{"id":99291,"date":"2023-09-07T07:48:09","date_gmt":"2023-09-07T07:48:09","guid":{"rendered":"https:\/\/www.techopedia.com"},"modified":"2024-01-17T12:40:29","modified_gmt":"2024-01-17T12:40:29","slug":"why-you-should-always-destroy-your-own-data","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/why-you-should-always-destroy-your-own-data","title":{"rendered":"Why You Should Always Destroy Your Own Data"},"content":{"rendered":"
You\u2019ve got technological defenses<\/a>, robust IT governance<\/a>, and a cyber-aware workforce. Your data<\/a> is safeguarded, replicated, and backed up<\/a>. That\u2019s great, there’s just one more thing you need to know: Why you should destroy your own data.<\/p>\n Given the efforts we take to protect data<\/a> and to satisfy the apparent dichotomy of making sure it is both accessible and secure, it is counter-intuitive to consider the willful destruction of data as not just a requirement, but a necessity.<\/p>\n There are several reasons why you\u2019d need to do this.<\/p>\n Hardware<\/a> ages, and like all machines, has a finite operational life. When servers<\/a>, desktop computers<\/a>, laptops<\/a>, Network Attached Storage devices<\/a>, and mobile devices such as cell phones<\/a> and tablets<\/a> are redundant, they must be disposed of.<\/p>\n The device might be replaced due to hardware failure. Some companies don\u2019t wait for failure, they proactively manage the retirement of hardware to prevent unforeseen downtime<\/a>. Different classes of devices are allocated an in-service duration, and once they hit that age they are replaced.<\/p>\n Device replacements can be driven by external factors too, such as the release of a new version of Microsoft Windows<\/a>. If your old hardware doesn\u2019t have the horsepower to run the new operating system<\/a>, it will have to be replaced.<\/p>\n If someone leaves their post and their laptop or desktop is being redeployed to their replacement, you need to securely wipe the device before giving it to the incoming staff member.<\/p>\n Legislation such as the\u00a0General Data Protection Regulations<\/a> forces organizations to state publicly (usually in their online Privacy Policy<\/a>) how long they will retain personally identifiable information<\/a> \u2014 personal data \u2014 for. This is called the retention period<\/a>.<\/p>\n Retaining data beyond the stated retention period can lead to serious breaches of data protection and privacy policies, and unwanted attention from the relevant supervisory authority. Not to mention unwanted costs and damage to your reputation.<\/p>\n Great efforts are taken to prevent threat actors<\/a> from getting their hands on your data. Disposing of old hardware without giving due thought to the data that sits on it is like handing that data straight to the bad guys.<\/p>\n You don\u2019t dump sensitive paper documents in the regular garbage. You shred them to render them inaccessible and unreadable. You need to securely erase the data from old hardware too.<\/p>\n Apart from the commercial implications of leaking sensitive corporate information, if any personally identifiable information is included in the data, that counts as an actionable data breach<\/a> in Europe.<\/p>\n There are only so many ways to securely remove your data from a hard drive<\/a> or to make the hard drive unreadable. You can:<\/p>\n Each of these techniques has benefits and drawbacks, and some companies use more than one at a time.<\/p>\n When an operating system deletes a file<\/a> it removes the name of the file from the list of files on that hard drive, then marks the space on the hard drive where the file was stored as available for re-use.<\/p>\n Eventually, that region of the hard drive will be overwritten by another file. If that area of the drive hasn\u2019t been overwritten it is trivial to retrieve the data from the deleted file<\/a>\u2014it is right there on the hard drive where it used to be. Deleting all files before disposing of an old hard drive or computer isn\u2019t nearly enough to prevent unauthorized access to the deleted data. It needs to be purposefully overwritten.<\/p>\n Specialist software packages<\/a> can be used to write data values to every possible data point on a hard drive, obliterating everything that was previously stored on it. However, overwriting is slow, especially if you are wiping high-capacity hard drives or have a large stack of drives to work through.<\/p>\n Overwriting software<\/a> is not a foolproof way to securely wipe a\u00a0Solid-State Drive (SSD)<\/a>. You need to check the manufacturer\u2019s website and obtain the brand-specific utility to completely erase one of their SSDs.<\/p>\n Overwriting data on a physical drive or completely erasing an SSD does not harm the drive itself. It can be re-used. If you’re cleansing a machine to pass to another employee or donate to charity, this is a good method to use.<\/p>\n Traditional physical hard drives store their data as magnetic patterns on the spinning platters<\/a>. Degaussing<\/a> uses strong magnetic fields to disrupt those patterns, effectively scrambling the entire hard drive.<\/p>\n Degaussing isn\u2019t selective, you can\u2019t degauss the platters on their own – instead, it zaps the entire hard drive mechanism. That means it often wipes the firmware<\/a> data from the servo controller<\/a>, rendering the drive inoperable. This further reduces the chances of anyone ever reading data from that drive.<\/p>\n However, if your plan was to re-use the drive once it was wiped, degaussing isn\u2019t the way to go. Even if the drive still works after degaussing, you\u2019ll have a drive with questions about its longevity \u2014 and you\u2019ve just nuked your warranty.<\/p>\n Degaussing machines are expensive. More affordable degaussing wands are available, but for guaranteed destruction, you need to use a powerful desktop unit. And because SSDs don\u2019t use magnetism to store their data, degaussing doesn\u2019t work on SSDs.<\/p>\n Done properly, this is guaranteed to work. Destruction of the hard drive removes all chances of retrieving data from it.<\/p>\n To thoroughly destroy a mechanical hard drive you can drill a series of holes through it at staggered distances working outwards from close to the center. You can accomplish this in a more primitive fashion with a large hammer and some four-inch (10 cm) nails. Sit the drive on a wooden block and wallop a couple of nails through the platters, shattering them.<\/p>\n As amazing as it might sound, there are shredders<\/a> into which you can drop hard drives, and they are pulverized. They cost a fortune, make a lot of noise, and shake the building, but they do exist. The point to watch is the pitch of the shredding wheels. They are usually about one inch (2.5 cm) or so apart. Some of the chips inside SSDs are smaller than that, so reclaimed chips could be pulled from the swarf, transplanted into donor units, and resurrected.<\/p>\n For drive destruction, I\u2019ve even heard of organizations striking deals with metal reclamation plants that melted the drives for them with no charge and recycled the metal. As well as dealing with the data destruction issue, it helped the organization’s sustainability program and green targets.<\/p>\n With the massive uptake of cloud storage<\/a>, it isn\u2019t just local hard drives<\/a> that you need to worry about. Your data is now on someone else\u2019s hard drives. A data center<\/a> will monitor the health of their hard drives and will replace them at the earliest sign of an approaching problem. How do they dispose of their old drives\u2014and your data? And in any event, how will they wipe your data if you move to a different cloud provider<\/a>?<\/p>\n The same considerations need to be given to Software-as-a-Service (SaaS)<\/a> providers. A traditional data center will typically be contractually bound to securely destroy data at the end of a contract and to provide written confirmation that it has taken place. That type of rigor is much rarer with SaaS providers.<\/p>\n Make sure data destruction is part of your contract or agreement before engaging with them. Get it in writing, and ensure that a statement or certificate of secure data destruction is an agreed deliverable.<\/p>\n Anything you can store data on must be destroyed or wiped before it is discarded or reused. That means:<\/p>\n Mobile phones<\/a> are another important category requiring careful data destruction. A simple factory reset<\/a> is often not good enough due to data recovery tools that can bypass this measure.<\/p>\n For a more secure wipe, use specialized software designed for mobile devices or consult your phone manufacturer’s guidelines.<\/p>\n Even devices such as multi-function printers<\/a> can retain huge amounts of information as documents are fed to them to be copied, printed, or scanned.<\/p>\n Recycling companies sometimes offer certificates of secure data destruction for computers and other data processing equipment they collect from you. A good company will demonstrate end-to-end rigor in its process.<\/p>\n It’s quite easy to find a company that will perform these services at no direct cost to you as long as they are permitted to profit from the recycling of electronic devices.<\/p>\n Data safeguarding starts the moment data is first written to, or created on, a device and lasts until that device is retired from active service, and the data is unequivocally guaranteed to have been purged from it.<\/p>\n Your data holds so many keys to part of your life, and the destruction of it should be treated with as much care as your protection of it while it serves a purpose.<\/p>\n Luckily, there are many methods to stay safe, and guarantee your data destruction. Just don’t rely on “moving everything to the recycle bin” – it’s about as valuable as leaving your front door key under a flower pot.<\/p>\n","protected":false},"excerpt":{"rendered":" You\u2019ve got technological defenses, robust IT governance, and a cyber-aware workforce. Your data is safeguarded, replicated, and backed up. That\u2019s great, there’s just one more thing you need to know: Why you should destroy your own data. Why You Should Destroy Your Own Data Given the efforts we take to protect data and to satisfy […]<\/p>\n","protected":false},"author":286520,"featured_media":99629,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_lmt_disableupdate":"","_lmt_disable":"","om_disable_all_campaigns":false,"footnotes":""},"categories":[548,557],"tags":[],"category_partsoff":[],"class_list":["post-99291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-data-management"],"acf":[],"yoast_head":"\nWhy You Should Destroy Your Own Data<\/span><\/h2>\n
Hardware Replacement<\/h3>\n
Hardware Re-use<\/h3>\n
Legislative or Compliance Reasons<\/h3>\n
Giving It All Away<\/span><\/h2>\n
How to Securely Wipe Hard Drives<\/span><\/h2>\n
\n
Overwriting Data<\/h3>\n
Degaussing<\/h3>\n
Physical Destruction of Drives<\/span><\/h2>\n
The Cloud and Software-as-a-Service<\/span><\/h2>\n
Not Just Hard Drives<\/span><\/h2>\n
\n
Find a Trusted Partner<\/span><\/h2>\n
\n
Cradle to Grave<\/span><\/h2>\n
The Bottom Line<\/span><\/h2>\n