Home > Ask the Security Experts > Platform Security Questions & Answers > The pros and cons of data wiping
Ask The Security Expert: Questions & Answers
EMAIL THIS

The pros and cons of data wiping

Michael Cobb, featured expert EXPERT RESPONSE FROM: Michael Cobb, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 08 August 2006
We are currently using a well known "wipe" utility, but it is taking eight hours to make one pass. Typical security has called for a minimum of three and up to seven passes to "ensure" that everything is completely gone. Is there a secure wipe utility that can help us safeguard our data in less than eight hours?

>
Performing a wipe is a time-consuming process and is exacerbated by the fact that relative to their capacity modern hard drives are slow. Most wipe tools reach the disk's physical limits because the CPU, memory and IDE, SCSI and SATA drives. If your wipe times don't improve, it may be because DBAN doesn't have a specific driver for your motherboard chipset, however you can contact them if this is the case.

Also review the number of passes that you really require to safeguard your data. If you need to guarantee that your data is wiped, then a wipe done to the U.S. Department of Defense's DoD 5220.22-M (8-306. /E) standard will over-wipe all addressable hard drive locations with a character, its complement and a random character followed by verification. This process is completed three times and prevents data from being recovered by commercially available processes. DoD 5220.22-M (8-306. /E, C & E) is a seven-pass wipe and is only required for the most sensitive of information. However, in the fall of 2004, the U.S. National Security Agency (NSA Advisory LAA-006-2004) found that a single overwrite using DoD 5220.22-M compliant software is sufficient to render electronic files unrecoverable.

Unfortunately software disk-wiping cannot sanitize disconnected, forgotten internal hard drives, or hard drives that have physically failed. Therefore, if you don't need your drives again consider destroying them by degaussing, melting, incineration, crushing or shredding. Also know that with both methods, software-wiping or physical destruction, you'll need to implement policies and procedures that govern hard drive disposal. You must also train employees to ensure that you have taken "reasonable measures" to safeguard your data. The FTC's FACTA rule on the proper storage and disposal of certain consumer information requires any business that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose, to properly dispose of such information or compilation. Although physically destroying disks is more costly than wiping them, the potential costs associated with compromised data may make it the best option.


BROWSE BY TAG
Platform Security,   Enterprise Data Protection,   Enterprise Data Governance,   Data Loss Prevention,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



RELATED CONTENT
Platform Security
Should developers create libraries of common cryptographic algorithms?
How to secure USB ports on Windows machines
What is the best database patch management process?
What is an encryption collision?
What are new and commonly used public-key cryptography algorithms?
Should management processes change based on a patch release schedule?
Does an EULA make it truly illegal to decompile software?
Should businesses delay Windows Vista adoption and just buy Windows 7?
Why should we place data files on a separate partition than the OS?
Should Windows Mobile updates come from Microsoft?

Enterprise Data Governance
Creating an enterprise data protection framework
Analyst DLP study finds maturity, ranks top DLP vendors
Voltage, RSA spar over tokenization, data protection
Twitter gets condemned by CISOs at Forrester forum
PCI DSS compliance requirements: Ensuring data integrity
Trustwave acquires data loss prevention vendor Vericept
Data has become too distributed to secure, Forrester says
Cloud-based security services should start private
Compliance in the cloud
How to write technology outsourcing contracts

Data Loss Prevention
Breach prevention: How to keep track of data and applications
Trend Micro to address DLP after analyst report criticizes strategy
How to secure USB ports on Windows machines
DLP technology challenges security costs
Defining DLP
Analyst DLP study finds maturity, ranks top DLP vendors
Data protection tips for corporate compliance leaders
Trustwave acquires data loss prevention vendor Vericept
Best Data Loss Prevention Products
Are there still Google Desktop security problems?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
cut-and-paste attack  (SearchSecurity.com)
data masking  (SearchSecurity.com)
data splitting  (SearchSecurity.com)
deperimeterization  (SearchSecurity.com)
Google hacking  (SearchSecurity.com)
masquerade  (SearchSecurity.com)
snooping  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts