Why You Should Always Destroy Your Own Data

You’ve got technological defenses, robust IT governance, and a cyber-aware workforce. Your data is safeguarded, replicated, and backed up. That’s great, there’s just one more thing you need to know: Why you should destroy your own data.

Why You Should Destroy Your Own Data

Given the efforts we take to protect data and to satisfy the apparent dichotomy of making sure it is both accessible and secure, it is counter-intuitive to consider the willful destruction of data as not just a requirement, but a necessity.

There are several reasons why you’d need to do this.

Hardware Replacement

Hardware ages, and like all machines, has a finite operational life. When servers, desktop computers, laptops, Network Attached Storage devices, and mobile devices such as cell phones and tablets are redundant, they must be disposed of.

The device might be replaced due to hardware failure. Some companies don’t wait for failure, they proactively manage the retirement of hardware to prevent unforeseen downtime. Different classes of devices are allocated an in-service duration, and once they hit that age they are replaced.

Device replacements can be driven by external factors too, such as the release of a new version of Microsoft Windows. If your old hardware doesn’t have the horsepower to run the new operating system, it will have to be replaced.

Hardware Re-use

If someone leaves their post and their laptop or desktop is being redeployed to their replacement, you need to securely wipe the device before giving it to the incoming staff member.

Legislative or Compliance Reasons

Legislation such as the?General Data Protection Regulations forces organizations to state publicly (usually in their online Privacy Policy) how long they will retain personally identifiable information — personal data — for. This is called the retention period.

Retaining data beyond the stated retention period can lead to serious breaches of data protection and privacy policies, and unwanted attention from the relevant supervisory authority. Not to mention unwanted costs and damage to your reputation.

Giving It All Away

Great efforts are taken to prevent threat actors from getting their hands on your data. Disposing of old hardware without giving due thought to the data that sits on it is like handing that data straight to the bad guys.

You don’t dump sensitive paper documents in the regular garbage. You shred them to render them inaccessible and unreadable. You need to securely erase the data from old hardware too.

Apart from the commercial implications of leaking sensitive corporate information, if any personally identifiable information is included in the data, that counts as an actionable data breach in Europe.

How to Securely Wipe Hard Drives

There are only so many ways to securely remove your data from a hard drive or to make the hard drive unreadable. You can:

• Overwrite the data
• Degauss the drives
• Physically damage or destroy the drives

Each of these techniques has benefits and drawbacks, and some companies use more than one at a time.

Overwriting Data

When an operating system deletes a file it removes the name of the file from the list of files on that hard drive, then marks the space on the hard drive where the file was stored as available for re-use.

Eventually, that region of the hard drive will be overwritten by another file. If that area of the drive hasn’t been overwritten it is trivial to retrieve the data from the deleted file—it is right there on the hard drive where it used to be. Deleting all files before disposing of an old hard drive or computer isn’t nearly enough to prevent unauthorized access to the deleted data. It needs to be purposefully overwritten.

Specialist software packages can be used to write data values to every possible data point on a hard drive, obliterating everything that was previously stored on it. However, overwriting is slow, especially if you are wiping high-capacity hard drives or have a large stack of drives to work through.

Overwriting software is not a foolproof way to securely wipe a?Solid-State Drive (SSD). You need to check the manufacturer’s website and obtain the brand-specific utility to completely erase one of their SSDs.

Overwriting data on a physical drive or completely erasing an SSD does not harm the drive itself. It can be re-used. If you’re cleansing a machine to pass to another employee or donate to charity, this is a good method to use.

Degaussing

Traditional physical hard drives store their data as magnetic patterns on the spinning platters. Degaussing uses strong magnetic fields to disrupt those patterns, effectively scrambling the entire hard drive.

Degaussing isn’t selective, you can’t degauss the platters on their own – instead, it zaps the entire hard drive mechanism. That means it often wipes the firmware data from the servo controller, rendering the drive inoperable. This further reduces the chances of anyone ever reading data from that drive.

However, if your plan was to re-use the drive once it was wiped, degaussing isn’t the way to go. Even if the drive still works after degaussing, you’ll have a drive with questions about its longevity — and you’ve just nuked your warranty.

Degaussing machines are expensive. More affordable degaussing wands are available, but for guaranteed destruction, you need to use a powerful desktop unit. And because SSDs don’t use magnetism to store their data, degaussing doesn’t work on SSDs.

Physical Destruction of Drives

Done properly, this is guaranteed to work. Destruction of the hard drive removes all chances of retrieving data from it.

To thoroughly destroy a mechanical hard drive you can drill a series of holes through it at staggered distances working outwards from close to the center. You can accomplish this in a more primitive fashion with a large hammer and some four-inch (10 cm) nails. Sit the drive on a wooden block and wallop a couple of nails through the platters, shattering them.

As amazing as it might sound, there are shredders into which you can drop hard drives, and they are pulverized. They cost a fortune, make a lot of noise, and shake the building, but they do exist. The point to watch is the pitch of the shredding wheels. They are usually about one inch (2.5 cm) or so apart. Some of the chips inside SSDs are smaller than that, so reclaimed chips could be pulled from the swarf, transplanted into donor units, and resurrected.

For drive destruction, I’ve even heard of organizations striking deals with metal reclamation plants that melted the drives for them with no charge and recycled the metal. As well as dealing with the data destruction issue, it helped the organization’s sustainability program and green targets.

The Cloud and Software-as-a-Service

With the massive uptake of cloud storage, it isn’t just local hard drives that you need to worry about. Your data is now on someone else’s hard drives. A data center will monitor the health of their hard drives and will replace them at the earliest sign of an approaching problem. How do they dispose of their old drives—and your data? And in any event, how will they wipe your data if you move to a different cloud provider?

The same considerations need to be given to Software-as-a-Service (SaaS) providers. A traditional data center will typically be contractually bound to securely destroy data at the end of a contract and to provide written confirmation that it has taken place. That type of rigor is much rarer with SaaS providers.

Make sure data destruction is part of your contract or agreement before engaging with them. Get it in writing, and ensure that a statement or certificate of secure data destruction is an agreed deliverable.

Not Just Hard Drives

Anything you can store data on must be destroyed or wiped before it is discarded or reused. That means:

• CDs
• DVDs
• Backup Tapes
• External Hard Drives
• USB Memory Sticks

Mobile phones are another important category requiring careful data destruction. A simple factory reset is often not good enough due to data recovery tools that can bypass this measure.

For a more secure wipe, use specialized software designed for mobile devices or consult your phone manufacturer’s guidelines.

Even devices such as multi-function printers can retain huge amounts of information as documents are fed to them to be copied, printed, or scanned.

Find a Trusted Partner

Recycling companies sometimes offer certificates of secure data destruction for computers and other data processing equipment they collect from you. A good company will demonstrate end-to-end rigor in its process.

• Equipment will be stickered with a barcode when it is collected.
• A collection manifest of collected equipment should be provided listing the barcode and the tag or serial number of the device that received that sticker.
• They will have trackers in their vans so they can tell that the driver did not deviate or stray from their route of collections for the day.
• Paperwork following the collection will include a certificate of secure data destruction for each device, linking the barcoded sticker to the serial number of the device and the serial number of the hard drives within the device.
• They will list the standards they adhere to and the certifications they have, which should cover topics such as quality management, environmental management, information security management, and secure destruction of confidential material.

It’s quite easy to find a company that will perform these services at no direct cost to you as long as they are permitted to profit from the recycling of electronic devices.

Cradle to Grave

Data safeguarding starts the moment data is first written to, or created on, a device and lasts until that device is retired from active service, and the data is unequivocally guaranteed to have been purged from it.

The Bottom Line

Your data holds so many keys to part of your life, and the destruction of it should be treated with as much care as your protection of it while it serves a purpose.

Luckily, there are many methods to stay safe, and guarantee your data destruction. Just don’t rely on “moving everything to the recycle bin” – it’s about as valuable as leaving your front door key under a flower pot.