-: Once your system has fulfilled
its operational useful life,
what are you going to do with it?
Should you reuse the asset?
Should you resell it?
Or should you throw it away?
Well, this is really a question
you have to think about
in terms of risk tolerance
and how your organization
views its security posture.
Which method you decide is going to be documented
inside your organization's disposal policy
and it's something you need to think through.
Asset disposal occurs whenever a system
is no longer needed by an organization.
And it doesn't mean it has to be some
old worn out piece of junk computer.
It may be that you have a new iPhone
and you just got a brand new one three weeks later.
What are you going to do with that one
that was there three weeks earlier?
Well, you're going to have to dispose of it somehow,
and it can be reused, resold, or completely thrown away.
This disposal might require the system to be destroyed,
it could be that the assets
can be reused for another purpose,
or it's resold to get you some money back.
Now in organizations that require
a high level of security for their data,
it's commonplace for data storage devices
to be electronically or physically destroyed first.
Now if you were going to use tapes
for your backups for example,
these tapes might be shredded or burned
when you no longer need them.
If your organization is using hard drives for storage,
these can be destroyed through a degaussing process.
Degaussing exposes the hard drive
to a powerful magnetic field,
and this causes the previously written data
to be wiped from the drive,
and the drive to become a blank slate once again.
Now I have seen organizations that take this step further
and they physically destroy those hard drives
to prevent the data from being exposed,
and they do this by hitting them with axes,
smashing them with hammers,
or even using industrial shredders
to turn that hard disk into tiny little pieces.
Now if all of that sounds a little too violent for you,
that's okay, there's electronic mechanisms to do this too.
This is known as purging.
Purging, also known as sanitizing,
is the act of removing data in such a way
that it cannot be reconstructed
using any known forensic techniques.
This includes using special bit-by-bit erasing software
that can allow you to rewrite the hard drive
many times over with a series of ones and zeros.
And if you do this at least seven times or even 35 times
for real high security applications,
you can actually erase that drive
and then reuse it again.
Another technique you can use
is to encrypt the drive,
and if you destroy the encryption key,
this again makes the data on it impossible to read,
and this is another way to basically sanitize your drive.
Now if you want to reuse that hard drive more easily though,
you would use a clearing technique.
A clearing technique is the removal of data
with a certain amount of assurance
that it can't be reconstructed.
For example if you delete a file
or a folder from your hard disk,
and then you replace the area
that was stored on it
with a series of zeros,
this would constitute clearing.
This is also used to do a secure erase function
inside of some operating systems.
Now unfortunately the data is actually recoverable
with special techniques and forensic procedures though.
And so if you want to conduct something
like a low level format of the hard disk,
this would be categorized as clearing as well.
The bottom line if you're working
in a high security environment,
you shouldn't use clearing.
Instead you should opt for purging
or physical destruction.
Now when it comes down to it,
the major security concern here
is the idea of data remnants.
It's those leftover pieces of data
that may exist in the hard drive
and we no longer need it.
For example let's say I took my old laptop
and I wanted to sell it to another person,
I would want to ensure that they can't access
any of the data that was previously stored on there
like my bank account information
or my social security number.
In order to do this,
I can remove the hard drive,
but this would make the laptop
essentially unusable or unsellable.
So instead I can purge or sanitize the hard drive
using these overwrite procedures
and then install a brand new operating system.
As long as I overwrote
every single sector of that hard drive,
the fear of the data being recovered
would be mitigated.
Now as an organization,
we might want to reuse an asset
such as a server, a router, or another system,
again the idea of data remnants here
must be addressed though.
So if I was going to take a server
that was previously used by accounting,
and provide it to the marketing department,
I probably want to ensure that all of the data remnants
have been removed using overwriting procedures.
But if a system was being used
in a test lab by web developers
and they wanted to reuse it again
for a new project testing another website,
it may only be necessary to do clearing
and just simply delete the files
or some of the applications that were on there.
Now there is no right or wrong answer
when you're deciding if an asset
should be physically destroyed or reused.
This is a decision that you have to make
as a security professional
based on the cost, the business case,
and the security issues involved
when you're writing your disposal policies.
Now when you're writing those disposal policies,
you should cover five steps in those policies.
First, you need to define
what equipment will be disposed of.
Second, you need to determine
where that old equipment
will be stored until disposal,
because if I took that server
and I just left it out,
people could access the data.
So I want to make sure it's locked up
in a server room or in a closet
where people can't access it
until I dispose of the information.
Third, you need to ensure
that your security personnel
analyze the equipment
and determine if it should be
disposed of, reused, or resold.
Fourth, you need to sanitize the device
and remove all of the data from that machine.
You can do this through clearing, purging,
or physical destruction.
And fifth, you want to throw away,
recycle, or resell the device
now that the data is gone.