Imagine if your company had a binder (or several binders) containing the entirety of its financial and sensitive records. That’s not something you would just throw in the trash because the information needs to be thoroughly destroyed.
The same is true for the sensitive electronic data that lingers on end-of-life IT equipment. Destroying this information takes more than just hitting the delete button. Data is tenacious and can remain hidden long after you thought it was gone for good. Steps must be taken, such as overwriting to hard drive destruction, to ensure that data disappears.
We live in a time when our every online action is tracked. It is our responsibility to make sure that information like bank details, health records, online shopping history, etc., remains private and secure. This is as true for companies as it is for individuals.
The National Association for Information Destruction (NAID) is an international trade association that sets and enforces best practices for data destruction. NAID certification is for organizations that follow strict data sanitization policies, such as NIST and DOD.
Also, many companies need to comply with local and federal regulations. Several industries have very specific data destruction privacy and security regulations, such as:
As noted above, improperly destroying the data on end-of-life IT assets can lead to fines and other costs due to data protection and privacy policies. In addition, it can also damage a company’s reputation if the theft of intellectual property or personal information occurs. Fortunately, there are options for fully secure data destruction.
Overwriting is a technique where new information, typically sequences of ones and zeros, is written directly on top of existing data. This can be done using random patterns or predetermined ones. The latter makes it possible to verify that data has been properly wiped by detecting the specific pattern.
For example, mender overwrites existing data on a device with a new image during a firmware update. This process can achieve a clean update and not affect the data on other partitions of the drive, if necessary.
Overwriting is a widely used secure data destruction method. However, it does present some challenges:
Degaussing uses a powerful magnetic field to physically disrupt delicate components of devices like hard drives, magnetic tapes, and floppy disks. The process provides a fast and comprehensive way to erase an entire storage medium in one go.
While degaussing can be a highly effective data destruction method, it does have some downsides. For example, degaussing only works on magnetic storage media. It does not affect non-magnetic devices like solid-state drives (SSDs) or optical discs (CDs/DVDs). Also, since degaussing makes the equipment completely unusable, it eliminates any resale potential and makes it impossible to confirm that all data has been destroyed. Finally, the efficiency of degaussing can depend on the data density of the drive. The process may not fully wipe high-density drives.
If IT equipment doesn’t need to be reused or resold, physically destroying it can make data unreadable and unusable. Destruction methods include shredding, drilling, crushing, and melting. Only pulverizing the drive into fine particles makes data recovery virtually impossible.
Since some destruction methods can leave portions of a drive intact, it is usually recommended that physical destruction is preceded by another data destruction method, such as overwriting. Also, the process of destroying IT equipment requires careful recordkeeping and auditing to ensure that every piece is properly managed.
At mender, we fully understand the importance of data destruction. If you need to ensure that the data on your end-of-life IT equipment is securely destroyed (and in an environmentally responsible manner), please reach out to mender and learn more about how our recycling and sustainability solutions can fit your needs.
