4.2.4 Disposal & Decommissioning

Disposal and decommissioning are the final stages of the information life cycle, ensuring that sensitive data is permanently removed and media is handled according to legal and security standards.

The Information Life Cycle Effective data management follows five distinct phases. Security professionals must understand where protection and retention apply within this flow: - Creation: Data is generated or collected. - Storage: Data is saved to a medium (Cloud, HDD, Tape). - Usage: Data is actively processed or shared. - Archival: Data is moved to long-term storage for retention purposes. - Destruction: Data is permanently eliminated via sanitization or physical destruction.

Data Retention and Compliance Retention policies dictate how long data must be kept before it can be destroyed. This is often driven by legal mandates rather than technical needs. - SOX (Sarbanes-Oxley Act): Heavily impacts public companies, requiring audit workpapers and related emails to be retained for at least five years. - Legal Hold: A process where destruction is paused because the data may be relevant to active or pending litigation. - Regulatory Requirements: Different industries (GDPR for privacy, HIPAA for health) have specific timelines for how long records must remain available.

Data Sanitization and Destruction Sanitization (or purging) ensures that data cannot be recovered using advanced forensic tools. The method used depends on whether the media is legacy (paper) or electronic. - Clearing: Using software to overwrite data with 0s and 1s. This is effective against simple recovery but may not stop laboratory-level forensics. - Purging / Overwriting: A more intense process (often multiple passes) that renders data unrecoverable even by sophisticated means. - Degaussing: Using powerful magnets to disrupt the magnetic field on HDDs or tapes. This is ineffective for SSDs (flash memory). - Physical Destruction: The most secure method; includes shredding, pulping (for paper), incineration, and drilling through drive platters. - NIST SP 800-88: The industry-standard guideline for media sanitization.

Decommissioning Assets When hardware reaches its end-of-life, the decommissioning process must be documented to maintain the chain of custody. - Certificate of Destruction: A formal document provided by third-party disposal services confirming that specific assets (by serial number) were destroyed. - Asset Tracking: Ensuring the inventory is updated so decommissioned devices do not appear as "missing" or "stolen" in audits.

Quick recall - Purging: General term for making data unrecoverable. - Degaussing: Magnetic destruction (HDDs only). - SOX Section 802: Five-year retention for audit papers and email. - Lifecycle phases: Creation, Storage, Usage, Archival, Destruction. - NIST 800-88: The go-to reference for sanitization standards.