Data Destruction: Why you must ensure the secure and complete destruction of your data

Effective data security is essential, especially when you can no longer use storage media and decommission it. If the data is not destroyed, it can be extracted and then used to cause harm. For this reason, firms have to ensure that their data destruction methods are secure and complete.

The usual methods used to delete data don’t necessarily remove al traces of it. The information may still be extracted even from a device that has been physically damaged or reformatted. To truly remove the data, it must be done in such a way that it is unreadable. The level of data managed by organizations worldwide continues to increase at an exponential rate.

Data Destruction Methods: How does Data Destruction work?

When data is merely reformatted or deleted, space is freed up, allowing more data to be used. The files which have been deleted can be recovered until their spaces have been overwritten. When a reformat occurs, the partition or entire drive will be removed. Overwriting is simply the process of replacing aging data with data that is new and arbitrary.

The degaussing method is often used to make data unreadable and unrecoverable. In this method, magnetic storage such as floppy disks, hard drives, and magnetic tape will be exposed to an intense magnetic field with alternating amplitude. It will eradicate the device while completely erasing the data for good.

However, degaussing has two drawbacks. The first is that it cannot be used for newer SSDs (Solid State Drives), and the second is that degaussing cannot be verified. Since the drive will be ruined, the data deletion cannot be confirmed.

Data destruction is carried via three main methods: Overwriting, Degaussing, and Physical Destruction.

Overwriting

Overwriting is the process of writing new data on top of existing data. This is comparable to recording over an old VHS tape. Because this technique destroys the previous data and renders anything remaining illegible, this method of data destruction is also known as data wiping.

When data is overwritten, it is replaced by a pattern of 1’s and 0’s. While a random pattern is frequently employed, a predetermined pattern can also be utilized, which enables later verification of the drive’s wiping by detecting the predefined pattern.

In most cases, overwriting data once is sufficient. However, several wipes may be required for high-security applications, adding another layer of security to the process of erasing old data.

On the disadvantage, overwriting a full high-capacity disc takes a long time. This method may be incapable of sanitizing data stored in inaccessible places, such as host-protected areas. Overwriting may require a separate licence for each hard drive.

RELATED: Size vs Size on Disk – Why is there a difference?

The process is useless in the absence of robust quality assurance processes. Additionally, overwriting works only if the storage media is undamaged and still writable.

Degaussing

Degaussing is a technique that uses a powerful magnet to distort the magnetic field of the storage medium, thereby erasing the data. When used to magnetic storage media such as hard discs, magnetic tape, or floppy discs, degaussing can efficiently cleanse an entire medium.

While degaussing is an efficient form of data erasure, it does have two significant drawbacks.

• Firstly, degaussing renders the hard drive useless by physically damaging the drive’s complex, interrelated mechanisms, effectively eradicating any end-of-life value.
• Secondly, there is no way to guarantee that all data is deleted completely. Because degaussing renders a disc useless, there is no way to verify that the data has been deleted.

Degaussing effectiveness can also be affected by the density of drives. Finally, it’s worth noting that degaussing does not remove data from non-magnetic media such as Solid State Devices and Compact Discs.

Physical destruction

If you are not required to reuse hard drives, physical destruction may be an alternative for data removal. Organizations can delete data physically in various methods, including shredding, drilling, melting, or any other procedure that renders physical storage media unusable or unreadable.

Physical destruction might present difficulties. To begin, it is highly susceptible to human error and manipulation. There is no method to audit the physical destruction process credibly. Second, most physical destruction methods preserve a significant percentage of the drive platter, even if the drive is useless.

In such circumstances, data can still be recovered using forensic techniques. Only crushing the disc to dust ensures that the data is permanently lost. Finally, because physical destruction renders media illegible, it precludes their wiping and remarketing. This effectively eliminates the possibility of recovering whatever end-of-life value that these assets may have.

The Benefits of Proper Data Destruction

Failure to properly destroy the data stored in end-of-life IT assets can lead to severe data protection and privacy policies breaches.

Your Reputation will be maintained

More than 70% of companies that sustain a significant data breach are forced to close their doors within 2 years. Many of these enterprises are small to medium-sized firms that cannot afford the severe litigation and loss of confidence that their data is compromised.

While large corporations are better positioned to absorb the shock and financial impact of data breaches, they too must maintain effective data elimination procedures.

It takes years of sacrifice and hard work to build a successful business, which is why losing it all due to a data breach is so debilitating. Companies of all sizes must take data security seriously, as the future of their organization depends on it.

Greater cost savings

In physical office space, companies need to use each square inch to generate the largest possible revenue. For this reason, many firms are switching to cloud storage, as it frees up a substantial amount of physical space and reduces dependence on physical hard drives.

This saves companies much money, but the data held in the cloud has to be maintained in compliance with various regulations.

Eco-friendly

The amount of digital data generated on a global scale is genuinely staggering; experts estimate that about 5.2 terabytes worth of data has been created for every human being currently living. The IoT (Internet of Things) will increase this amount further as more people worldwide close the digital divide.

However, securing data becomes ever more critical for enterprises and the environment itself. When data is properly secured and disposed of when it is no longer needed, it can alleviate the damage caused by pollution. Many organizations are developing new ways to recycle hardware and electronics to be reused in newer devices.

The need for a Data Elimination Policy

Since data has proliferated in almost every digital media, legislation has been enacted in many countries to secure customers’ data. Institutions that fail to destroy data adequately might violate FACTA (Fair Accurate Credit Transactions Act), the Health Insurance Portability and Accountability Act (HIPAA), and the Gramm-Leach-Bliley Act (GLBA). Violating any of these can result in heavy fines or litigation.

RELATED: Top Technology Compliance Mistakes Businesses must Avoid

The data elimination policy should be enacted by an individual who is familiar with digital asset decommission.

If you decide to outsource the work to an ITAD, or Information Technology Asset Disposition, it is essential to vet the persons who will participate in the custody chain. Details that should be included in your data elimination policy are:

• Complete logging for the whole decommissioning process
• A thorough backup of data that has been stored
• Degaussing any magnetic data
• Maintain an extensive inventory for IT assets
• A procedure for disconnecting devices including firewalls and subnets
• The complete wiping of solid-state data
• Physical eradication of storage mediums
• Records of what has been destroyed
• Specific cloud-based data destruction procedures

The Destruction of Data Must Always Be Verified

Knowing the regulations which are specific to your geographical area is very important. Many of these policies involve the management of classified data. If it is not thoroughly destroyed and verified, the consequences can be severe.

Data sanitization is when data is totally destroyed and verified to ensure it can’t be tampered with. Industries that are heavily regulated mandate sanitization. The task can only be undertaken by experts who have years of experience.

Best Practices For Data Destruction

If you fail to destroy the data on your end-of-life IT assets appropriately, you may violate data protection and privacy policy legislation.

• Guarantee destruction accountability through the usage of certification – These forms must be signed by each individual tasked with carrying out the destruction and should contain detailed information on how this elimination occurred.
• Non-electronic records must also be included – The procedures used to eliminate electronic data must also be applied to traditional paper records where applicable. These documents should be destroyed and then disposed of when unauthorized parties cannot exploit them. Methods of achieving this include incineration, cross-cut style shredders and pulverizers.
• Data sensitivity should determine the destruction method – Certain types of sensitive data might need to be eradicated in a particular way. If so, this should be specified in the documented agreement.
• Permanently destroy data in an irrecoverable manner – Standard data removal techniques are not adequate. This is because when files are deleted in the usual way, only their file references are removed. The true file data stays in the disk and remains recoverable until it has been completely overwritten.
• Draft formal and documented procedures – Every organization should do this to eliminate data and insist on their partners doing the same thing.
• Report inadequate storage media sanitization – Research shows that data breaches often come from the storage mediums being returned to manufacturers for replacement or servicing. If it is determined that data has not been correctly eliminated, take the proper steps to correct it as soon as possible.

Next Steps

The optimum technique of data destruction is determined by the type of medium, the sensitivity of the data, and the asset’s end-of-life value. Many businesses try to destroy data in-house. That is not a normal use of internal time and resources.

Most IT asset disposition companies have the ability and scale to accomplish data destruction at a substantially lower cost.