The Cyber Defense eMagazine November Edition for 2023

eing monitored to protect against misuse of data. Because of this threat, it is of the utmost importance
that organizations acquire certified software/hardware solutions or hire a certified IT Asset Disposition
Company (ITAD) to effectively destroy all remnants of data on all data-bearing devices prior to those
devices leaving their secured facilities.
Assets at Risk
The task of destroying this data can sometimes be overwhelming. In a data center, data-bearing assets
range from enterprise storage arrays, hyper-converged storage, servers, blade servers, network
switches, routers, firewalls, storage switches, and access points to assets commonly found in offices. In
an office space, laptops, desktops, high-end Chromebooks, servers, mobile phones, tablets, high-end
printers, scanners, and copiers can all contain sensitive data that must be purged before removal from
the facility. If that list of assets isn’t daunting enough, consider that for each asset type, there may be
hundreds or thousands of combinations of manufacturer, model, and firmware for each device type. Each
of these may behave slightly differently than the other and require either specialized knowledge or
software to properly sanitize the data.
What Standards Exist
Fortunately, there are clear standards for data sanitization in place and new standards being finalized for
both present and future use. Gone are the days of Department of Defense 3X, 5X, and 7X overwrites.
Today’s storage is too varied and overwrites can be ineffective on certain types of storage media. Luckily,
there are standards in place that provide secure, absolute data sanitization with forensic science to back
them up.
1. NIST SP800-88r1 (2014)
o This standard has been the gold standard since its inception. It is no longer being revised and
therefore is not up to date with the latest storage devices and technology. Because of this,
IEEE decided to update it and create a new standard, IEEE 2883.
2. IEEE 2883 (2022/2023)
o This standard picks up where NIST left off and accounts for the latest storage devices. It will
be the new standard moving forward. It addresses both digital sanitization and physical
destruction of data-bearing assets.
Where to find help
Now that this article has rightfully put some fear into anyone in charge of managing these assets as they
make their transition from in-use to end-of-use, take solace in the fact that there are solutions and
services out there that can mitigate data security risks to the highest standards and provide certifications
that can be used for security audits and regulatory compliance. There are vendors that manufacture
Cyber Defense eMagazine – November 2023 Edition 101
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.