Protecting Data in Decommissioned IT Assets: Factors, Tools and Methods

Transcription

1 SECURIS SM Protecting Data in Decommissioned IT Assets: Factors, Tools and Methods Information Systems Security Association (ISSA) Baltimore Chapter Monthly Meeting January 27, 2016 Hugh McLaurin, CSDS

2 Agenda The need to protect data when IT systems are decommissioned Methods and techniques, tools Important factors to consider What do you do?

3 Two important aspects of managing IT/Electronics end-of-life disposition Protecting the Environment Hazardous materials Reclamation of reusable materials Protecting your Data Customer, company, personal information Preventing data breaches or identity theft PCs, laptops, servers, clients, phones, tablets, copiers

4 Last Line of Defense Companies/institutions go to extraordinary lengths to protect data during life of IT systems Cybersecurity explosion Don t forget to do the same when decommissioning! 4

5 Data Breach Risks Data breach stakes are higher than ever Average cost per breach event in the U.S. = $7.2 M 1 10% of data breaches are due to improper disposal

6 Data Breach Risks Data breach stakes are higher than ever Average cost per breach event in the U.S. = $7.2 M 1 10% of data breaches are due to improper disposal 2 But it s more than an issue of $$ Classified data (e.g., government) in wrong hands Regulated information (e.g., healthcare) Intellectual property and proprietary data Company reputation and trustworthiness Liabilities

7 Plan for Data Protection at End of Life Treat as an integral part of IT asset management and IT system operations A critical piece of the overall cybersecurity solution set It shouldn t be an afterthought Budget How vulnerable and risk averse is your work sector? Healthcare, Financial, Government (incl. contracting), Legal, Regulatory oversight and penalties Classification or sensitivity of data Customer requirements How determined might your adversary be? The tools and vendors you choose depend on these factors One size doesn t necessarily fit all 7

8 Tools for Protecting Data at IT Asset End of Life Degaussing (HDDs, magnetic storage media) Physical destruction (shredding) Solid state devices and Micro-shredding Destruction vs. Sanitization 8

9 Hard Disk Drive Degaussing Intense magnetic field erases data on magnetic media and renders HDDs useless Necessary for classified and extremely sensitive data Equipment listed on NSA Evaluated Products List (EPL) meets rigorous NSA standards Required for DOD/Class projects Typically, classified data requires two-stage process of degaussing followed by shredding Throughput important for larger data destruction jobs 9

10 Data Destruction Securely Shredded Data Storage Devices The brute-force process of physically shredding hard drives, cell phones, tapes and other data storage media and devices Appropriate for most data when coupled with secure chain of custody and state-of-the-art destruction equipment Throughput important for larger data destruction jobs

11 Legacy Data Storage Continues to Evolve HDD size and cost diminish as memory density increases Good news for shredder Impacts decisions on data destruction techniques 11

12 Evolution Includes Transition to Solid State Memory Destruction requires different techniques for non-magnetic storage media (e.g., Flash)

13 In Some Cases, Particle Size Matters Traditional HDD shredders usually aren t appropriate for SSD s or flash memory devices such as SD cards, thumb drives, etc. Typically, a shred dimension of 2 mm or smaller is required (per NSA) to break through the memory chips and securely obliterate the data 13

14 New Technology Requires New Techniques 14

15 Micro Shredding (Hammer Mill) Pulverize Class SSDs, Flash memory, phones/pdas, circuit boards, other solid state devices to meet <2mm particle size standards 15

16 Destroying vs. Sanitizing Memory Why Destroy? NSA does not prescribe software wiping for any type of data storage device Data can be retrieved from dead sectors that are not overwritten when wiped Potential for hidden data in internal memory Shredding better mitigates the risk of human error A wiped drive and a non-wiped drive look exactly the same Wiping takes a long time The higher storage density of the drive, the longer it takes to overwrite the data With higher volumes, you consume more time and processing power (and $) to wipe the drives Evolution of data storage devices Chances are that old hard drive isn t all that useful Shredding is more fun to watch

17 No Such Agencies Class/UnClass Data media_destruction_guidance/ nispom pdf _01_oct_11_2007_final_agreement.pdf Publications/NIST.SP r1.pdf

18 Certifications Requires recyclers to sanitize, purge or destroy all data in secure environment Rigorously audited by independent third party in more than 50 areas 18

19 Additional Factors to Consider Vendor Certifications (NAID AAA, R2 or e-stewards) Secure chain of custody (Processes/procedures, DLIS certification) On-site vs. off-site destruction services Closed-loop, end-end processes and partnerships Documentation Certificate of Data Destruction Asset Report Traceability from your custody to destruction/disposition 19

20 The IT Infrastructure Landscape Has Evolved

21 The Internet of Things Data Gone Wild Re-evaluate: Vulnerabilities Methods Tools 21

22 Contact Information Hugh McLaurin, CSDS Owner, Securis Central Maryland Office Cell

23 Securis Core Strengths Responsible E-waste Recycling & End of Life Disposition Onsite removal service for recycling of retired IT assets in compliance with our Zero-Export, Zero-Landfill Policy and R2 Certification Data Shredding Mobile industrial shredder or Micro Shredder destroy computer hard drives, solid state drives, cell phones, back-up tapes, DLT, LTO, and other data storage devices onsite with staff witness or off-site at our secure processing facility Data Degaussing Mobile State-of-the-art LM-4 degausser is specially designed to destroy large quantities of magnetically-stored electronic media onsite at your facility with a staff witness or off-site at our secure processing facility Chain of Custody Auditing & Reporting Final documentation includes auditable inventory list of all IT assets that were recycled or destroyed as well as a Certificate of E-waste Recycling and Destruction for your records

24 Securis Recycling Process From Start to Finish Onsite removal service of all IT assets Downstream processing of parts in compliance with Zero-Export, Zero- Landfill policy Secure, End-to-End Process Scanning for auditable inventory list Physical disassembly of units at Securis s secure facility All units checked for data

25 Securis Background Experience 10+ years of experience in IT asset disposal and data destruction Locations 8 East Coast locations - Maryland franchise locations opened in 2013 Certifications R2 (recycling) and NAID AAA (data destruction) Customers Government (Federal, State and Local) Government Contractors Financial Institutions Healthcare Educational Institutions Technology Sector, etc.

26 Securis Process for Classified Data Destruction Compliant with DSS and NSA requirements Step-by-step written description of the Securis process for the destruction of government classified hard drives Onsite at the government or contractor s facility Off-site at Securis facility 26