minutes to destroy this with a hammer, but imagine if I had a whole bank of hard drives I had to do that on. Maybe I'm decommissioning a network attached storage or a SAN and I had hundreds of these drives that I had to decommission. That could be very time intensive.

So there are third parties that have these giant shredders, or have some sort of degausser, or have some official way of deleting the data on these devices. What I could do is I could hire them. They might pull up in some sort of vehicle, or I might put it in some sort of special container, and then they would take it away and then dispose of this drive properly.

And then if I wanted to, I could also ask for a special certificate. They'll actually give me a certificate saying yes, they have officially deleted this data. Then if my customers ever asked what was my way of deleting this data, or officially making sure that I disposed of it properly, I have this certificate that this vendor has given me showing that I have properly disposed of that data.

Check Retention Requirements First

Now one thing we should be concerned with before we destroy this data is to make sure that we aren't required to keep a copy of it. Most customers and most laws and regulations are going to require you that when you're done with the data you have to dispose of it, and you have to dispose of it properly. However, there are some cases where it requires you to keep the data. Maybe you're going through some sort of lawsuit and there's some sort of data that you must keep, or there are certain records you have to keep for a certain period of time. So make sure before you destruct that data that you understand if there is any need for retaining any of that data.