Data Security End of life

1. Andy Crawford acrawford@destructdata.com Data SecurityEnd of life Florida Gulf Coast ARMA Chapter

2. 263,470,869 Florida Gulf Coast ARMA Chapter

3. Protecting Data Before, During and After Florida Gulf Coast ARMA Chapter

4. Where is End of Life Data Contained? • Electronic Media Types and Forms • Optical Discs (CD / DVD) • Hard Disc Drives (HDD) • Magnetic Tape • Floppy Discs • Flash Memory Florida Gulf Coast ARMA Chapter

5. How much is a Megabyte? • 8 bits equals 1 Byte • 1024 bytes equal 1 Kilobytes. • 1024 Kilobytes equals 1 Megabyte. • 1024 Megabytes equals 1 Gigabytes. • 1024 Gigabytes equals 1 Terabyte. Florida Gulf Coast ARMA Chapter

6. CD’s and DVD’s • CD-ROMs are capable of holding up to 300,000 pages of data on a single disc. (870 MB) • 5,000 sheets of paper equals 1 box of paper. • This equates to 60 Boxes of Data • DVD’s are capable of holding up to 2,000,000 pages of data on a single disc. (4.7 GB) • 40 Cartons equals 1 pallet of paper. • This equates to 10 pallets of paper. • Half a Semi-Trailer full of information. Florida Gulf Coast ARMA Chapter

7. Hard Disc Drives • Range in size and new technology has made it possible to have a 3,000 GB Hard Disc Drive. • 60 GB Hard Drive is pretty typical. • 60 GB equals over 25 million pieces of paper. • 1 Truck equals 800 cartons of paper. • This equates to 6.4 Semi-Trucks full of paper. Florida Gulf Coast ARMA Chapter

8. Magnetic Tape • In 2007 IBM and Fujifilm were close to releasing an 8 Terabyte Magnetic Tape Reel. • This Equates to over 3.4 billion sheets of paper. • 870 Semi Trucks full of data. Florida Gulf Coast ARMA Chapter

9. Floppy Discs • Could hold up to 1 Megabyte of information. • Not used much anymore. • 1 Floppy Disc would hold up to 415 pages of information. • Less than one Ream of paper. • 1 Ream equals 500 sheets of paper. Florida Gulf Coast ARMA Chapter

10. Flash Drives • Sizes range from 512,000 MB to 4 GB. • A 4 GB Flash Drive is capable of holding up to 1,700,000 sheets of information. • This equates to 340 boxes of paper. Florida Gulf Coast ARMA Chapter

11. Economic Impact • Economic Impact in 2008 • $6.65 Million • $202 per record lost • Increased by $64 per person since 2005 • 40% Increase • Customer Churn • Health Care • 6.5% • Financial • 5.5% • Consumers • $6,400.00 • 40 Hours • Highs of 200 Hours. Florida Gulf Coast ARMA Chapter

12. Regulatory Drivers – Penalty Matrix Florida Gulf Coast ARMA Chapter

13. Most People’s Idea Florida Gulf Coast ARMA Chapter

14. Data Security Life Cycle Florida Gulf Coast ARMA Chapter

15. Show me the money Billions of dollars spent protecting data in the first 4 stages • Firewalls • Login Passwords • Encryption • Special screens • and more… Florida Gulf Coast ARMA Chapter

16. End of Life • No figures on end of life • Significantly less • Money • Effort • Tuesdays and Thursdays • Pull hard drive • Place in burn bag • Hand to driver Florida Gulf Coast ARMA Chapter

17. Where do they all go? For every 10 Hard Drives that enter the market… ….7 Hard Drives are taken out of the market. Florida Gulf Coast ARMA Chapter

18. End of Life Myths • Hard Drives • Deleting Files • Reformatting • Reinstalling Operating System • Software Overwriting? Florida Gulf Coast ARMA Chapter

19. DoD 5220 • Software Overwriting • DoD Wipe • 3 Pass • 7 Pass • Guttman • Free • What is it missing? • HPA • DCO • G-List Florida Gulf Coast ARMA Chapter

20. Degaussing and Secure Erase • Degaussing • How does it work? • eWaste • Verification • Audit Trail • Secure Erase • What is it? • Who Invented it • Verification • Audit Trail Florida Gulf Coast ARMA Chapter

21. CD-Rom DVD Destruction Florida Gulf Coast ARMA Chapter

22. Digital Data Destruction Cost to Reconstruct Thermal-Nuclear Launch Codes Value Of Data High High Patient Records Friend’s Tel # Low Low Level of Tier Destruction

23. Setting Policy • DoD 5220 • National Security Information Program • NISPOM 5220 • January 1995 • 3 Pass • February 2006 • Left up to CSA • DoD • CIA • NSA This Manual cancels DoD 5220.22-S-1, “COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information,” August 1983. Florida Gulf Coast ARMA Chapter

24. NIST 800-88 • Covers all types of media • Good source for information • Commercial • Government • Clear • Single pass • All addressable sectors • Purge • Degauss • FW Based solution (Secure Erase) • Physical Destruction • Shred, Pulverize Florida Gulf Coast ARMA Chapter

25. NIST 800-88 Methods How Florida Gulf Coast ARMA Chapter

26. “Best Safe Practices”Digital Data Destruction – Hard Disc Drives • Recommendations & Guidelines from NIST on Hard Drive Destruction • HDD- Media NIST SP-800-88 September 2006 Florida Gulf Coast ARMA Chapter

27. “Best Safe Practices”Digital Data Destruction – CD / DVD Discs • Recommendations & Guidelines from NIST on Optical Media Destruction • HDD- Media NIST SP-800-88 September 2006 Florida Gulf Coast ARMA Chapter

28. “Best Safe Practices”Digital Data Destruction – Magnetic Tapes • Recommendations and & Guidelines from NIST on Tape Destruction • HDD- Media NIST SP-800-88 September 2006 Florida Gulf Coast ARMA Chapter

29. “Best Safe Practices”Digital Data Destruction – Flash Drives • Recommendations and & Guidelines from NIST on Flash Destruction: • HDD- Media NIST SP-800-88 September 2006 Florida Gulf Coast ARMA Chapter

30. NIST Users Florida House Bill 1066 Florida Senate Bill1366 Florida Gulf Coast ARMA Chapter

31. Don’t forget.. Florida Gulf Coast ARMA Chapter

32. Florida Gulf Coast ARMA Chapter

33. Disposal • What is in a Hard Drive? • Lead • Brominated Flame Retardants • Barium • Mercury • Beryllium • Cadmium Florida Gulf Coast ARMA Chapter

34. CDs Florida Gulf Coast ARMA Chapter

35. State E-Waste Guidelines • 19 States already have E-Waste Legislation • All states will have in 2 – 3 years. • Makes it illegal to dump E-Waste in landfills • Puts a carbon tax on manufacturers Florida Gulf Coast ARMA Chapter

36. Keys • Education • Discipline • Understand Levels Florida Gulf Coast ARMA Chapter

37. Education • All employees • Used laptops • Used hard drives • System Administrators • Always new things to learn • OS and Networking • Hands on training versus multiple choice Florida Gulf Coast ARMA Chapter

38. Discipline • The human factor • Affects everything • Lazy or • Doesn’t understand task completely Florida Gulf Coast ARMA Chapter

39. Security Matrix • Time to recover • Level of Effort • Cost to recover • Labor • Equipment • Information Importance • Classified • Personal Florida Gulf Coast ARMA Chapter

40. In the field -vs- In the lab • Emergency Destruct • Iranian Embassy • EP3 • Home on the range • More time • Destruction before transit Florida Gulf Coast ARMA Chapter

41. Technology Changes • Technology is not affected by bureaucracy • Patterned Media • Heat Assisted Recording • Holographic Media • Laws and Regs have to change too! Florida Gulf Coast ARMA Chapter

42. Points to Remember • What regulations govern your EOL security? • Are they up to date to meet today's standards? • Even if you cannot RESUSE your hard drives…you should PURGE the data before you hand over for destruction or Degausing! • Don’t forget security at EOL!! Florida Gulf Coast ARMA Chapter

43. Contact Info Andy Crawford 727.596.2109 727.656.5744 acrawford@destructdata.com Florida Gulf Coast ARMA Chapter