It is good security practice to overwrite, or wipe, sensitive files when they are deleted. But what level of erasure...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
should you set for your confidential data? In 2004, the U.S. National Security Agency (NSA Advisory LAA-006-2004) found that a single overwrite using DoD 5220.22-M-compliant software is sufficient to render electronic files unrecoverable. Many data wiping products state that they meet the "DoD 5220.22-M standard." The particular claim generally means that the technology will over-wipe all addressable hard drive locations with a single character. The second part of the operation wipes all addressable locations with a character, its complement, and then a random character, followed by verification. The process is completed three times and prevents data from being recovered by commercially available processes.
One problem with software disk-wiping is that it cannot sanitize hard drives that have actually physically failed. In such instances, you could destroy them by degaussing, melting, incineration, crushing or shredding. Physical destruction offers the highest level of erasure but even this is not necessarily absolute if any remaining disk pieces are larger than a single 512-byte record block in size. Whichever method you chose, either software wiping or physical destruction, you must enact policies and procedures governing hard drive disposal. You should also offer appropriate employee training to ensure that you have taken "reasonable measures" to safeguard your data.
The Federal Trade Commission's FACTA rule on the proper storage and disposal of certain consumer information requires that such information is properly disposed of. Although physically destroying disks is more costly than wiping them, the potential costs associated with compromised data may make it the best option. I would recommend the NIST Special Publication 800-88, Guidelines for Media Sanitization. Its recommendations can be applied to all types of organizations and are helpful in devising an appropriate erasure policy based on the confidentiality level of your information.
Dig Deeper on Data security strategies and governance
Related Q&A from Michael Cobb
Android encryption on devices using Qualcomm chips can be broken due to two vulnerabilities. Expert Michael Cobb explains how these flaws affect ...continue reading
A flaw that allows attackers to load malicious DLL files in Symantec products was labeled as severe. Expert Michael Cobb explains the vulnerability ...continue reading
Mobile apps using insecure OAuth could lead to over one billion user accounts being attacked. Expert Michael Cobb explains how developers can ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.