Net Zeros and Ones: How Data Erasure Promotes Sustainability, Privacy, and Security

Cover
Title Page
Copyright Page
About the Authors
Contents at a Glance
Contents
Foreword
Introduction
Chapter 1 End of Life for Data
1.1 Growth of Data
1.2 Managing Data
1.2.1 Discovery
1.2.2 Classification
1.2.3 Risk
1.3 Data Loss
1.3.1 Accidental
1.3.2 Theft
1.3.3 Dumpster Diving
1.4 Encryption
1.5 Data Discovery
1.6 Regulations
1.7 Security
1.8 Legal Discovery
1.9 Data Sanitization
1.10 Ecological and Economic Considerations
1.10.1 Ecological
1.10.2 Economic
1.11 Summary: Proactive Risk Reduction and Reactive End of Life
Chapter 2 Where Are We, and How Did We Get Here?
2.1 Digital Data Storage
2.2 Erasing Magnetic Media
2.3 History of Data Erasure
2.3.1 The Beginnings of Commercial Data Erasure
2.3.2 Darik’s Boot and Nuke (DBAN)
2.4 Summary
Chapter 3 Data Sanitization Technology
3.1 Shredding
3.2 Degaussing
3.3 Overwriting
3.4 Crypto-Erase
3.5 Erasing Solid-State Drives
3.6 Bad Blocks
3.7 Data Forensics
3.8 Summary
Chapter 4 Information Lifecycle Management
4.1 Information Lifecycle Management vs. Data Lifecycle Management
4.2 Information Lifecycle Management
4.2.1 Lifecycle Stages
4.3 Data Security Lifecycle
4.3.1 Stages for Data Security Lifecycle
4.4 Data Hygiene
4.5 Data Sanitization
4.5.1 Physical Destruction
4.5.2 Cryptographic Erasure
4.5.3 Data Erasure
4.6 Summary
Chapter 5 Regulatory Requirements
5.1 Frameworks
5.1.1 NIST Cybersecurity Framework Applied to Data
5.2 Regulations
5.2.1 GDPR
5.2.2 HIPAA Security Rule Subpart C
5.2.3 PCI DSS V3.2 Payment Card Industry Requirements
5.2.4 Sarbanes–Oxley
5.2.5 Saudi Arabian Monetary Authority Payment Services Regulations
5.2.6 New York State Cybersecurity Requirements of Financial Services Companies 23 NYCRR 500
5.2.7 Philippines Data Privacy Act 2012
5.2.8 Singapore Personal Data Protection Act 2012
5.2.9 Gramm–Leach–Bliley Act
5.3 Standards
5.3.1 ISO 27000 and Family
5.3.2 NIST SP 800-88
5.4 Summary
Chapter 6 New Standards
6.1 IEEE P2883 Draft Standard for Sanitizing Storage
6.1.1 Data Sanitization
6.1.2 Storage Sanitization
6.1.3 Media Sanitization
6.1.4 Clear
6.1.5 Purge
6.1.6 Destruct
6.2 Updated ISO/IEC CD 27040 Information Technology Security Techniques—Storage Security*
6.3 Summary
Chapter 7 Asset Lifecycle Management
7.1 Data Sanitization Program
7.2 Laptops and Desktops
7.3 Servers and Network Gear
7.3.1 Edge Computing
7.4 Mobile Devices
7.4.1 Crypto-Erase
7.4.2 Mobile Phone Processing
7.4.3 Enterprise Data Erasure for Mobile Devices
7.5 Internet of Things: Unconventional Computing Devices
7.5.1 Printers and Scanners
7.5.2 Landline Phones
7.5.3 Industrial Control Systems
7.5.4 HVAC Controls
7.5.5 Medical Devices
7.6 Automobiles
7.6.1 Off-Lease Vehicles
7.6.2 Used Vehicle Market
7.6.3 Sanitization of Automobiles
7.7 Summary
Chapter 8 Asset Disposition
8.1 Contracting and Managing Your ITAD
8.2 ITAD Operations
8.3 Sustainability and Green Tech
8.4 Contribution from R2
8.4.1 Tracking Throughput
8.4.2 Data Security
8.5 e-Stewards Standard for Responsible Recycling and Reuse of Electronic Equipment
8.6 i-SIGMA
8.7 FACTA
8.8 Summary
Chapter 9 Stories from the Field
9.1 3stepIT
9.2 TES – IT Lifecycle Solutions
9.2.1 Scale of Operations
9.2.2 Compliance
9.2.3 Conclusion
9.3 Ingram Micro
9.4 Summary
Chapter 10 Data Center Operations
10.1 Return Material Allowances
10.2 NAS
10.3 Logical Drives
10.4 Rack-Mounted Hard Drives
10.5 Summary
Chapter 11 Sanitizing Files
11.1 Avoid Confusion with CDR
11.2 Erasing Files
11.3 When to Sanitize Files
11.4 Sanitizing Files
11.5 Summary
Chapter 12 Cloud Data Sanitization
12.1 User Responsibility vs. Cloud Provider Responsibility
12.2 Attacks Against Cloud Data
12.3 Cloud Encryption
12.4 Data Sanitization for the Cloud
12.5 Summary
Chapter 13 Data Sanitization and Information Lifecycle Management
13.1 The Data Sanitization Team
13.2 Identifying Data
13.3 Data Sanitization Policy
13.3.1 Deploy Technology
13.3.2 Working with DevOps
13.3.3 Working with Data Security
13.3.4 Working with the Legal Team
13.3.5 Changes
13.4 Summary
Chapter 14 How Not to Destroy Data
14.1 Drilling
14.1.1 Nail Gun
14.1.2 Gun
14.2 Acids and Other Solvents
14.3 Heating
14.4 Incineration
14.5 Street Rollers
14.6 Ice Shaving Machines
Chapter 15 The Future of Data Sanitization
15.1 Advances in Solid-State Drives
15.2 Shingled Magnetic Recording
15.3 Thermally Assisted Magnetic Recording, Also Known as Heat-Assisted Magnetic Recording
15.4 Microwave-Assisted Magnetic Recording
15.5 DNA Data Storage
15.6 Holographic Storage
15.7 Quantum Storage
15.8 NVDIMM
15.9 Summary
Chapter 16 Conclusion
Appendix: Enterprise Data Sanitization Policy
Introduction
Intended Audience
Purpose of Policy
General Data Hygiene and Data Retention
Data Spillage
Handling Files Classified as Confidential
Data Migration
End of Life for Classified Virtual Machines
On Customer’s Demand
Seven Steps to Creating a Data Sanitization Process
Step 1: Prioritize and Scope
Step 2: Orient
Step 3: Create a Current Profile
Step 4: Conduct a Risk Assessment
Step 5: Create a Target Profile
Step 6: Determine, Analyze, and Prioritize Gaps
Step 7: Implement Action Plan
Data Sanitization Defined
Physical Destruction
Degaussing
Pros and Cons of Physical Destruction
Cryptographic Erasure (Crypto-Erase)
Pros and Cons of Cryptographic Erasure
Data Erasure
Pros and Cons of Data Erasure
Equipment Details
Asset Lifecycle Procedures
Suggested Process, In Short
Create Contract Language for Third Parties
Data Erasure Procedures
Responsibility
Validation of Data Erasure Software and Equipment
Personal Computers
Servers and Server Storage Systems
Photocopiers, Network Printers, and Fax Machines
Mobile Phones, Smartphones, and Tablets
Point-of-Sale Equipment
Virtual Machines
Removable Solid-State Memory Devices (USB Flash Drives, SD Cards)
CDs, DVDs, and Optical Discs
Backup Tape
General Requirements for Full Implementation
Procedure for Partners and Suppliers
Audit Trail Requirement
Policy Ownership
Mandatory Revisions
Roles and Responsibilities
CEO
Board of Directors
Index
EULA