Скачать презентацию Andy Crawford acrawford destructdata com DATA SECURITY END OF Скачать презентацию Andy Crawford acrawford destructdata com DATA SECURITY END OF

13d8e89ae248b720298e253368170c19.ppt

  • Количество слайдов: 43

Andy Crawford acrawford@destructdata. com DATA SECURITY END OF LIFE 3/19/2018 Florida Gulf Coast ARMA Andy Crawford [email protected] com DATA SECURITY END OF LIFE 3/19/2018 Florida Gulf Coast ARMA Chapter 1

263, 470, 869 3/19/2018 Florida Gulf Coast ARMA Chapter 2 263, 470, 869 3/19/2018 Florida Gulf Coast ARMA Chapter 2

Protecting Data Before, During and After 3/19/2018 Florida Gulf Coast ARMA Chapter 3 Protecting Data Before, During and After 3/19/2018 Florida Gulf Coast ARMA Chapter 3

Where is End of Life Data Contained? • Electronic Media Types and Forms – Where is End of Life Data Contained? • Electronic Media Types and Forms – Optical Discs (CD / DVD) – Hard Disc Drives (HDD) – Magnetic Tape – Floppy Discs – Flash Memory 3/19/2018 Florida Gulf Coast ARMA Chapter 4

How much is a Megabyte? • 8 bits equals 1 Byte • 1024 bytes How much is a Megabyte? • 8 bits equals 1 Byte • 1024 bytes equal 1 Kilobytes. • 1024 Kilobytes equals 1 Megabyte. • 1024 Megabytes equals 1 Gigabytes. • 1024 Gigabytes equals 1 Terabyte. 3/19/2018 Florida Gulf Coast ARMA Chapter 5

CD’s and DVD’s • CD-ROMs are capable of holding up to 300, 000 pages CD’s and DVD’s • CD-ROMs are capable of holding up to 300, 000 pages of data on a single disc. (870 MB) • 5, 000 sheets of paper equals 1 box of paper. • This equates to 60 Boxes of Data • DVD’s are capable of holding up to 2, 000 pages of data on a single disc. (4. 7 GB) • 40 Cartons equals 1 pallet of paper. • This equates to 10 pallets of paper. • Half a Semi-Trailer full of information. 3/19/2018 Florida Gulf Coast ARMA Chapter 6

Hard Disc Drives • Range in size and new technology has made it possible Hard Disc Drives • Range in size and new technology has made it possible to have a 3, 000 GB Hard Disc Drive. • 60 GB Hard Drive is pretty typical. • 60 GB equals over 25 million pieces of paper. – 1 Truck equals 800 cartons of paper. • This equates to 6. 4 Semi-Trucks full of paper. 3/19/2018 Florida Gulf Coast ARMA Chapter 7

Magnetic Tape • In 2007 IBM and Fujifilm were close to releasing an 8 Magnetic Tape • In 2007 IBM and Fujifilm were close to releasing an 8 Terabyte Magnetic Tape Reel. – This Equates to over 3. 4 billion sheets of paper. – 870 Semi Trucks full of data. 3/19/2018 Florida Gulf Coast ARMA Chapter 8

Floppy Discs • Could hold up to 1 Megabyte of information. – Not used Floppy Discs • Could hold up to 1 Megabyte of information. – Not used much anymore. – 1 Floppy Disc would hold up to 415 pages of information. – Less than one Ream of paper. • 1 Ream equals 500 sheets of paper. 3/19/2018 Florida Gulf Coast ARMA Chapter 9

Flash Drives • Sizes range from 512, 000 MB to 4 GB. – A Flash Drives • Sizes range from 512, 000 MB to 4 GB. – A 4 GB Flash Drive is capable of holding up to 1, 700, 000 sheets of information. – This equates to 340 boxes of paper. 3/19/2018 Florida Gulf Coast ARMA Chapter 10

Economic Impact • Economic Impact in 2008 – $6. 65 Million – $202 per Economic Impact • Economic Impact in 2008 – $6. 65 Million – $202 per record lost • Increased by $64 person since 2005 • 40% Increase – Customer Churn • Health Care – 6. 5% • Financial – 5. 5% • Consumers – $6, 400. 00 – 40 Hours • Highs of 200 Hours. 3/19/2018 Florida Gulf Coast ARMA Chapter 11

Regulatory Drivers – Penalty Matrix Gramm Leach Bliley Financial Service Modernization Act Directors and Regulatory Drivers – Penalty Matrix Gramm Leach Bliley Financial Service Modernization Act Directors and Officers (per Sarbanes Oxley Public Company Accounting Reform & Investor Protection Act $10, 000 $5 Million 5 -12 Fair & Accurate Credit Transaction Act $1 Million $100, 000 FACTA 20 HIPAA Health Insurance Portability Accountability Act $50, 000 violation) Institution (per violation) Years in Prison FDIC Insurance Impact on Operations 3/19/2018 $11, 000 $250, 000 1 -10 Terminated Cease and Desist Florida Gulf Coast ARMA Chapter 12

Most People’s Idea 3/19/2018 Florida Gulf Coast ARMA Chapter 13 Most People’s Idea 3/19/2018 Florida Gulf Coast ARMA Chapter 13

Data Security Life Cycle Data Origin Data at EOL Data at Rest Data in Data Security Life Cycle Data Origin Data at EOL Data at Rest Data in Use 3/19/2018 Data in Motion Florida Gulf Coast ARMA Chapter 14

Show me the money Billions of dollars spent protecting data in the first 4 Show me the money Billions of dollars spent protecting data in the first 4 stages • • • Firewalls Login Passwords Encryption Special screens and more… 3/19/2018 Florida Gulf Coast ARMA Chapter 15

End of Life • No figures on end of life – Significantly less • End of Life • No figures on end of life – Significantly less • Money • Effort • Tuesdays and Thursdays – Pull hard drive – Place in burn bag – Hand to driver 3/19/2018 Florida Gulf Coast ARMA Chapter 16

Where do they all go? For every 10 Hard Drives that enter the market… Where do they all go? For every 10 Hard Drives that enter the market… New Hard Drives Shipped vs. Retired Units Entering Secondary Markets Millions of Units Shipped 600 500 Units Shipped 400 300 Units Retired 200 100 0 2002 2003 2004 Years 2005 2006 2007 …. 7 Hard Drives are taken out of the market. 3/19/2018 Florida Gulf Coast ARMA Chapter 17

End of Life Myths • Hard Drives – – 3/19/2018 Deleting Files Reformatting Reinstalling End of Life Myths • Hard Drives – – 3/19/2018 Deleting Files Reformatting Reinstalling Operating System Software Overwriting? Florida Gulf Coast ARMA Chapter 18

Do. D 5220 • Software Overwriting – – – Do. D Wipe 3 Pass Do. D 5220 • Software Overwriting – – – Do. D Wipe 3 Pass 7 Pass Guttman Free • What is it missing? – HPA – DCO – G-List 3/19/2018 Florida Gulf Coast ARMA Chapter 19

Degaussing and Secure Erase • Degaussing – – How does it work? e. Waste Degaussing and Secure Erase • Degaussing – – How does it work? e. Waste Verification Audit Trail • Secure Erase – – 3/19/2018 What is it? Who Invented it Verification Audit Trail Florida Gulf Coast ARMA Chapter 20

CD-Rom DVD Destruction 3/19/2018 Florida Gulf Coast ARMA Chapter 21 CD-Rom DVD Destruction 3/19/2018 Florida Gulf Coast ARMA Chapter 21

Digital Data Destruction Thermal-Nuclear Launch Codes Value Of Data Cost to Reconstruct High Patient Digital Data Destruction Thermal-Nuclear Launch Codes Value Of Data Cost to Reconstruct High Patient Records Friend’s Tel # Low Level of Tier Destruction 22

Setting Policy • Do. D 5220 – National Security Information Program – NISPOM 5220 Setting Policy • Do. D 5220 – National Security Information Program – NISPOM 5220 – January 1995 • 3 Pass – February 2006 • • Left up to CSA Do. D CIA NSA This Manual cancels Do. D 5220. 22 -S-1, “COMSEC Supplement to the Industrial Security Manual for Safeguarding Classified Information, ” August 1983. 3/19/2018 Florida Gulf Coast ARMA Chapter 23

NIST 800 -88 • Covers all types of media • Good source for information NIST 800 -88 • Covers all types of media • Good source for information – Commercial – Government • Clear – Single pass – All addressable sectors • Purge – Degauss – FW Based solution (Secure Erase) • Physical Destruction – Shred, Pulverize 3/19/2018 Florida Gulf Coast ARMA Chapter 24

NIST 800 -88 Methods 3/19/2018 How Florida Gulf Coast ARMA Chapter 25 NIST 800 -88 Methods 3/19/2018 How Florida Gulf Coast ARMA Chapter 25

“Best Safe Practices” Digital Data Destruction – Hard Disc Drives • Recommendations & Guidelines “Best Safe Practices” Digital Data Destruction – Hard Disc Drives • Recommendations & Guidelines from NIST on Hard Drive Destruction – HDD- Media NIST SP-800 -88 September 2006 ATA/SCSI Dri. HDD- Media NIST SP-800 -88 September 2006 ves 3/19/2018 Overwrite media by using agencyapproved and validated overwriting technologies/methods/tools. (ATA Drives) Purge using Secure Erase. The Secure Erase software can be download from the University of California, San Diego (UCSD) CMRR site. Purge hard disk drives by either purging the hard disk drive in an NSA/CSS-approved automatic degausser or by disassembling the hard disk drive and purging the enclosed platters with an NSA/CSS-approved degaussing wand. ***Degaussing any current generation hard disk will render the drive permanently unusable. Florida Gulf Coast ARMA Chapter Disintegrate. Shred. Pulverize. Incinerate hard disk drives by burning the hard disk drives in a licensed incinerator. 26

“Best Safe Practices” Digital Data Destruction – CD / DVD Discs • Recommendations & “Best Safe Practices” Digital Data Destruction – CD / DVD Discs • Recommendations & Guidelines from NIST on Optical Media Destruction – HDD- Media NIST SP-800 -88 September 2006 Optical Disks – CD/DVD Media NIST SP-800 -88 September 2006 See Physical Destruction 3/19/2018 Destroy in order of recommendations: 1. Removing the Information bearing layers of CD media using a commercial optical disk grinding device. 2. Incinerate optical disk media (reduce to ash) using a licensed facility. 3. Use optical disk media shredders or disintegrator devices to reduce to particles that have a nominal edge dimensions of five millimeters (5 mm) and surface area of twenty-five square millimeters (25 mm 2). ** ** This is a current acceptable particle size. Any future disk media shredders obtained should reduce CD to surface area of. 25 mm². Florida Gulf Coast ARMA Chapter 27

“Best Safe Practices” Digital Data Destruction – Magnetic Tapes • Recommendations and & Guidelines “Best Safe Practices” Digital Data Destruction – Magnetic Tapes • Recommendations and & Guidelines from NIST on Tape Destruction – HDD- Media NIST SP-800 -88 September 2006 Magnetic Tapes –NIST 800 -88 September 2006 Clear magnetic tapes by either re-recording (overwriting) or degaussing. Clearing a magnetic tape by re-recording (overwriting) may be impractical for most applications since the process occupies the tape transport for excessive time periods. Clearing by Overwriting: Overwriting should be performed on a system similar to the one that originally recorded the data. For example, overwrite previously recorded classified or sensitive VHS format video signals on a comparable VHS format recorder. All portions of the magnetic tape should be overwritten one time with known non-sensitive signals. 3/19/2018 Degauss using an NSA/CSS-approved degausser. Purging by Degaussing: Purge the magnetic tape in any degausser that can purge the signal enough to prohibit playback of the previous known signal. Purging by degaussing can be accomplished easier by using an NSA/CSS-approved degausser for the magnetic tape. Florida Gulf Coast ARMA Chapter Incinerate by burning the tapes in a licensed incinerator. Shred. Preparatory steps, such as removing the tape from the reel or cassette prior to destruction, are unnecessary. However, segregation of components (tape and reels or cassettes) may be necessary to comply with the requirements of a destruction facility or for recycling measures. 28

“Best Safe Practices” Digital Data Destruction – Flash Drives • Recommendations and & Guidelines “Best Safe Practices” Digital Data Destruction – Flash Drives • Recommendations and & Guidelines from NIST on Flash Destruction: – HDD- Media NIST SP-800 -88 September 2006 Flash Memory-NIST SP 800 -88 September 2006 Compact Flash Drives, SD 3/19/2018 Overwrite media by using agency-approved and validated overwriting technologies/methods/tools. See Physical Destruction. Florida Gulf Coast ARMA Chapter Destroy media in order of recommendations. Shred. Disintegrate. Pulverize. Incinerate by burning in a licensed incinerator. 29

NIST Users Florida House Bill 1066 Florida Senate Bill 1366 3/19/2018 Florida Gulf Coast NIST Users Florida House Bill 1066 Florida Senate Bill 1366 3/19/2018 Florida Gulf Coast ARMA Chapter 30

Don’t forget. . 3/19/2018 Florida Gulf Coast ARMA Chapter 31 Don’t forget. . 3/19/2018 Florida Gulf Coast ARMA Chapter 31

3/19/2018 Florida Gulf Coast ARMA Chapter 32 3/19/2018 Florida Gulf Coast ARMA Chapter 32

Disposal • What is in a Hard Drive? – Lead – Brominated Flame Retardants Disposal • What is in a Hard Drive? – Lead – Brominated Flame Retardants – Barium – Mercury – Beryllium – Cadmium 3/19/2018 Florida Gulf Coast ARMA Chapter 33

CDs 3/19/2018 Florida Gulf Coast ARMA Chapter 34 CDs 3/19/2018 Florida Gulf Coast ARMA Chapter 34

State E-Waste Guidelines • 19 States already have EWaste Legislation • All states will State E-Waste Guidelines • 19 States already have EWaste Legislation • All states will have in 2 – 3 years. • Makes it illegal to dump EWaste in landfills • Puts a carbon tax on manufacturers 3/19/2018 Florida Gulf Coast ARMA Chapter 35

Keys • Education • Discipline • Understand Levels 3/19/2018 Florida Gulf Coast ARMA Chapter Keys • Education • Discipline • Understand Levels 3/19/2018 Florida Gulf Coast ARMA Chapter 36

Education • All employees – Used laptops – Used hard drives • System Administrators Education • All employees – Used laptops – Used hard drives • System Administrators – Always new things to learn – OS and Networking • Hands on training versus multiple choice 3/19/2018 Florida Gulf Coast ARMA Chapter 37

Discipline • The human factor – Affects everything • Lazy or • Doesn’t understand Discipline • The human factor – Affects everything • Lazy or • Doesn’t understand task completely 3/19/2018 Florida Gulf Coast ARMA Chapter 38

Security Matrix • Time to recover • Level of Effort – Cost to recover Security Matrix • Time to recover • Level of Effort – Cost to recover • Labor • Equipment • Information Importance – Classified – Personal 3/19/2018 Florida Gulf Coast ARMA Chapter 39

In the field -vs- In the lab • Emergency Destruct – Iranian Embassy – In the field -vs- In the lab • Emergency Destruct – Iranian Embassy – EP 3 3/19/2018 • Home on the range – More time – Destruction before transit Florida Gulf Coast ARMA Chapter 40

Technology Changes • Technology is not affected by bureaucracy – Patterned Media – Heat Technology Changes • Technology is not affected by bureaucracy – Patterned Media – Heat Assisted Recording – Holographic Media • Laws and Regs have to change too! 3/19/2018 Florida Gulf Coast ARMA Chapter 41

Points to Remember • What regulations govern your EOL security? • Are they up Points to Remember • What regulations govern your EOL security? • Are they up to date to meet today's standards? • Even if you cannot RESUSE your hard drives…you should PURGE the data before you hand over for destruction or Degausing! • Don’t forget security at EOL!! 3/19/2018 Florida Gulf Coast ARMA Chapter 42

Contact Info Andy Crawford 727. 596. 2109 727. 656. 5744 acrawford@destructdata. com 3/19/2018 Florida Contact Info Andy Crawford 727. 596. 2109 727. 656. 5744 [email protected] com 3/19/2018 Florida Gulf Coast ARMA Chapter 43