Skip to content

Page076

Degaussing

Degaussing destroys the integrity of magnetic media such as tapes or disk drives by exposing them to a strong magnetic field, destroying the integrity of the media and the data it contains. The drive integrity is typically so damaged that a degaussed disk drive usually can no longer be formatted.

Destruction

Destruction physically destroys the integrity of media by damaging or destroying the media itself, such as the platters of a disk drive. Destructive measures include incineration, pulverizing, shredding, and bathing metal components in acid.

Destruction of objects is more secure than overwriting. It may not be possible to overwrite damaged media (though data may still be recoverable). As previously discussed, data on media such as Solid State Drives cannot be reliably removed via overwriting. Also, some magnetic media such as WORM (Write Once Read Many) drives and CD-Rs (Compact Disc—Recordable) can only be written once and cannot be subsequently overwritten. Highly sensitive data should be degaussed or destroyed (perhaps in addition to overwriting). Destruction enhances defense-in-depth, allowing confirmation of data destruction via physical inspection.

Shredding

A simple form of media sanitization is shredding, a type of physical destruction. Though this term is sometimes used in relation to overwriting of data, here shredding refers to the process of making data printed on hard copy, or on smaller objects such as floppy or optical disks, unrecoverable. Sensitive information such as printed information needs to be shredded prior to disposal in order to thwart a dumpster diving attack.

Paper shredders cut paper to prevent object reuse. Strip-cut shredders cut the paper into vertical strips. Cross-cut shredders are more secure than strip-cut, and cut both vertically and horizontally, creating small paper “confetti.” Given enough time and access to all of the shredded materials, attackers can recover shredded documents, though it is more difficult with cross-cut shredders.

Dumpster diving is a physical attack in which a person recovers trash in hopes of finding sensitive information that has been merely discarded in whole rather than being run through a shredder, incinerated, or otherwise destroyed. Fig. 3.2 shows locked shred bins that contain material that is intended for shredding. The locks are intended to ensure that dumpster diving is not possible during the period prior to shredding.

Fig. 3.2 Locked shred bins. Source: https://commons.wikimedia.org/wiki/File:Confidential_shred_bins.JPG; Photograph by: © BrokenSphere/Wikimedia Commons. Image under permission of Creative Commons Attribution ShareAlike 3.0.