- In this lesson, 15.2,
we're gonna focus in on the information lifecycle,
and then specifically deletion,
disposal and destruction.
Let's start with walking through
the information lifecycle.
We start with either creating information
or collecting information.
And if we're collecting information,
we really wanna be cognizant
of those OECD privacy principles,
that we only collect what we need.
That we collect it with notice and lawfully.
That we already specified the use
for whatever we're gonna collect.
We're not just gonna collect data
'cause we think it might be useful later on, right?
We're gonna be very deliberate
of what we're collecting.
Or we may be creating,
maybe we're creating a spreadsheet
or we're creating a database,
or we're writing the great American novel,
but we could be creating or collecting.
That's the beginning part of information lifecycle.
Then in our production environment,
we're going to be using that information,
but there is a parallel track.
For some of that data,
we are going to make copies of it
and we're going to be retaining it.
So we have these two parallel tracks
of use and retention.
And then we get to the end of its useful life,
whether it's been in use in production
or it's been information that we have archived.
And we get to the end of it
and we either have to dispose of it,
or we need to go a step further
and actually destruct the media
that that information or that data is written on.
So you know how to use data,
so let's talk about retention of data.
Retention is a set of rules, really a policy
that dictates the data sets
that must be kept and for how long.
The data retention strategies must be aligned
with business and legal requirements.
So, for example, here in the US, the SEC,
the Securities and Exchange Commission,
requires that certain financial documents
be retained for seven years.
And the IRS, our Internal Revenue Service,
says that payroll tax records
have to be retained for seven years.
And there may be other state
and federal requirements that apply to you.
And, of course, wherever you are in the world,
right, you wanna look at the requirements
for your jurisdiction.
Then there may be other data that you want
to retain, kind of on a discretionary.
It's like, oh, I think we should keep our email
or I wanna keep X, Y, Z kind of records.
And my suggestion to you is before
you make that decision,
that you consult with legal counsel
because there's always pros
and cons of retaining information.
So once we have determined our retention rules,
then we go through the process
of actually saving that data.
And the process is referred to as archiving.
Archiving, the process
of securely storing original, unmodified files
for later potential retrieval.
Now, data should be archived
in accordance with its retention schedule,
it should be stored securely in accordance
with its classification
and it should be properly disposed of
at the end of the retention period.
Now, I wanna make sure that we make
the distinction between archiving and backup.
When we archive something,
we are making a copy of it,
and that copy will forevermore remain unmodified.
So we have an original document.
We make another copy of it.
It looks exactly like the original document, right?
It is pristine, it is unmodified
and it is put away so if we need to go back
to that original document later on, we can.
That's really different than backup and replication.
Backup and replication is the process
of making copies of data
to ensure recoverability.
So what we're trying to do there
is our production data, right, if,
for some reason, it got corrupted,
it got deleted, system failed, whatever,
we could restore that production data.
So backup and replication
is a distinctly different process
than archiving 'cause in backup and replication,
we're always backing up whatever
the current data state is,
whatever that data looks like at that moment.
Where, once again, archiving,
we store this unmodified, pristine file
that maybe we have to go back to later on,
no matter how many times it's been edited
further down the line.
Now, there might be another situation
that you encounter where you have
to also save documents, and that's a legal hold.
A legal hold is a requirement
for an organization to preserve all forms
of relevant information when litigation, audit
or a government investigation
is reasonably anticipated.
Now, the objective is to avoid evidence spoliation,
which means that you either modify that evidence
or even delete that evidence.
Now, a legal hold is gonna supersede
your organizational retention policies.
So perhaps you don't have a retention policy
on saving your emails,
but you get a legal hold,
and the legal hold says all emails
from person A to person B, you must save.
So even though that's not in your retention policy,
this legal hold is going to supersede
that retention policy.
And then we get to the end of useful life.
So we've reached the end of useful life
for the data in production,
or it could be end of useful life for the data
that you now have archived,
and we need to get rid of it.
So how do we do it?
Well, we know that conventional data deletion
does not delete data, right?
If you just click delete,
it doesn't delete the data, right?
If you put it in the trash bin
and then you empty the trash bin,
it does not delete the data.
So what does happen?
Well, when a file is deleted,
the corresponding entry
in the file system directory is cleared
and the directory index is marked
as ready to be reused,
but that ones and zeros still exist
on the media, right?
The original file remains intact
until the space is used
and the original file is overwritten.
Now, often, when we overwrite,
we're not overwriting the full file.
So it's very possible
that potentially all or part
of a deleted file entry can be recovered.
Data remanence refers to the residual traces
of data that remain on that storage medium
even after attempts have been made to erase
or delete the information.
Now, there are a number of techniques
that you wanna know to counter data remanence,
and these include data wiping, also known
as data sanitization, encryption
and physical destruction.
And then TRIM is a command that can be used
by operating systems to inform
a solid state drive,
which many of our systems have these days,
which blocks of data are no longer in use.
So when TRIM is executed,
the solid state drive
may immediately erase the associated data,
reducing the likelihood of remanence.
So data sanitization, which is also known
as disk wiping, is a clearing technique
that overwrites all addressable storage
and indexing locations multiple times.
A standard that you may be familiar with is one
that was created by the United States
Department of Defense,
and it's DoD 5220.22-M,
which is a standard that specifies data sanitization methods
for secure erasure of sensitive information
from storage media.
Now, the DoD 5220.22-M method
requires overriding all addressable storage
and indexing locations on the drive
three times, with zeros, with ones
and with random characters,
and then verifies all the writing procedures.
Now, just a little note there, you see
on the bottom that solid state drives
may not be effectively sanitized
using this standard and may require
a manufacturer-specific utility.
But what if we want to just get rid
(laughs) of the media, right?
We wanna destroy the media that
that data is written on.
Well, we have four options: shredding,
pulverizing, pulping and burning.
Now, shredding is physically breaking
the media into pieces.
Pulverizing is reducing media to dust.
Pulping is chemically altering the media.
And then burning is incinerating the media.
So maybe we wanna really take it
to its final end and we just wanna get rid
of that media totally, right?
We could shred, sometimes you'll hear the word shearing,
pulverize, pulp or burn.
But very often, you're going
to outsource that destruction.
There are a number of third-party companies
that actually do all the destruction work.
But if you are going to outsource that work,
you wanna make sure that you receive
a Certificate of Destruction.
Now, a Certificate of Destruction
is gonna be issued by commercial services
upon destruction of the media.
And that Certificate of Destruction,
at a minimum, should include
date of destruction;
the description of the media,
including a serial number,
if that's appropriate; the method
of destruction, burning, shredding,
pulping, pulverizing; who witnessed it;
and the company name, address
and other contact information.
And that, my friends, brings us
to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do it.
A residual representation of data.
One, two, three.
And that's gonna be our data remanence.
A clearing technique that overwrites
addressable storage multiple times.
One, two, three.
And that's gonna be disk sanitization,
also known as disk wiping.
Number three, vendor proof of destruction.
One, two, three.
And that's our Certificate of Destruction.
Number four, rules that dictate the data sets
that must be kept and for how long.
One, two, three.
That's gonna be your retention policy.
And lastly, number five,
the process of reducing media to dust.
All right, this is one of those four destruction techniques.
One, two, three.
And that's gonna be pulverizing.
I hope you did great on those.
Let's do a security-in-action
about confidential data.
Research published in 2019
by security firm Rapid7
revealed how problematic
discarded technology can be.
The researcher, Josh Frantz, bought 85 devices
for $650 at a second-hand store and found
over 366,300 files,
including images and documents.
And after an analysis of each device,
Frantz found email addresses, date of birth,
Social Security numbers and credit card numbers,
driver's license numbers, even passport numbers.
So my question to you is how could this exposure
have been avoided?
Should that information have been there?
We know definitely (laughs) not.
So what could have happened?
How could have that exposure been avoided?
Go ahead and put me on pause
and note some controls, then come on back.
Well, the owners should have sanitized
the drive, right, or the drives before disposal.
Now, alternately, the owners could have used
a third-party service to destroy the drives
by burning, shredding,
pulping or pulverizing.
And if none of the above are feasible, right,
then the hard drives should be removed
from the devices, right, and securely stored
prior to donating or selling a device.
So either you wanna sanitize it.
You can do disk wiping, disk sanitation.
We could destroy those drives.
Or if you really can't do any of those,
well, you need to make sure
that you're not sending systems
to a second-hand store or donating them
to a nonprofit or to a school
with the drives in there.
You wanna make sure that you remove the drives
and you securely store the drives
because you need to protect
any information that's on there.
Doing that, my friends, security-in-action.
All right, there's your word cloud.
Make sure you are comfortable with all of these terms.
You know what they mean,
you could speak to them, you could teach them.
And then, when you're ready,
head on over to our next quiz.