Andy Crawford
acrawford@destructdata.com
DATA SECURITY
END OF LIFE
3/22/2016
Florida Gulf Coast ARMA Chapter
1
263,470,869
3/22/2016
Florida Gulf Coast ARMA Chapter
2
Protecting Data
Before, During and After
3/22/2016
Florida Gulf Coast ARMA Chapter
3
Where is End of Life Data Contained?
• Electronic Media Types and Forms
– Optical Discs (CD / DVD)
– Hard Disc Drives (HDD)
– Magnetic Tape
– Floppy Discs
– Flash Memory
3/22/2016
Florida Gulf Coast ARMA Chapter
4
How much is a Megabyte?
• 8 bits equals 1 Byte
•1024 bytes equal 1 Kilobytes.
•1024 Kilobytes equals 1 Megabyte.
• 1024 Megabytes equals 1 Gigabytes.
• 1024 Gigabytes equals 1 Terabyte.
3/22/2016
Florida Gulf Coast ARMA Chapter
5
CD’s and DVD’s
• CD-ROMs are capable of holding up to 300,000 pages of data
on a single disc. (870 MB)
• 5,000 sheets of paper equals 1 box of paper.
• This equates to 60 Boxes of Data
• DVD’s are capable of holding up to 2,000,000 pages of data
on a single disc. (4.7 GB)
• 40 Cartons equals 1 pallet of paper.
• This equates to 10 pallets of paper.
• Half a Semi-Trailer full of information.
3/22/2016
Florida Gulf Coast ARMA Chapter
6
Hard Disc Drives
• Range in size and new technology has made it
possible to have a 3,000 GB Hard Disc Drive.
• 60 GB Hard Drive is pretty typical.
• 60 GB equals over 25 million pieces of paper.
– 1 Truck equals 800 cartons of paper.
• This equates to 6.4 Semi-Trucks full of paper.
3/22/2016
Florida Gulf Coast ARMA Chapter
7
Magnetic Tape
• In 2007 IBM and Fujifilm were close to
releasing an 8 Terabyte Magnetic Tape Reel.
– This Equates to over 3.4 billion sheets of paper.
– 870 Semi Trucks full of data.
3/22/2016
Florida Gulf Coast ARMA Chapter
8
Floppy Discs
• Could hold up to 1 Megabyte of information.
– Not used much anymore.
– 1 Floppy Disc would hold up to 415 pages of
information.
– Less than one Ream of paper.
• 1 Ream equals 500 sheets of paper.
3/22/2016
Florida Gulf Coast ARMA Chapter
9
Flash Drives
• Sizes range from 512,000 MB to 4 GB.
– A 4 GB Flash Drive is capable of holding up to
1,700,000 sheets of information.
– This equates to 340 boxes of paper.
3/22/2016
Florida Gulf Coast ARMA Chapter
10
Economic Impact
•
Economic Impact in 2008
– $6.65 Million
– $202 per record lost
• Increased by $64 per person since 2005
• 40% Increase
– Customer Churn
• Health Care
– 6.5%
• Financial
– 5.5%
•
Consumers
– $6,400.00
– 40 Hours
• Highs of 200 Hours.
3/22/2016
Florida Gulf Coast ARMA Chapter
11
Regulatory Drivers – Penalty Matrix
Gramm Leach
Bliley
Financial Service
Modernization Act
Directors and
Officers (per
Sarbanes Oxley
FACTA
HIPAA
Public Company
Accounting Reform &
Investor Protection Act
Fair & Accurate Credit
Transaction Act
Health Insurance
Portability
Accountability Act
$10,000
$1 Million
$100,000
$5 Million
5-12
20
$50,000
violation)
Institution
(per violation)
Years in Prison
FDIC Insurance
Impact on
Operations
3/22/2016
$11,000
$250,000
1-10
Terminated
Cease and
Desist
Florida Gulf Coast ARMA Chapter
12
Most People’s Idea
3/22/2016
Florida Gulf Coast ARMA Chapter
13
Data Security Life Cycle
Data
Origin
Data at
EOL
Data in
Use
3/22/2016
Data at
Rest
Data in
Motion
Florida Gulf Coast ARMA Chapter
14
Show me the money
Billions of dollars spent protecting
data in the first 4 stages
•
•
•
•
•
Firewalls
Login Passwords
Encryption
Special screens
and more…
3/22/2016
Florida Gulf Coast ARMA Chapter
15
End of Life
• No figures on end of life
– Significantly less
• Money
• Effort
• Tuesdays and Thursdays
– Pull hard drive
– Place in burn bag
– Hand to driver
3/22/2016
Florida Gulf Coast ARMA Chapter
16
Where do they all go?
For every 10 Hard Drives that enter the market…
New Hard Drives Shipped vs. Retired Units
Entering Secondary Markets
Millions of Units Shipped
600
500
Units Shipped
400
300
Units Retired
200
100
0
2002
2003
2004
2005
2006
2007
Years
….7 Hard Drives are taken out of the market.
3/22/2016
Florida Gulf Coast ARMA Chapter
17
End of Life Myths
• Hard Drives
–
–
–
–
3/22/2016
Deleting Files
Reformatting
Reinstalling Operating System
Software Overwriting?
Florida Gulf Coast ARMA Chapter
18
DoD 5220
• Software Overwriting
–
–
–
–
–
DoD Wipe
3 Pass
7 Pass
Guttman
Free
• What is it missing?
– HPA
– DCO
– G-List
3/22/2016
Florida Gulf Coast ARMA Chapter
19
Degaussing and Secure Erase
• Degaussing
–
–
–
–
How does it work?
eWaste
Verification
Audit Trail
• Secure Erase
–
–
–
–
3/22/2016
What is it?
Who Invented it
Verification
Audit Trail
Florida Gulf Coast ARMA Chapter
20
CD-Rom DVD Destruction
3/22/2016
Florida Gulf Coast ARMA Chapter
21
Digital Data Destruction
Thermal-Nuclear
Launch Codes
Value Of Data
Cost to
Reconstruct
High
High
Patient
Records
Friend’s
Tel #
Low
Low
1
2
3
4
5
Level of Tier Destruction
22
Setting Policy
• DoD 5220
– National Security Information Program
– NISPOM 5220
– January 1995
• 3 Pass
– February 2006
•
•
•
•
Left up to CSA
DoD
CIA
NSA
This Manual cancels DoD 5220.22-S-1,
“COMSEC Supplement to the Industrial
Security Manual for Safeguarding Classified
Information,” August 1983.
3/22/2016
Florida Gulf Coast ARMA Chapter
23
NIST 800-88
• Covers all types of media
• Good source for
information
– Commercial
– Government
• Clear
– Single pass
– All addressable sectors
• Purge
– Degauss
– FW Based solution (Secure Erase)
• Physical Destruction
– Shred, Pulverize
3/22/2016
Florida Gulf Coast ARMA Chapter
24
NIST 800-88
Methods
3/22/2016
How
Florida Gulf Coast ARMA Chapter
25
“Best Safe Practices”
Digital Data Destruction – Hard Disc Drives
•
Recommendations & Guidelines from NIST on Hard Drive Destruction
– HDD- Media NIST SP-800-88 September 2006
ATA/SATA/SCSI
DriHDD- Media NIST
SP-800-88 September
2006
ves
3/22/2016
Overwrite media by using
agency-approved and validated
overwriting
technologies/methods/tools.
(ATA Drives) Purge using Secure Erase. The Secure
Erase software can be download from the University
of California, San Diego (UCSD) CMRR site.
Purge hard disk drives by either purging the hard disk
drive in an NSA/CSS-approved automatic degausser or
by disassembling the hard disk drive and purging the
enclosed platters with an NSA/CSS-approved
degaussing wand.
***Degaussing any current generation hard disk will
render the drive permanently unusable.
Florida Gulf Coast ARMA Chapter
􀂃 Disintegrate.
􀂃 Shred.
􀂃 Pulverize.
􀂃 Incinerate.
Incinerate hard disk
drives by burning
the hard disk drives
in a licensed
incinerator.
26
“Best Safe Practices”
Digital Data Destruction – CD / DVD Discs
•
Recommendations & Guidelines from NIST on Optical Media Destruction
– HDD- Media NIST SP-800-88 September 2006
Optical Disks – CD/DVD Media NIST SP-800-88 September 2006
See Physical
Destruction
See
Physical
Destruction
3/22/2016
Destroy in order of recommendations:
1.􀂃
Removing the Information bearing layers of CD media using a commercial optical disk grinding device.
2.􀂃
Incinerate optical disk media (reduce to ash) using a licensed facility.
3.􀂃
Use optical disk media shredders or disintegrator devices to reduce to particles that have a nominal edge dimensions
of five millimeters (5 mm) and surface area of twenty-five square millimeters (25 mm2). **
** This is a current acceptable particle size. Any future disk media shredders
obtained should reduce CD to surface area of .25mm².
Florida Gulf Coast ARMA Chapter
27
“Best Safe Practices”
Digital Data Destruction – Magnetic Tapes
•
Recommendations and & Guidelines from NIST on Tape Destruction
– HDD- Media NIST SP-800-88 September 2006
Magnetic Tapes –NIST 800-88 September 2006
Clear magnetic tapes by either re-recording
(overwriting) or degaussing. Clearing a
magnetic tape by re-recording (overwriting)
may be impractical for most applications
since the process occupies the tape
transport for excessive time periods.
Clearing by Overwriting: Overwriting should
be performed on a system similar to the one
that originally recorded the data. For
example, overwrite previously recorded
classified or sensitive VHS format video
signals on a comparable VHS format
recorder. All portions of the magnetic tape
should be overwritten one time with known
non-sensitive signals.
3/22/2016
Degauss using an NSA/CSS-approved
degausser.
Purging by Degaussing: Purge the magnetic
tape in any degausser that can purge the
signal enough to prohibit playback of the
previous known signal. Purging by
degaussing can be accomplished easier by
using an NSA/CSS-approved degausser for
the magnetic tape.
Florida Gulf Coast ARMA Chapter
􀂃 Incinerate by burning the tapes in a
licensed incinerator.
􀂃 Shred.
Preparatory steps, such as removing the
tape from the reel or cassette prior to
destruction, are unnecessary. However,
segregation of components (tape and reels
or cassettes) may be necessary to comply
with the requirements of a destruction
facility or for recycling measures.
28
“Best Safe Practices”
Digital Data Destruction – Flash Drives
•
Recommendations and & Guidelines from NIST on Flash Destruction:
– HDD- Media NIST SP-800-88 September 2006
Flash Memory-NIST SP 800-88 September 2006
Compact
Flash Drives,
SD
3/22/2016
Overwrite media by using agency-approved and
validated overwriting technologies/methods/tools.
See Physical Destruction.
Florida Gulf Coast ARMA Chapter
Destroy media in order of recommendations.
􀂃 Shred.
􀂃 Disintegrate.
􀂃 Pulverize.
􀂃 Incinerate by burning in a licensed incinerator.
29
NIST Users
Florida House
Bill 1066
Florida Senate
Bill1366
3/22/2016
Florida Gulf Coast ARMA Chapter
30
Don’t forget..
3/22/2016
Florida Gulf Coast ARMA Chapter
31
3/22/2016
Florida Gulf Coast ARMA Chapter
32
Disposal
• What is in a Hard Drive?
– Lead
– Brominated Flame Retardants
– Barium
– Mercury
– Beryllium
– Cadmium
3/22/2016
Florida Gulf Coast ARMA Chapter
33
CDs
3/22/2016
Florida Gulf Coast ARMA Chapter
34
State E-Waste Guidelines
• 19 States already have EWaste Legislation
• All states will have in 2 – 3
years.
• Makes it illegal to dump EWaste in landfills
• Puts a carbon tax on
manufacturers
3/22/2016
Florida Gulf Coast ARMA Chapter
35
Keys
• Education
• Discipline
• Understand Levels
3/22/2016
Florida Gulf Coast ARMA Chapter
36
Education
• All employees
– Used laptops
– Used hard drives
• System Administrators
– Always new things to learn
– OS and Networking
• Hands on training versus multiple
choice
3/22/2016
Florida Gulf Coast ARMA Chapter
37
Discipline
• The human factor
– Affects everything
• Lazy or
• Doesn’t understand task completely
3/22/2016
Florida Gulf Coast ARMA Chapter
38
Security Matrix
• Time to recover
• Level of Effort
– Cost to recover
• Labor
• Equipment
• Information Importance
– Classified
– Personal
3/22/2016
Florida Gulf Coast ARMA Chapter
39
In the field -vs- In the lab
• Emergency Destruct
– Iranian Embassy
– EP3
3/22/2016
• Home on the range
– More time
– Destruction before
transit
Florida Gulf Coast ARMA Chapter
40
Technology Changes
• Technology is not
affected by bureaucracy
– Patterned Media
– Heat Assisted Recording
– Holographic Media
• Laws and Regs have to
change too!
3/22/2016
Florida Gulf Coast ARMA Chapter
41
Points to Remember
• What regulations govern your EOL security?
• Are they up to date to meet today's
standards?
• Even if you cannot RESUSE your hard
drives…you should PURGE the data before you
hand over for destruction or Degausing!
• Don’t forget security at EOL!!
3/22/2016
Florida Gulf Coast ARMA Chapter
42
Contact Info
Andy Crawford
727.596.2109
727.656.5744
acrawford@destructdata.com
3/22/2016
Florida Gulf Coast ARMA Chapter
43