5 POINTS OF FAILURE IN THE DATA WIPING PROCESS

Data Wiping can be a tricky thing to handle. The process of identifying, auditing, and deleting data is a veritable minefield – and failure to understand this complexity can only increase the dangers exponentially.

Thankfully, there is a solution to many of these threats in the form of education and preparation. The lion’s share of failures through the data wiping process comes down to poor implementation of badly documented processes, and as such, understanding these failures and creating a plan to handle them can negate much, if not all, of the potential damage they can wreak, both economic and otherwise.

That’s exactly what we aim to do with this piece. We’re going to discuss five common points of failure in the data wiping process, and address some actions that can be taken to ensure these issues are limited in both scope and damage.

1 – Poor Scope Identification

A huge potential failure point is in misidentifying the scope and breadth of data that needs to be wiped. Data left on a hard drive in essentially space that cannot be used elsewhere. Additionally, data left over that is no longer in use but is still legally protected via edicts in the European Union or the United States may not only be a space eater, but a legal complication.

Thus, when choosing data for deletion, identifying the proper scope is vitally important. When looking at the data that is to be deleted, a basic rubric must be adhered to, ensuring that data of a similar type and similar range is the correct data for deletion.

2 – Failing to Identify Data as In Use

Would the loss of this data be catastrophic to any business function or tertiary function? This is mostly related to hidden records as part of database management. Deleting all the records for a salesperson is fine, but if you’re deleting content that doesn’t have data integrity enforcements, you could very easily cause your database to failover due to null entries and cause a catastrophic cascading failure.

Likewise, choosing not to delete data when it’s not in use can have drastic effects on the rest of the functionality of the greater system, eating up processing power and space.

Failure to maintain records of vital data for legal purposes is a huge issue in the data management world, one which comes with hefty fines and punishments. If data is being sought for legal purposes, destroying this data would be considered destruction of evidence, and would be even more severely punished.

3 – Improperly Erasing Drives

This seems like a no-brainer, but improper drive erasure is a serious issue. Not every drive is going to be wiped because the data is no longer useful – it might be wiped for use in another system or computer. In this case, if the drive has poorly formed sectors or bad platters that need to be replaced, data chunks can still remain on the drive long after the fact, causing an unintentional data leak and resultant exposure that can be hugely damaging.

Not everything is physical, however – poor erasure can also arise during the process itself in application. Not choosing the correct write cycle, or incorrectly marking files for deletion, can result in drives that aren’t really wiped, ghost chunks of data left over, and an overall ineffective process.

Additionally, poorly chosen methodologies fall into this category. While it’s tempting to just argue for software deletion to save money, some hardware really does need to be magnetically separated or shredded by speciality devices, and if those devices aren’t properly handled, these issues are drastically magnified.

4 – Poor Processing and Documentation
Speaking of the process, a huge point of failure is one of process. Improper documentation of the correct data wiping process causes most of the issues on this list, but as an extension of this, we also find it very typical to have poor documentation of the erased drive proper.

When a drive is erased, it should have an established chain of custody at each point in the process from identification to remediation/reinstallation. Doing so allows for tracking of responsibility at each stage in the process. Failing to do so removes any sort of accountability, and can very quickly result in unsanitized drives in the production space.

This would have the effect of not only harming production overall with bad sectors, read/write, etc., but also have the effect of unnecessarily exposing data in such a way as to make it functionally public.

This is very clearly a huge deal, which is why it’s so frustrating to see – it could be extremely easily fixed, with very minimum effort. Something as simple as a binder with signatures marking chain of custody and signing off on quality control could all but negate this process, with other more complex solutions offering even greater granular authority control and accountability.

5 – Industry Compliance

Data is not yours – data might be operated upon by you and others, but data is owned by the subject which produced it. Accordingly, this data is protected by a vast amount of regulations and laws.

Accordingly, each industry has very specific laws governing the collection, maintenance, and destruction of data, and during the data destruction process, a data compliance officer should be appointed and made responsible for adhering to these laws.

Some of these regulations include:

• Sarbanes-Oxley Act (SOx) – A law ensuring regulatory oversight for the investment industry;

• HIPAA & HITECH – A series of regulations governing the collection, transmission, storage, and destruction of healthcare data;

• The Fair and Accurate Credit Transactions Act of 2003 (FACTA) – An act created to protect consumers from identity theft which governs both collection, transmission, and destruction of personal financial information;

• Payment Card Industry Data Security Standard (PCI DSS) – A standard meant to protect those who use debit, point of sale, or credit payment methodologies;

• Personal Information Protection and Electronic Documents Act (PIPEDA) – An act designed to govern the protection of personal data in the electronic space; and

• EU data protection directive of 1995 – An international law governing every aspect of personal data for citizens living in the European Union and corporations who do business within.

Failing to comply with any of these laws could be catastrophic, with fines in the hundreds of thousands cumulatively. Moreso, these laws exist for a very specific purpose – because previous efforts were so lax in their data destruction that these kinds of laws were made necessary.

Accordingly, sticking to these laws and acts is much more about adherence to basic standards rather than a legal argument. These standards have all been reviewed and tested, so as long as you adhere to them, you know that your data processing is industry standard at worst, and excellent at best.

All About Processes

The great news is that all of these issues are primarily solved by proper processing and compliance efforts. Each and every one of these problems, unaddressed, could be hugely damaging – however, making sure you have an internal culture of security can go a long way to ensuring that these issues, when they do arise, are dealt with in a positive and complete way.

Adopting a great tool like ClaraWipe, which matches all of these standards and more, can go a long way – but understanding how to actually use those tools within a good set of standards and processes is what make those tools so powerful.