1. DATA SECURITY END OF LIFE Andy Crawford acrawford@destructdata.com 5/23/20151Florida Gulf Coast ARMA Chapter

2. 263,470,869 5/23/20152Florida Gulf Coast ARMA Chapter

3. Protecting Data Before, During and After 5/23/20153Florida Gulf Coast ARMA Chapter

4. Where is End of Life Data Contained? Electronic Media Types and Forms – Optical Discs (CD / DVD) – Hard Disc Drives (HDD) – Magnetic Tape – Floppy Discs – Flash Memory 5/23/2015Florida Gulf Coast ARMA Chapter4

5. How much is a Megabyte? 5/23/2015Florida Gulf Coast ARMA Chapter5 8 bits equals 1 Byte 1024 bytes equal 1 Kilobytes. 1024 Kilobytes equals 1 Megabyte. 1024 Megabytes equals 1 Gigabytes. 1024 Gigabytes equals 1 Terabyte.

6. CD’s and DVD’s 5/23/2015Florida Gulf Coast ARMA Chapter6 CD-ROMs are capable of holding up to 300,000 pages of data on a single disc. (870 MB) 5,000 sheets of paper equals 1 box of paper. This equates to 60 Boxes of Data DVD’s are capable of holding up to 2,000,000 pages of data on a single disc. (4.7 GB) 40 Cartons equals 1 pallet of paper. This equates to 10 pallets of paper. Half a Semi-Trailer full of information.

7. Hard Disc Drives Range in size and new technology has made it possible to have a 3,000 GB Hard Disc Drive. 60 GB Hard Drive is pretty typical. 60 GB equals over 25 million pieces of paper. – 1 Truck equals 800 cartons of paper. This equates to 6.4 Semi-Trucks full of paper. 5/23/2015Florida Gulf Coast ARMA Chapter7

8. Magnetic Tape In 2007 IBM and Fujifilm were close to releasing an 8 Terabyte Magnetic Tape Reel. – This Equates to over 3.4 billion sheets of paper. – 870 Semi Trucks full of data. 5/23/2015Florida Gulf Coast ARMA Chapter8

9. Floppy Discs Could hold up to 1 Megabyte of information. – Not used much anymore. – 1 Floppy Disc would hold up to 415 pages of information. – Less than one Ream of paper. 1 Ream equals 500 sheets of paper. 5/23/2015Florida Gulf Coast ARMA Chapter9

10. Flash Drives Sizes range from 512,000 MB to 4 GB. – A 4 GB Flash Drive is capable of holding up to 1,700,000 sheets of information. – This equates to 340 boxes of paper. 5/23/2015Florida Gulf Coast ARMA Chapter10

11. Economic Impact Economic Impact in 2008 – $6.65 Million – $202 per record lost Increased by $64 per person since 2005 40% Increase – Customer Churn Health Care – 6.5% Financial – 5.5% Consumers – $6,400.00 – 40 Hours Highs of 200 Hours. 5/23/2015Florida Gulf Coast ARMA Chapter11

12. Regulatory Drivers – Penalty Matrix Gramm Leach Bliley Financial Service Modernization Act Sarbanes Oxley Public Company Accounting Reform & Investor Protection Act FACTA Fair & Accurate Credit Transaction Act HIPAA Health Insurance Portability Accountability Act Directors and Officers (per violation) $10,000$1 Million$50,000 Institution (per violation) $100,000$5 Million$11,000$250,000 Years in Prison 5-12201-10 FDIC Insurance Terminated Impact on Operations Cease and Desist 5/23/201512Florida Gulf Coast ARMA Chapter

13. Most People’s Idea 5/23/201513Florida Gulf Coast ARMA Chapter

14. Data Security Life Cycle Data Origin Data at Rest Data in Motion Data in Use Data at EOL 5/23/201514Florida Gulf Coast ARMA Chapter

15. Show me the money Billions of dollars spent protecting data in the first 4 stages Firewalls Login Passwords Encryption Special screens and more… 5/23/201515Florida Gulf Coast ARMA Chapter

16. End of Life No figures on end of life – Significantly less Money Effort Tuesdays and Thursdays – Pull hard drive – Place in burn bag – Hand to driver 5/23/201516Florida Gulf Coast ARMA Chapter

17. Where do they all go? For every 10 Hard Drives that enter the market… ….7 Hard Drives are taken out of the market. 5/23/201517Florida Gulf Coast ARMA Chapter

18. End of Life Myths Hard Drives – Deleting Files – Reformatting – Reinstalling Operating System – Software Overwriting? 5/23/201518Florida Gulf Coast ARMA Chapter

19. DoD 5220 Software Overwriting – DoD Wipe – 3 Pass – 7 Pass – Guttman – Free What is it missing? – HPA – DCO – G-List 5/23/201519Florida Gulf Coast ARMA Chapter

20. Degaussing and Secure Erase Degaussing – How does it work? – eWaste – Verification – Audit Trail Secure Erase – What is it? – Who Invented it – Verification – Audit Trail 5/23/201520Florida Gulf Coast ARMA Chapter

21. CD-Rom DVD Destruction 5/23/2015Florida Gulf Coast ARMA Chapter21

22. 22 Digital Data Destruction Level of Tier Destruction Friend’s Tel # Tel # PatientRecords Thermal-Nuclear Launch Codes High Low High Low Cost to Reconstruct Value Of Data

23. Setting Policy DoD 5220 – National Security Information Program – NISPOM 5220 – January 1995 3 Pass – February 2006 Left up to CSA DoD CIA NSA 5/23/201523Florida Gulf Coast ARMA Chapter This Manual cancels DoD 5220.22-S-1, “COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information,” August 1983.

24. NIST 800-88 Covers all types of media Good source for information – Commercial – Government Clear – Single pass – All addressable sectors Purge – Degauss – FW Based solution (Secure Erase) Physical Destruction – Shred, Pulverize 5/23/201524Florida Gulf Coast ARMA Chapter

25. NIST 800-88 MethodsHow 5/23/201525Florida Gulf Coast ARMA Chapter

26. “Best Safe Practices” Digital Data Destruction – Hard Disc Drives Recommendations & Guidelines from NIST on Hard Drive Destruction – HDD- Media NIST SP-800-88 September 2006 5/23/2015Florida Gulf Coast ARMA Chapter26 ATA/SATA/SCSI Dri HDD- Media NIST SP-800-88 September 2006 ves Overwrite media by using agency-approved and validated overwriting technologies/methods/tools. (ATA Drives) Purge using Secure Erase. The Secure Erase software can be download from the University of California, San Diego (UCSD) CMRR site. Purge hard disk drives by either purging the hard disk drive in an NSA/CSS-approved automatic degausser or by disassembling the hard disk drive and purging the enclosed platters with an NSA/CSS-approved degaussing wand. ***Degaussing any current generation hard disk will render the drive permanently unusable.  Disintegrate.  Shred.  Pulverize.  Incinerate. Incinerate hard disk drives by burning the hard disk drives in a licensed incinerator.

27. “Best Safe Practices” Digital Data Destruction – CD / DVD Discs 5/23/2015Florida Gulf Coast ARMA Chapter27 Recommendations & Guidelines from NIST on Optical Media Destruction – HDD- Media NIST SP-800-88 September 2006 Optical Disks – CD/DVD Media NIST SP-800-88 September 2006 See Physical Destruction See Physical Destruction Destroy in order of recommendations: 1.  Removing the Information bearing layers of CD media using a commercial optical disk grinding device. 2. Incinerate optical disk media (reduce to ash) using a licensed facility. 3. Use optical disk media shredders or disintegrator devices to reduce to particles that have a nominal edge dimensions of five millimeters (5 mm) and surface area of twenty-five square millimeters (25 mm 2 ). ** ** This is a current acceptable particle size. Any future disk media shredders obtained should reduce CD to surface area of.25mm².

28. “Best Safe Practices” Digital Data Destruction – Magnetic Tapes Recommendations and & Guidelines from NIST on Tape Destruction – HDD- Media NIST SP-800-88 September 2006 5/23/2015Florida Gulf Coast ARMA Chapter28 Magnetic Tapes –NIST 800-88 September 2006 Clear magnetic tapes by either re-recording (overwriting) or degaussing. Clearing a magnetic tape by re-recording (overwriting) may be impractical for most applications since the process occupies the tape transport for excessive time periods. Clearing by Overwriting: Overwriting should be performed on a system similar to the one that originally recorded the data. For example, overwrite previously recorded classified or sensitive VHS format video signals on a comparable VHS format recorder. All portions of the magnetic tape should be overwritten one time with known non-sensitive signals. Degauss using an NSA/CSS-approved degausser. Purging by Degaussing: Purge the magnetic tape in any degausser that can purge the signal enough to prohibit playback of the previous known signal. Purging by degaussing can be accomplished easier by using an NSA/CSS-approved degausser for the magnetic tape.  Incinerate by burning the tapes in a licensed incinerator.  Shred. Preparatory steps, such as removing the tape from the reel or cassette prior to destruction, are unnecessary. However, segregation of components (tape and reels or cassettes) may be necessary to comply with the requirements of a destruction facility or for recycling measures.

29. “Best Safe Practices” Digital Data Destruction – Flash Drives Recommendations and & Guidelines from NIST on Flash Destruction: – HDD- Media NIST SP-800-88 September 2006 5/23/2015Florida Gulf Coast ARMA Chapter29 Flash Memory-NIST SP 800-88 September 2006 Compact Flash Drives, SD Overwrite media by using agency-approved and validated overwriting technologies/methods/tools. See Physical Destruction.Destroy media in order of recommendations.  Shred. Disintegrate. Pulverize. Incinerate by burning in a licensed incinerator.

30. NIST Users 5/23/201530Florida Gulf Coast ARMA Chapter Florida House Bill 1066 Florida Senate Bill1366

31. Don’t forget.. 5/23/201531Florida Gulf Coast ARMA Chapter

32. 5/23/201532Florida Gulf Coast ARMA Chapter

33. Disposal What is in a Hard Drive? – Lead – Brominated Flame Retardants – Barium – Mercury – Beryllium – Cadmium 5/23/201533Florida Gulf Coast ARMA Chapter

34. CDs 5/23/201534Florida Gulf Coast ARMA Chapter

35. State E-Waste Guidelines 19 States already have E- Waste Legislation All states will have in 2 – 3 years. Makes it illegal to dump E- Waste in landfills Puts a carbon tax on manufacturers 5/23/201535Florida Gulf Coast ARMA Chapter

36. Keys Education Discipline Understand Levels 5/23/201536Florida Gulf Coast ARMA Chapter

37. Education All employees – Used laptops – Used hard drives System Administrators – Always new things to learn – OS and Networking Hands on training versus multiple choice 5/23/201537Florida Gulf Coast ARMA Chapter

38. Discipline The human factor – Affects everything Lazy or Doesn’t understand task completely 5/23/201538Florida Gulf Coast ARMA Chapter

39. Security Matrix Time to recover Level of Effort – Cost to recover Labor Equipment Information Importance – Classified – Personal 5/23/201539Florida Gulf Coast ARMA Chapter

40. In the field -vs- In the lab Emergency Destruct – Iranian Embassy – EP3 Home on the range – More time – Destruction before transit 5/23/201540Florida Gulf Coast ARMA Chapter

41. Technology Changes Technology is not affected by bureaucracy – Patterned Media – Heat Assisted Recording – Holographic Media Laws and Regs have to change too! 5/23/201541Florida Gulf Coast ARMA Chapter

42. Points to Remember What regulations govern your EOL security? Are they up to date to meet today's standards? Even if you cannot RESUSE your hard drives…you should PURGE the data before you hand over for destruction or Degausing! Don’t forget security at EOL!! 5/23/201542Florida Gulf Coast ARMA Chapter

43. Contact Info Andy Crawford 727.596.2109 727.656.5744 acrawford@destructdata.com 5/23/201543Florida Gulf Coast ARMA Chapter