Unauthorised Access: Physical Penetration Testing For IT Security Teams

10.6. Data Destruction

If organizations formalized (and followed) the actions laid out in this section it would make the lives of criminals and social engineers (and penetration testers) a lot harder. Sadly, most don't. This leads to confidential data on paper, digital media or hard drives falling into the wrong hands on a regular basis. I won't repeat the points I made in Chapter 6 but I will lay out firm guidelines for each type of media.

10.6.1. Disposing of Data on Digital Media

Too many companies throw hard drives in the trash when they've reached the end of their life or there's no room left in the cupboard for old kit that no one's going to use again. Very few bother to erase the contents first, although a few might perform a cursory format (which erases little). Then there are the companies that sell their old storage media on EBay. This is not the wisest idea. If you really must sell old equipment, ensure that the drives are cryptographically scrubbed using a tool such as DBAN (see Chapter 6 for further details.)

The following policy statements can help protect discarded data:

• Floppy disks, USB drives and magnetic tapes should be cryptographically scrubbed before reuse using [insert preferred tool]. If physically defective, the disks should be destroyed by incineration.

• CDs and DVDs should be shredded or cut into quarters before disposal.

• Hard drives should be cryptographically scrubbed before reuse using [insert preferred tool]. If physically defective, these disks should ...