Review of the publication NIST SP 800-88 "Guidelines for Media Sanitization"

Ruslan Rakhmetov, Security Vision

The extensive growth of data in electronic form as a result of accelerated automation and digitalisation processes has led to the need for competent management of all stages of the life cycle of confidential information and the physical storage devices that contain it. The evolution of storage technology has also led to the emergence of many obsolete storage devices that contain corporate information but are being decommissioned. Examples include hard disk drives (HDDs), tape drives from previous generations (LTO-7 and earlier), compact discs (CD/DVDs), as well as floppy discs and old flash drives. When these drives become obsolete at the time of decommissioning, it is critical to ensure that the drives are cleaned of sensitive information prior to disposal. The same approach should be taken when devices and drives are transferred to third parties, such as off-site repairs, sales to employees, or donations to charity. NISTdocument SP 800-88 Rev. 1 Guidelines for Media Sanitisation provides guidelines for removing sensitive information from various types of media, depending on the criticality of the data, with roles and responsibilities for the sanitisation process. Below we elaborate on the provisions of this document.

According to the categorisation of NIST SP 800-88, the following methods can be used to sanitise (clean) drives:

1. Clear - Logical deletion of information in all user-accessible data areas using in-house functionality to overwrite the information or reset the device to factory defaults, but with the option to have the data recovered by specialised laboratories.

2. Purge - application of logical and physical methods of information deletion, after which it is impossible to recover data even in specialised laboratories.

3. Destroy - physically destroying a data storage device or appliance and making it impossible to recover the information, even in specialised laboratories.

Decisions about information deletion and drive sanitisation are required throughout the life cycle of information systems, and critical factors affecting such actions should be considered at the very beginning, before system development. Information flow patterns, device and storage specifications and characteristics, and interconnections between information systems must be taken into account. However, information confidentiality also depends on the protection of physical drives and devices: it should be recognised that one way to gain unauthorised access to confidential information is to gain access to discarded or for sale drives and devices (laptops, smartphones, networking equipment and servers and workstations) and attempt to gain access to the files stored on them. Attackers can achieve this either by purchasing used company equipment, by searching for discarded devices and drives, or by recovering information from improperly cleaned drives (e.g., if the company's device is not of sufficient grade to physically destroy the drives). Particular attention should be paid not to the drives themselves, but to the information that was processed on them: a company can dispose of new drives without information or drives that contain publicly available information (e.g., software distributions available on the Internet), but the challenge for information security will be to identify and properly clean the devices on which the protected information was stored. We should not forget about the destruction of hard copies of documents: shredders are also divided into classes and allow shredding printouts with guaranteed impossibility of recovery. In addition to shredding printouts in shredders, they can also be incinerated in special ovens that do not allow recovery of information and are protected from accidental flying out of the oven with the flow of hot air.

As data storage technologies evolve, so do the methods of guaranteed destruction. For example, methods that have been used for magnetic disc drives, such as demagnetisation in degaussers, are not applicable to drives that use other physical principles, such as solid state drives (SSD/NVMe). Smaller electronic drives such as USB sticks and memory cards (SD/microSD) pose a challenge for shredding devices (specific shredders) as they require the minimum shredding unit to be smaller than the physical size of the drive to be shredded: for example, miniature microSD cards with capacities up to 1TB can be difficult to handle. In addition, some drive models have a guaranteed deletion feature built into the firmware, and the credibility of the vendor's implementation may be questionable until independent research is conducted. Another challenge in today's cyberspace will be the need for assured data destruction in mobile devices and cloud infrastructures. In both cases, the Cryptographic erase method, which removes the encryption key rather than the encrypted information itself, can be used. However, the credibility of this method also depends on mobile device vendors and cloud providers: in the former case, it is important to ensure that the encryption of all sensitive information is implemented correctly and that the encryption key is securely removed (and not copied somewhere), and in the latter case, it is important to ensure that the provider does not store a copy of the unencrypted information or encryption key in an unprotected area (e.g., RAM or backups/replicas).

NIST SP 800-88 recommends the use of cryptographic erasure in the following cases:

1. When sensitive information was encrypted before it was written to the media (including both the data itself and copies of the data).

2. When the storage location of the drive containing the encryption key is known and when it is possible to purge these drives.

3. When all encryption key storage locations are known and can be cleared.

4. When the encryption keys are themselves encrypted with an access key and one can be guaranteed to remove these access keys.

5. When it is assured that the user can consciously apply the necessary encryption functions.

Cryptographic erasure is not recommended in the following cases:

1. When drive encryption has been enabled after sensitive information has been written to the drive.

2. When it is unknown whether sensitive information was written to the drive before encryption was enabled.

Organisations should consider the following characteristics when selecting a data wiping method:

1. What type and volume of drive should be purged?

2. What are the privacy requirements of the data stored on the drive?

3. Will the drive operate within a controlled area?

4. Will the cleaning be performed in-house or by a contractor?

5. How many drives will need to be cleaned?

6. What is the availability of tools and equipment to carry out the sanitisation?

7. What is the level of training of staff to operate sanitisation tools and equipment?

8. How long will the sanitisation be carried out?

9. What is the cost of sanitisation including tools, training, verification of actions performed?

The distribution of responsibilities and roles for the data media sanitisation process according to NIST SP 800-88 may be as follows:

1. The head of the organisation is responsible for allocating adequate resources to ensure the success of the processes of identifying drive locations and correct sanitisation.

2. The IT manager is responsible for ensuring that the IS policy requirements are met and that the sanitisation processes comply with its provisions.

3. The information system owner must ensure that methods are in place to ensure the confidentiality of information and drives according to its level of criticality.

4. The information owner is responsible for understanding the level of criticality of information in his area of responsibility and for ensuring that information users understand the data cleansing rules.

5. The IS manager is responsible for creating and enforcing IS policies for information deletion and drive purging using the principles of relevance and responsiveness, and has access to resources and tools to perform sanitisation procedures.

6. Users are responsible for knowing and understanding the level of confidentiality of the information they process and for using it correctly.