According to the Identity Theft Resource Center (ITRC), there are approximately 12 million data exposed since the starting of 2017. These occur because of the lack of data sanitization. Lacking data sanitization has been brought a lot of dangers, risks for companies, industries, even for a single person.
To eradicate this issue, the National Institute for Standards and Technology (NIST) has come with some solutions. That solution is known as Data Sanitization. It meets up all the problems nowadays to secure information and data.
What is Data Sanitization?
We know sanitization stands for the public health to have clean water, required sewage system, in a word, this means to look after public health by taking necessary steps like making sure of clean and pure drinking water, nutritious food, fruits, keeping the environment neat and clean. Data sanitization also means the same. It is a process to remove or destroy information or data for good consciously so that that information or data can’t be regained anyhow from a memory device.
Data sanitization plays an important role in the data lifecycle. After a certain time, some data becomes unimportant, out of date, unnecessary in case of usage for a company, or a person, then it is quite obvious not to keep them in a memory device. In that time, data sanitization is required to remove all the unnecessary data permanently so that others can’t recover them. Because it is proven that data recovery which is discarded by others is dangerous. That’s why data sanitization is required.
Methods of Data Sanitization
When a device is sanitized then there will be no recoverable data or information at all, even a forensic tool is unable to recover that data. Some certified methods sanitize data. Three verified methods are trustworthy in this data sanitization process. They are physical destruction, data erasure, and cryptographic erasure. These three only has the verification and certification of data sanitization because they have met the definition of data sanitization.
Physical Destruction
It is one of the most used processes in data sanitization. In this process, all the storage devices like hard drives, smartphones, laptops, and all other memory devices are cut into pieces by shredders or using degaussers.
In the degaussing process, data is destroyed by the powerful magnetic field that provides unrecoverable data. This process is only applicable to hard drive devices and tapes, but after going through this degaussing process those drives and tapes can be reused at all.
Though this process can render unrecoverable data, it is harmful for the environment as it uses a powerful magnetic field.
Data Erasure
This one is the best method in case of security. It is a software-based method in which overwriting strategy is used in all the sectors of any data storage device. In this method, overwriting is used by typing one or zero all over the previous data. As a result, the data becomes unrecoverable.
For applying this method, the software which is being used must permit the standard selection process by which overwriting will occur according to the need of industry and organization.
After doing the overwriting, the used software must verify the process so that it ensures the data sanitization. After verifying the software must give a tamper-proof certificate so that no path is left on the case of data recovery.
Data erasure is not an ordinary method, rather a timelier process than other ones. Again, it compels the organizations and industries to improve the policies and strategies for all the memory or storage devices.
Cryptographic Erasure
Cryptography is a method of securing information and data from being accessed by others for whom the data is not reserved. It converts data into codes so that only the intended ones can use them properly. The word cryptography consists of crypt and graphy where crypt means hidden and graphy means writing. So this ensures writing to be hidden.
Cryptography means to protect information and communication techniques that came from mathematical concepts and a set of calculations called algorithms, to convert messages in ways that are hard to decode.
Cryptographic erasure is a method based on encryption software that is used on the entire data storage device. The encryption software works on the storage or memory device and erases the decryption key. Thus data sanitization has occurred in this method.
Cryptographic erasure must thoroughly check whether the encryption key has eradicated the old key or not and replace it with a new key, providing the data encrypted and the older key unrecoverable.
This encryption method should provide a tamper-proof certificate to ensure the removal of the encryption key. This method is best for insensitive information sanitization. This method also depends on the manufacturer so that the required implementation can be done.
NIST Data Sanitization Standard
NIST stands for National Institute for Standards and Technology. NIST 800-88 is used for the media sanitization process which is published by the National Institute for Standards and Technology. NIST Special Publication 800-88 “Guidelines for Media Sanitization,” is a government document of the United States that gives guidance when the time comes to erase data from electronic storage devices.
This institute gives several standards in case of data sanitization to make the process easier and understandable.
Before data sanitization, NIST tells some guidelines so that the act becomes effective enough. When it comes to data sanitization, then among the three methods one can be chosen according to your access. But before the application of any method, you should categorize your data like below:
1. Regarding confidentiality levels, the data and information should be categorized.
2. Looking at the form of the storage device.
3. Determining the danger of confidentiality.
4. Identifying whether the storage device is going to use or not.
After categorizing you can sanitize data using any of the three methods. But after categorizing you have to look at the following things before applying any method. They are:
Guideline
1. All paper-based media should be thrown away when it is no longer necessary for industry or business use.
2. All electronic storage devices should be sanitized when it is no longer important for business purposes.
3. If you want to sell your electronic storage devices, then you have to sanitize those devices before selling or donation or give away another person. So it should be made to secure your data and information before transferring to anyone by sanitizing data.
If your media is paper-based then you should follow the following recommendation:
1. You can use the shredding method for paper-based media sanitization.
2. A document erasure services should be hired for destroying paper-based media. In this case, a verification certificate of Destruction should be collected from the erasure party, as a shred of evidence that documents were not in existence, and prevented for future usage.
The following are recommended for sanitization and disposal of Electronic Storage Media:
1. Here you can also use the shredding method for destroying non-writeable DVDs, CDs, and floppy disks. 2. You can use the other two methods according to your need. If you have the required software, you can give a powerful magnetic field, then you use that method. But in the end, you have to ensure the work by having a certificate.
These are the standards given by NIST to sanitize data. You should look upon the official website of NIST for current standards.
Conclusion
Nowadays this era is dependent upon data and information. Without information, we can stay a single day. But for this, the data should be secured. If the data is not be secured then you can face huge problems with any other party. That party can make an irreparable loss for you, can blackmail you. So you have to make your data, information, and communication secure after usage. That securing can be done by data sanitization. Here you will get all the ins and out of data sanitization that can help to secure your data. And eventually you will get a secure life.
Leave a Reply