J.2(h)_FRTIB_IT_Security_Electronic_Media_Destruction_or_Sanitization_Procedures.pdf

IT Security Electronic Media

Destruction or Sanitization Procedure

Federal Retirement Thrift Investment Board Effective Date: January 1, 2015

Office of Technology Services- Infonnation Assurance Division IT Security Media Destruction or Sanitization Procedure

Table of Contents

Office Enterprise Risk Management (OERM) Docwnent Number FRTIB.307 .0 I

1.0 Overview ·-·····················- ·······························-···········- ···························-·· ..... ·-· ... ······-········ ... -·-··3

2.0 Roles And Responsibilities ••••.•.••••••.•••••••••••••••••••.•.••••••••••••.••••.•••••.•••••.•.•••••••••••••••••••.•••••••••••.••••.••• 3

3.0 Applicable Policies ·-······················································································································ 4

4.0 Procedures ••itt••·•······································•· ... ••·············································································•····· 4

4.1 What and How to Sanitize ..••.•••.•••.•••.••.•••••• -

4.1.1 Types of Media

4.2 Types of Sanitization ••••••••••••.•••••••••••.•••••••.•••••••.••.••••••.••••.•••••.•••••••••••••••••••••.••••..•••.•.••••••• ,"'.5

4.2.1 Choosing the Sanitization Method

4.3 Sanitization

4.3.1 General Use Media to be Sanitized ............................................... - .,, ........ ., .... ,

4.3.2 Enterprise Media and Devices to be Sanitized ···- ········· .. •••• .. ····-··········-····-··6

4.3.3 Required Information for EMDSR .................................................... , •••••• ,

4.3.4 SODR Recommendations···-·-···········-·····-······-·- ·-······

4.3.5 Disposal Validation ........................................... -......................................................... ~ 7

4.3.6 Documentation ..•.•.••......•••.••••...•..•••.••.••...•... ._ •....•.•.•.•. - ···········-····························· 8

5.0 Authorities And Ref ercnccs

6.0 Revision History ··-··············-········-····-··································-····-·············································-8

7 .0 Approval ............................................................................................. ~················································ 9

8.0 Appendices ................................................................................ -···········- ······ .. ·····-··········-··········· 10

Appendix A: Electronic Media Destruction Or Sanitization Documents

Appendix B: Minimum Sanitization Requirements ............................................... - Table B-2. Mobile Device Sanitization ...................... , •• " ........ " ..................................... "

Table B-3. Equipment Sanitiza.tion -··························-·····················- ·······- ······························ 12 Table 8-4. Legacy Magnetic Media Sanitization ••••.•••••••. - Table 8-5. Peripherally Attached Storage Sanitization Table 8-6. Optical Media Sanitization Ta hie 8-7. Flash-Based Storage Device Sanitization ......................................................... - Table B-8. RAM and ROM-Based Storage Device Sanitization ... _. ....... _

Appendix C: Electronic Media Destruction Or Sanitization Flowchart

Appendix D: Glossary ······-·····································································- ···························-············ 23

Page 2 of25

1.0 Overview

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

The Federal Employees' Retirement System Act of 1986 (FERSA) authorized the Federal Retirement Thrift Investment Board (FRTIB), an independent agency of the U.S. Executive Branch, to administer the Thrift Savings Plan (TSP), one of the three components of the new Federal Employees' Retirement System (FERS).

The TSP is a defined contribution plan for U.S. Federal civilian employees (including those covered by the older Civil Service Retirement System (CSRS) as well as members of the uniformed services). FRTIB and TSP are collectively referred to as the Agency. The mission of FRTIB is to administer the TSP solely in the interest of its participants and beneficiaries.

The IT Security Electronic Media Destruction or Sanitization Procedures support the mandate to maintain the confidentiality of the data and information stored and handled by the Agency. When electronic media are transferred, become obsolete, or are no longer usable or required by an information system, it is important to ensure that residual magnetic, optical, electrical, or other representations of data that has been stored on the media or device are not easily recoverable. Sanitization refers to the general process of removing data and information from electronic media, such that there is reasonable assurance that the data may not be easily retrieved and reconstructed. For the purposes of this document the term data shall be understood to include both data and information.

This document sets forth FRTIB's procedures related to electronic media sanitization and destruction. These procedures are applicable to all offices within

FRTIB.

2.0 Roles and Responsibilities

Chief Technical Officer (CTO) - is charged with promulgating information security policy, components of which are electronic media sanitization. The CTO is responsible for ensuring this procedure is communicated to and followed by all offices within FRTIB

System Owner (SO) - is charged with overall health and wellbeing of an FRTIB system to include the confidentiality of the data therein. The SO is responsible for ensuring that maintenance and other contractual agreements have sufficient provisions to protect the confidentiality ofFRTIB data in a manner commensurate with the assessed system security categorization. The SO is also responsible for an accounting of the final disposition of all electronic media and devices before and after the sanitization.

Chief Information Security Officer (C/SO) - is charged with the overall state of security within FRTIB. The CISO is responsible for ensuring that the IT Security Electronic Media Sanitization and Destruction Procedures conform with the National Institute of Standards and Technology Special Publication (NIST SP) 800-53 rev. 4 requirements for systems whose security categorization is moderate.

Page3 of25

Office of Technology Services- Information Assurance Div1sion Office Enterprise Risk Management (OERM) IT Security Media Destruction or Sanitization Procedure Document Number FRTIB.307.01

The CISO is also responsible for ensuring that these requirements are implemented and exercised throughout the organization.

Information System Security Officer (JSSO) - The ISSO is charged with the day to-day implementation and administration of security for their designated system(s). The ISSO shall provide validation of the success of the executed sanitization process and in finding the results satisfactory shall finalize the Electronic Media Destruction or Sanitization Request (EMDSR).

System Administrator (SA) - The SA is charged with the technical aspects of a system. The SA is responsible for the sound implementation of established information assurance policy and procedures. The SA shall initiate the EMDSR.

General User - the general user is responsible for ensuring that any media or device that is damaged or

3.0 Applicable Policies

• Enterprise Information Security and Risk Management (EISRM) Policy

4.0 Procedures

4.1 What and How to Sanitize

4.1.1 Types of Media

Electronic media store the bits and bytes contained in any device, or any part of a device, which represent data or information.

Electronic media includes, but is not limited to:

• Hard disk drives

• Random Access Memory (RAM) Chips

• Read Only Memory (ROM) Chips

• Universal Serial Bus (USB) Drives (also known as thumb drives)

• Digital tape

• Zip Disks

Electronic media may be found in:

• Laptops

• Desktops

• Servers

• Switches, routers, bridges

• Printers

• Copiers

• Fax machines

• CeU phones

• Tablets

• Personal Digital Assistants (PDAs)

• Recording devices

• Any other device which may electronically store FRTIB data or information

Page 4 of25

Office of Technology Services- Information Assurance Division

Office Enterprise Risk Management (OERM) Document Number FRTIB.307 .0 I

The term media shall be understood to also signify devices whose media is integral and is not generally removable. (i.e.: Cell phones, fax machines, etc .... )

4.2 Types of Sanitization

Sanitization is the process of removing any data from electronic media regardless of the type of data. Sanitization includes clearing, purging, and destruction.

Clearing - Clearing infonnation is a level of media sanitization that protects the confidentiality of infonnation against a robust keyboard attack. Simple deletion of items does not suffice for clearing. Clearing must not allow infonnation to be retrieved by data, disk, or file recovery utilities. Overwriting is an acceptable method for clearing media.

Purging - Purging infonnation is a media sanitization process that protects the confidentiality of infonnation against a laboratory attack. For some media, clearing does not suffice for purging. However, for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged. See the system designated ISSO for instructions.

Destroying - Destruction of media is the ultimate form of sanitization. After media are destroyed, they cannot be reused as originally inten~ed . Physical destruction can be accomplished using a variety of methods, including disintegration, incineration, pulverizing, and melting. The application of Destructive techniques may be the only option when the media fails and other Clear or Purge techniques cannot be effectively applied to the media, or when the validation of Clear or Purge methods fails (for known or unknown reasons).

4.2.1 Choosing the Sanitization Method

The sanitization method applied to any media should be predicated on the security categorization method of the system on which it was used.

The Agency currently has no systems at either the High or Low security categorization. As such, this procedure speaks to sanitization of media from Moderate level systems.

The minimum moderate and high level sanitization method requirements for media destruction are listed in Appendix B: Media Sanitization Decision Matrix. These requirements are based on recommendations from NIST SP 800-88 (rev.I) Guidelines for Media Sanitization.

All electronic media used in a moderate system shall at a minimum be cleared. If the media or device is leaving the control of the Agency the medium or device shall be purged. See Appendix A: Media Sanitization Decision Matrix to ensure that at least the requisite minimum sanitization method is performed on the media or device.

Should a high level system be commissioned at the Agency the procedure will be the same, but the method of sanitization will be

Page S of25

Office of Technology Services- Information Assurance Division Office Enterprise Risk Management (OERM) purging as a minimum and destruction with no possibility of reuse of the media or device when the media or device is leaving the control of the Agency.

4.3 Sanitization

Any user may have media or devices that require sanitization. Once an electronic medium or device has reached its end of life, whether through obsolescence or failure, it should be immediately scheduled for sanitization.

4.3.1 General Use Media to be Sanitized

Users should take mobile devices and non-system specific removable media (i.e. thumb drives, memory cards) to their local close support person. (For the purposes of this document any duty assigned to the SODR shall apply to the close support staff as there is no difference in the procedure.). The close support staff should complete an Electronic Media Destruction or Sanitization Request (EMDSR) and an Electronic Media Destruction or Sanitization Checklist.

The completed EMDSR and EMDSR Checklist are forwarded to the CISO for approval. See Appendix A for the Electronic Media Destruction or Sanitization request and the EMDSR Checklist

4.3.2 Enterprise Media and Devices to be Sanitized

For enterprise system media or devices the SA working on the enterprise system shall list the media and devices to be sanitized on an EMDSR and start an EMDSR checklist.

The completed EMDSR is forwarded to the respective SO or SODR for approval. See Appendix A for the Electronic Media Destruction or Sanitization request.

4.3.3 Required Information for EMDSR

The EMDSR must be completed in its entirety to include enough infonnation about the media or device to be sanitized to ensure the proper sanitization method is used to protect the FRTIB data.

The EMDSR requires the requester to provide the following information:

• Requester name

• Requester Department

• System ID

• Media Type

• Part Number (if available)

• Serial Number (if available)

Page 6 of2S

Office ofT ecbnology Services- Infonnation Assurance Division

4.3.4 SODR Recommendations

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

The EMDSR containing a description of the media to be sanitized is then forwarded to the SODR who shall review the request and provide recommendations as to the minimum sanitization process required based on the final disposition of the Media:

1. Will the media be reused?

• Yes, reused will media remain in FRTIB control

a. Media requires cleaning

• Yes, reused media will leave FRTIB control

a. Media requires purging

• No, Media will not be reused, media will be destroyed

a. Media destruction will be performed in house or

b. Media destruction will be performed by a 3rd party

The SODR signs the EMDSR with his recommendations and forwards the request to the SO for approval.

The SO evaluates the request for proper handling of the designated media.

If there are no contrary indications the SO signs the EMDSR.

If the SO disagrees with the reuse recommendation, he/she may change the recommendation to not available for reuse and approve the request. Once the SO signs final approval of the EMDSR the SODR then notifies the requester of the approval of the request and the particulars for the sanitization process to be used on the media. The SODR is responsible for ensuring the sanitization proceeds in accordance with the recommendations in the EMDSR .While the SODR may delegate to an appropriate FRTIB SA to facilitate destructive sanitization decision, s/he shall ensure control of the media.

4.3.S Disposal Validation Verification of the sanitization and disposal process is required.

Verification of the completed sanitization process is to be conducted by personnel without a stake in any part of the process. In FRTIB the independent verification is performed by an ISSO.

The ISSO inspects a sampling of sanitized media to ensure that the sanitization process was appropriately and thoroughly implemented.

Upon successful validation, the ISSO signs the EMDSR thus completing the request.

Should the validation of the sanitization be unsuccessful the media is returned to the designated media sanitization POC and the sanitization is repeated. Upon completion of the reiteration of sanitization validation will again be performed. Should the sanitization be unsuccessful at this point, the sanitization method should be increased a level: clear raised to

Page 7 of25

Office of Technology Services- Information Assurance Division Office Enterprise Risk Management (OERM) IT Security Media Destruction or Sanitization Procedure Document Number FRTIB.307 .0 I purge; purge raised to destroy. Validation is again perfonned by the ISSO with their signature completing the request.

4.3.6 Third Party Disposal

The SO can approve the outsourcing of media sanitization and destruction if it is the most reasonable option to maintain confidentiality

, while optimizing available resources. Due diligence should be exercised upon entering into a contract with a third party engaged in media sanitization. Due diligence could include a review of any or all of these options as listed in 16 CFR 682:

• an independent audit of the disposal company's operations

• an independent audit of the disposal company's compliance with this procedure,

• information from references or other reliable sources,

• certification by a recognized trade association or similar third party

• the disposal company's information security policies or procedures,

• other appropriate measures to determine the competency and integrity of the potential disposal company.

4.3. 7 Documentation The ISSO shall document the EMDSR in the IAD IT Security Media Destruction or Sanitization Log which can be found on FRTIB SharePoint. The finalized request is returned to the SODR.

The SODR shall retain and maintain the finalized EMDSR and any associated documentation for a minimum of three years.

5.0 Authorities and References

• NIST SP 800-53 Revision 4

• NIST 800-60 Revision I

• NIST 800-88 Revision 1

• EISRM Directive

• 16 CFR 682

6.0 Revision History

Date Version Author OERM Coordinator Comments

(briefly summarize change)

6/1114 1.0 John Ramsey, CISO, IAD Karrenthya Simmons Initial version l/5/2015 2.0 John Ramsey, CISO, IAD Karrenthya Simmons Annual update

Page 8 of25

I

Office of Technology Services- lnfonnation Assurance Division

7.0 Approval

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

Date: \/ \ :,· ! ' S-

Title: Chief Technology Officer. Federal Retirement Thrift Investment Board

Page 9 of25

Office Enterprise Risk Management (OERM) Document Number FRTIB.307 .0 I

8.0 Appendices

Appendix A: Electronic Media Destruction Or Sanitization Documents (Separately attached to this document)

• IT Security Electronic Media Destruction or Sanitization Request

• IT Security Electronic Media Destruction or Sanitization Checklist

• IT Security Electron1c Media Destruction or Sanitization Log

Appendix B: Minimum Sanitization Requirements

Clear:

Purge:

Destroy:

Notes:

Table B-1 Networking Device Sanitization

Pafonn a full manufacturer's reset to reset the router or switch back to its factory default settings.

See Destruct. Most routers and switches only offer capabilities to Clear (and not Purge) the data contents. A router or switch may offer Purge capabilities, but these capabilities arc specific to the hardware and firmware of the device and should be applied with caution. Refer to the device manufacturer to identify whether the device has a Purge capability that applies media-dependent techniques (such as rewriting or block erasing) to ensure that dnta recovery is infeasible, and that the device does not simply remove the file pointers.

Shred. Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

For both Clear and (if applicable) Purge, refer to the manufacturer for additional infocmation on the proper Sanitization procedure.

Network Devices may amtain removublc storJgc. The removable media mw.1 be n:mo\IW and S1111ili1.ed using media-specific techniques.

Page 10 of25

Office of Technology Services- lnfonnation Assurance Division Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01 IT Security Media Destruction or Sanitization Procedure

Clear/ Purge:

Destroy:

Notes:

Table B-2. Mobile Device Sanitization

Select the full sanitize option (typically in the 'Settings> Gaicral > Reset> Erase All Conlalt and Settings' menu). The saniti7.8tion operation may take only minutes if Cryptographic Erase is supported, or may take as long as several hours if media-dependent non-ayptogniphic sanirizlition techniques thnt lc:vcruge ovawiiting arc applied by the device (dcpatding on the media size).

Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

Following the Clear!Purge operation, manually navigate to multiple areas of the device (such as browser history, files, photos, etc.) to verify that no personal information has been retained on the device.

Refer to the manufacturer for proper sanitizntion procedure, and for details about implementation ditfcmices between device versions and OS versions. Proper initial configur-.uion using guides such as the DISA STIGs lbttp;flja,,~ctiSJni!Jajwif) helps ensure that the level of data protection and sanitization assurance is as robust as poSS1blc.

Select the full sanitize option (typically in either the 'Options> Security Options> General Settings> [menu button]> Wipe Hnndheld' OR in 'Options> Security Options> Security Wipe' menu), making sure to select all subcnrcgorics of data types for sanitization. The sanitization operation may take os long os several hours depending on the media size.

Shred, Disintegrate, Pulvcriz.c, or Incinerate by burning the device in a licensed incinerator.

Following the Clear/Purge operation, manually nnvigote to multiple areas of the device (such as browser history, files, photos, etc.) to verify that no personnl information hos been retained on the device.

Refer to the manufacturer for additional infonnation on the proper saniti7.8tion procedure, and for details about implementation differences between device ~ons and OS ~ons. Proper initial oonfiguration using guides such as the DISA S11Gs (btm;tfmsc.disunfl/Sii:sfl helps ensure that the level of data protection and sanitization assumnce is as robust os JlOSSlble. If the device contains removoblestorage media, ensure that the media is sanitized using approprillle media- dependent procedures.

Ill'' in·' runnin;.: lhl· Coo;.:k \ndrnid OS

Clear: Select the full sanitize option (typically in the 'Malu >Settings> (Privacy OR SD and Phone Storage]> Factory data reset• menu).

Purge: Android settings and capabilities may be modified by device vendors or service providers, and therefore no assumptions should be made about the level of ~cc provided by pcrf onning a factory data reset. Some vasions of Android support alaypUOO. and may support Ceyptographic Erase. Refer to the device manufacturer (and potentially the service provider as wel~ if applicable) to identify whether the device has a Purge capability that applies mcdia-dcpcndcnt techniques (such as rewriting or block erasing) or Cryptographic Erase to ensure that data recovery is infeasible, and that the device does not simply remove the file pointers.

!Destroy: Shred. Disintegrate, Pulverize, or IncinO'BlC by burning the device in a licensed incinerator.

!Notes: Proper initial oonfiguration using guides such as the DISA STIGs <btlpff11S.diS11.mi'V.si~ helps ensure that the level of dam protection and saniti7.8tion assurance is as robust as possible.

Following the Clear or (if applicable) Purge operation, manually navigate to multiple~ of the device (such as browsa-history, files, photos. etc.) to vaifythatnopcrsonal infonnation has been retained on the device.

For both Clear and (if applicable) Purge, refer to lhe manufuctun:r' for additional information on the proper sanitization procedure.

Page 11 of25

Office of Technology Services- Infonnation Assurance Division Office Enterprise Risk Management (OERM) 1T Security Media Destruction or Sanitization Procedure Document Number FRTIB.307.01

I

. \II other mo hill• <IL'\ ices I /111 11, !11rf, 1 , II 1/ 1 1, Ill 11111/11111, \ /'/) I . I ,/,!,/I ' i/ f J/ t rdt I ( J ' [ (01('/. d

.nlht'/Jltc<cl1J1'...!.ll.uh.!._ (({{~~:u11t'

!Clear:

Purge:

Destroy:

Notes:

Purge:

Manually delete all infonnation. then perfonn a full manufacturer's reset to reset the mobile device to filctory state.

See Oe;truct. Many mobile devices only offer capabilities to Clear (and not Purge) the data contents. A mobile device may offer Purge capabilities, but these capabilities are specific to the hardware ood software of the device and should be applied with caution. The device manufacturer should be referred to in order to idattify whctha-the device has a Purge capability that applies media-dependent techniques (such as rewriting or block cra.~ng) or Cryptographic Erase to ensure that data recovery is infeasible, and that the device docs not simply remove the file pointers.

Shred, Disintegrate, Pulveriz.e, or Incinerate by burning the device in a licensed incinerator.

Following the Clear or (if applicable) Purge operation, manually navigate to multiple areas of the device (such as call history, browser history, files, photos, etc.) to verify that no pmonal infonnation has been retained on the device.

For both Clear nnd (if applicable) Purge, refer to the manufucturer for proper sanitimtion procedure.

Table B-3. Equipment Sanitization

Perfonn a full m1111ufncturer's reset to reset the office CC]Uipment to its factory default settings.

See Destruct Most office equipment only offers capabilities to Clear (1111d not Purge) the data contents. Office equipment may offer Purge capabilities, but these capabilities arc specific to the hardware 1111d firmware of the device 11nd should be applied with cuution. Refer to the device manufacturer to identify whether the device has a Purge capability that applies media-dependent techniques (such as rewriting or block erasing) or Cryptographic Erase to ensure that dutu recovery is infeasible, and that the device does not simply remove the file pointers. Office equipment may have removable storage media, and if so, media-dependent sanitization techniques may be applied to the associated storage device.

Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incineralor.

For both Clear nnd (if applicable) Purge, manually navigate to multiple areas of the device (such as stored fax numbers, network configuration information, etc.) to verify that no personal information has been retained on the device.

For both Gearing and (if applicable) Purge, the ink, Iona-, and associated supplies (drum, fusa, etc.) should be removed and destroyed or disposed ofin accordance with applicable law, environmental, and hea1th amsidantions. Some of these supplies may retain impressions of data printed by the machine and therefore could pose a risk of data aposure, and should be handled accordingly. If the device is functional, one way to reduce the associated risk is to print a blank page, then an all-black page, then anotha-blank page. For devices with dedicated color components (such as cyan, magenta, wid yellow toners and related supplies), one page of each color should also be printed between blank pages. The resulting sheets should be handled nt the confidentiality of the Office Equipment (prior to sanitimtion). Note that these procedum; do not apply to supplies such as ink/toner on a one-time use roll, as they are typically not used again and therefore will not be addressed by sending additional pages through the equipment Office Equipment supplies may nlso pose hea1th risks, and should be handled using appropriate procedures to minimize exposure to the print components and tona-.

For both Clear nnd (if applicable) Purge, refer to the manufucturcr for additionnl infonnation on the proper sanitization procedure.

Page 12 of25

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.0 I

Clear:

Purge:

Destroy:

Notes:

Table B-4. Legacy Magnetic Media Sanitization

Ovciwrite media by using organizationally approved software and validate the overwritten data. The Clear pattern should be at least a single pass with a fixed data value, such as all mos. Multiple passes or more complex values may alternatively be used

Degauss in an organizationally approved degausser.

Incinerate floppy disks and diskettes by burning in a licensed incinerator or Shred.

Overwrite media by using organizationally approved software and validate the overwritten data. The Clear pattern should be at least a single pass with a fixed data value, such as ell zeros.

Multiple passes or more complex values may alternatively be used

Degauss in an organizationally approved degausser.

Incinerate disks and diskettes by burning in a licensed incinerator or Shred.

Degaussing zip disks typically renders the disk permanently unusable.

Rcl'I a11d ( ;p,,l'tll' l'ormat 'l:t:,!lll'lir Ta pl''

Clear:

Purge:

Destroy:

Notes:

Re-record (overwrite) all data on the IBpC using an organizationally approved pattern, using a system with similar characteristics to the one that originally recorded the data. For example; overwrite previously recorded sensitive VHS format video signals on a comparable VHS fonnat recorder. All portions of the magnetic tape should be ovcrwrittai one time with known non- satSitivc signals. Clearing a magnetic tape by re-recording (overwriting) may be impractical for most applications since the process occupies the tape transport for excessive time periods.

Degauss the magnetic tape in an organizationally approved dcgausscr.

Incinerate by burning the tapes in n licensed incinerator or Shred.

Prcpara!O<y steps for Destruct, such as removing the tape fiom the reel or cassette prior to Destruction, nrcunna:cssmy. However, segregation of componcnCS(tapcand n:cls or casscucs) may bcna:cssaiy to comply with the requirements of a Desttuction facility or for recycling m~

Page 13 of25

Office Enterprise Risk Management (OERM)

Document Number FRTIB.307.01

\T \ liar rl Dr hes I 11 1111 . 11,/, 1 /'I I I .) I I I , ) l I I , 1, ~lear: Overwrite media by using organi7.lllionally approved and validated overwriting tedmologieslmethods/tools.

The Clear pnttan should be at least a single pass with a fixed dam wluc, such as all zeros. Multiple pasS<S or more complex values may alternatively be used.

Purge: Four options are available:

1. Apply the AT A saniti1.e command, if supportOO. One or both of the following options may be available:

a. The overwrite command. Apply one pass of a fixed pattern across the media surface.

Some examples of fixed patterns include all Os or a pscudornndom pattern.

Optionally: Instead of one pass, use three tolal passes of a pseudorandom pattern, lcvcrnging the invert option so that the second pass is the inverted version of the pattern specified.

b. If the device supports encryption and the requirements descnbed in this document have been satisfied, the Cryptographic Erase (also known as sanitize crypto scramble) command.

Optionally; After Cryptographic Erase is successfully applied to a device, use the oveiwrite command (if supported) to write one pass of 1.ems or a pscudorandom pattern across the media. If the overwrite command is not supported, the Secure Erase or the Clear procedure could alternatively be applied following Cryptographic Erase.

2. Apply the AT A Secure Erase command. The AT A saniti:zc command is prcfcrrcd lo ATA Secure Erase when the AT A sanitize command is supported by the device.

3. Cryptographic Erase through the Trusted Computing Group (fCG) Opal Security Subsystem Class (SSC) or Enterprise SSC intcrfucc by issuing commands as n=my to cause all MEKs to be changed (if the requirements described in chis document have been satisfied). Refer to the TCG nnd device manufacturers for more information.

Optionally: After Cryptographic Erase is successfully applied to a device, use the overwrite

I command (ir supported) to write one pass of zeros or a pseudornndom pattern across the media. If

I the oveiwrite command is not supported, the Secure Erase or the Clear procedure could alternatively be applied following Cryptographic Erase.

i I

4. Degauss in an organi:zationally approved automatic degausser or disassemble the bani disk drive and Purge the enclosed platters with an organiz.ationally approved degaussing wnnd

Destroy: Shred, Disintegrate, Pulvcrfac, or Incinerate by burning the device in a licatSal incinerator.

Page 14 of25

Office of Technology Services- Infonnation Assurance Division Office Enterprise Risk Management (OERM)

Notes: Verification must be performed for each la:hniquc within Clear and Purge, except ~ing. The asmirance provided by degaussing depends on selecting an effective degausser, applying it appropriately and periodically spot checking the results~ ensure it is woridng as expected.

When using the three pass AT A sanitize overwrite procedure with the in vat option, the verification ~would simply search for the original pattern (which would have been writtm again during the third pa$).

The storage device may support ronfiguration capabilities that aitiliciall y restrict the ability to access portions of the media as defined in the ATA standard, such as a Host Protected Area (HP A), Device Configuration Overlay (DCO), or Accessible Mox Address. Even when a dedicated sanitization command addresses these areas, their presence may affect the ability to reliably verify the effectiveness of the sanitization procedure if left in place. Any coo figuration options limiting the ability to access the entire eddrcs.Wl\e area of the storage media should be reset prior to applying the sanitiz.ation technique.

Rocovay data, such as an OEM-provided restoration image may have been stored in this manna-, and sanitization may therefore impact the ability to recover the system unless reinstB!lation media is also available.

This guidance applies to Legacy Magnetic media only, and it is critical to verify the media type prior to sanitization. Note that emerging media types, such as HAMR media or hybrid drives may not be easily identifiable by the label. Refer to the manufacturer for details about the media type in a storage device.

Dcgeussing the media in a storage device typically renders the device unusable.

~( ... , I l.11 d 1>1 i\ l ' ' I! f' fl', f., ,r, ' )( .'i ' ; \ I"" I ( 1-.:J Ii.! '·'

(:I ear:

l>urge:

Destroy:

Ovawriec media by using organizationally npproved and validated overwriting tcclmologiciJmcthodsltools.

The Clear pattern should be at least a single pass with a fixed datn value, such as all 1.eros. Multiple passes or more complex values may alternatively be used.

Four options arc available:

1. Apply the SCSI sanitize command, if suppoctcd. One or both of the following options may be available:

a. The ova-write command Use throe total passes of a pscudorandom pattan, lcvaaging the invert option so that the second pass is the inverted version of the pattern specified.

b. If the device supports encryption, the Cryptographic Erase(alsoknown as sanitire crypto samnble) command.

Optionally: After Cryptographic Erase is suca:ssfully applied to a device, use the ova-write command (if supported) to write one pass of zeroes or a pscudorandom pettan across the media If the ovcrwriterommand is not supported, Secure Erase or the Clear proocdurc could altanativcly be applied.

2. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC intaface by issuing commands as n~ to cause all MEKs to be changed. Refer to the TCG and vendors shipping TCG Opal or Entcfprise storage devices for more information. Optionally: After Cryptographic Erase is successfully applied to a device, use the ova-write command (if supported) to write one pass of zeroes or a pseudorandom pattern across the media If the ova-write command is not supported, Sccurc Erase or the Clear proccdW'C could altanativcly be applied.

3. If neither of the first two options is supponed, use the native read and writeinterfuceto write least a single pass with a fixed data value, such as nil uroes. Multiple passes or more oomplcx values may altanativcly be used.

c. DcgQuss in an organizationally approved automatic dcgausscr or disassemble the hard disk drive and Purge the enclosed plattas with an organimtionally approved degaussing wand

Shml, Disintegrate, Pulverize, or lncinaute by burning the device in a licensed incinerator.

Page 15 of25

Office ofTeclmology Services- Information Assurance Division Office Enterprise Risk Management (OERM)

Notes: Verification must be pc:rfunned fur each technique within Clear and Purge, except degnllssing. The 11SSU1W1CC provided by degaussing depends on selecting an effective degausser, applying it appropriately ond periodically spot checking the results to ensure it is worlcing as expected.

When using the three poss SCSI sanitize overwrite procedure with the invert (also known os complement) option, the verification process would simply sardi for the original pattern (which would have been writtm again during the third poss). While it is widely accepted that one pass of overwriting should be sufficient for Purging the daln, the availability of a dedicated command that inCOlllOrales the ability to invert the data pattern allows an efficient ond ctfedivc epproocf:i that mitigµtcs any residual risk ossocialcd wilh wriations in implementations of magnetic recording features acros.ci device mwiufacturers.

The storage device may support configuration capabilities that artificially restrict the ability to access portions of the media, such as SCSI mode select. Even when a dedicated saniti:zation command addresses these areas, their presence may affect lhe ability to reliably verify the effectiveness of the sanitization procedure i fleft in place. Any configuration options limiting the ability to access the entire addn:ssoble Un:u of lhe stomge media should be reset prior to applying the sanitization technique.

When Cryptographic Erase is applied, verification must be perfonned prior to additional sanitization techniques (if applicable), such as a Clear or Purge technique applied following Cryptographic Erase, 10 ensure that the cryptographic opctation completed succcssfuny. A quick sampling verification should also be perfonned after any additional techniques are applied following Cryptographic Erme.

:1

I Not all implementations of encryption are necessarily suilable for reliance upon Cryptographic Erase as a Purge mcclumism. The decision regarding whctha- to use Cryptographic Erase depends upon verification of attribules previously identified in this guidance and in Apoendix B.

This guidance applies to Legacy Magnetic media only, and it is critical to verify the media type prior to snniti2lltion. Nole that emerging media types, such as HAM R media or hybrid drives may not be easily identifiable by the label. Refer to the manufucturer for details about the media type in a storage device.

Degaussing the media in a storage device typically renders the device unusable.

Page 16 of25

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

Purge:

Table B-5. Peripherally Attached Storage Sanitization

Overwrite media by using orgnnizationally approved and validated overwriting technologies/methods/tools.

The Clear pattern should be at least a single pass with a fixed data value, such as all zeros. Multiple passes or more complct values may alternatively be used.

See Destruct The implemenlation of External Locally Attached Hord Drives varies sufficiently acros.s models and vendors that the issuance of any specific command to the device may not reasonably wid consistently assure the desired sanitii.ation result

When the external drive bay amtains an AT A or SCSI hard drive, if the commands can be delivertd natively to the device the device may be sanitized based on the associated media- specific guidance.

However, the drive could be configured in a vendor-specific manner that precludes saniti?.ation when removed from the enclosure. Additionally, if saniti:zarion techniques are applied, the hnrd drive may not work as cxpo:tcd when reinstalled in the enclosure.

Refer to lhe device manufactura-to identify whether the device has a Purge capability that applies mcdia dependcnt techniques (such ~ rewriting, block erasing. Cryptographic Erase, etc.) to ensure that data recovery is infeasible, and that the device does not simply remove the file pointas.

Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

Verification must be performed for each lfdmique within Clear and Purge.

Some external locnlly attached hard drives, especially those featuring security or encryption features, may also have hidden storage areas that might not be oddn:ssed cvel\ when the drive is removed from the endosun:. The device vendor may leverage proprietury commands to interact with the security subsystem.

Please refer to the rnanufiu:turer to identify whether any reserved areas exist on the media and whether any tools arc available to remove or sanitize them, if present

Table B-6. Optical Media Sanitization

Destroy in order of rccom~cndations:

1. Removing the infonnation-bearing layers of CD media using a commercial optical disk grinding device. Note that this applies only to CD and not to DVD or BD media

2. Incinerate optical disk media (reduce to ash) using a licensed facility.

3. Use optical disk media shredders or disintcgrator devices to reduce to particles that have a nominal edge dimensions of point five millimeters (.5 mm) and surface area of point two five square millimeters (.25 mm1

) or smaller.

Page 17 of25

Office ofTeclutology Services- htfonnation Assurance Division

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

Purge:

•Destroy:

Table B·7. Flash-Based Storage Device Sanitization

1. Overwrite media by using organi7.lltionally approved and validated overwriting technologies/methods/tools. The Clear pattern should be at least a single pass with a fixed data value, such as all zeros. Multiple passes or more complex values may alternatively be used.

2. Leverage (the non-enhanced) AT A Secure Erase, if supported by the device.

Three options are uwiluble:

1. Apply the ATA sanitize commnnd, if supportoo. One or both of the following options may be available:

a. The block erase command Optionally: Afta- the block erase command is successfully applied to a device, write binary I s across the user addressable area of the storage media, and theii perform u second block erase.

b. If the device supports encryption, the Cryptographic Erase (also known as sanitire crypto scramble) command.

Optio11ally: After Cryptographic Erase is successfully applied to a device, use the block erase command (if supported) to block erase the media. If the block erase oommond is not supported, Secure Erase or the Clear procedure could alternatively be applied.

2. Apply the AT A Secure Erase commwid The sanitize command is prcfem:d to Secure Er.ise when the sanitize command is supported by the device.

3. Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by i s s u i n g oommonds as ncccssary to cause all MEKs to be changed. Refer to the TCG and vendors shipping TCG Opal or Enterprise storage devices for more infonnation. Option"lly: After Cryptographic Erase is successfully applied to a device, use the block erase commend (if supported) to block erase the media. If the block erase command is not supported, Secure Erase or the Clear procedure could alternatively be applied.

Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

Page 18 of25

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

Notes: Verification must be pc:rfonned for eacfi teclmique within Oeer and Purge.

When Cryptographic Erase is applied, verification must be performed prior to additional san1112l1ll<>n techniques (if applicable), such es a acar or Purge technique applied following Cryptogmphic Enisc, to ensure that the aypCI>graphic operation oomplcted successfully. A quick sampling verification should also be performed after any additional techniques arc applied fullowing Ceyptographic Erase.

The storage device may support configuration capabilities that artificially restrict the ability to ~s portions of the media as defined in the ATA standard, such 11S a Host Protected Area (HPA), Device Configuration Overlay (DCO), or Accessible Mox Address. Even when a dedicated sanitization command addresses these areas, their presence may affect the ability to reliably verify the cffcctivaicss of the sanitization procedure if left in piece. Any configuration options limiting the ability to access the entire addressable area of the storage media should be reset prior to applying the sanitimtion technique.

Recovery data, such as an OEM-provided restoration image may have been stored in this manner, and sanitization may therefore impact the ability to recover the system unless reinstnllation media is also available.

Not all implementations of encryption ere necessarily suitable for reliance upon Cryptographic Erase as a Purge mechanism. The decision rcgnnling whether to use Cryptographic Erase depends upon verification of ottn"butes previously identified in this guidance and in Appendix B.

Given the wriability in implcmaitation of the Enhanced Secure Erase feature, use of this command is not recommended without first rcfcning the manufactu~ to identify that the storage device's model-specific implementation meets the needs of the organization.

Whereas AT A Secure Erase was a Purge mcchanism for magnetic media, it is only a Clear mechanism for flesh due to variability in implementation and the possibility that sensitive data may remain in areas such as spare cells that have been rocatedoutofuse.

Degaussing must not be solely relied upon as a saniti2'Jltion technique on flash-based stomge devices or on hybrid devices that contain non-volatile Oesh storage media. Degaussing may be used when non-volatile flash media is prcsa1t if the flash componaits arc sanitized using media- dcpcndait techniques.

SCSI Solid Sl:tll' l>riH'' (SS!h) /1•1, 1-. /u111·, .'>< ~I.\/.\ I 1i>,·1 c .\,,,,;<'!. ,.,, Oear:

Purie:

Destroy:

Overwrite media by using organizationally approved end wlidated overwriting technol~tools.

The Clear pattern should be at least a single pass with a fixed data value, such os all zeros. Multiple passes or more complex values may nltcmativcly be used.

Two options nre awilable:

1. ApplythcSCSlsanitizccommand,ifsupportcd. Oneorbolhofdicfullowingoptions may be awilable:

a. The block erase mmmand

b. lfthcdcviccsupportsaicryption, thcQypcogmphic Erasc(also known as sanitize crypto scramble) command.

Optionally: After Cryptographic Erase is successfully applied to a device, use the block erase command (if supponed) to block erase the media. If the block erase command is not supported. the Ocar procedure could alternatively be applied.

2. Cryptographic Erase through the TCG Opal SSC or Entcsprise SSC intaface by i s s u i n g commands as necessary to cause all MEKs to be changed Refer to the TCG and vendors shipping TCG Opal or Enterprise storage devices for more information. Optionally: After Cl)'plographic Erase is successfully applied to a device.. use the block erase command (if supported) to block erase lhe media. If the block erase command is not supported, the Clear procalurc is en acceptable altannrivc.

Shred, Disintegrate, Pulverize, or lncinmue by burning the device in a licensed incinc:rator.

Page 19 of25

Office ofTechnology Services- Infonnation Assurance Division

Office Enterprise Risk Management (OERM) Document Number FRTIB.307.01

I

Notes: Verification must be performed for each technique within Clear and Purge.

Clear:

Purge:

Destroy:

Notes:

The storage device may support configuration capabilities that artificially restrict the ability lo access portions of the media, such as SCSI mode select Even when a dedicated sanitization command addresses these areas, their ~ce moy affect the ability to reliably verify the effectiveness of the sanitization procedure ifleft in pince. Any configuration options limiting the ability lo access lhe entire addressable area of the storage media should be reset prior lo applying the saniti7lltion technique.

When Cryptographic Erase is applied, verification mw.1 be pc.:rfunned prior to additional sanitimtion techniques (if opplicnble), such as a Clear or Purge technique applied following Cryptographic Erase, to ensure that the cryptographic operation completed successfully. A quick sampling verification should also be performed ofter any additional techniques arc applied following Cryptographic Erase.

Not oil implementations of encryption arc nccess3rily suilable for reliance upon Cryptographic Erase as a Purge mechanism. The decision regarding whether to use Cryptographic ~ depends upon verification of attributes previously identified in this guidance and in Appendix B.

Degaussing must not be performed us a sanitirntion technique on flash-based storage devices.

OVCIWritc media by using organi1.11tionally approved and wlidotcd overwriting technologies/methods/tools.

The Clear pattern should be at least a single pass wilh 11 fixed dotn wlue, such as all zeros. Multiple pDSSeS or more complex volues m11y alternatively be used.

Two options arc available:

1. Apply the NVM Express Format command, if supported. One or both of the following options may be uvoil11ble;

a. The User Data Erase comm11nd.

b. If the device supports encryption, the Cryptographic Erase commwid Optionally: After Cryptographic Erase is successfully applied lo a device, use the User Dain Erase conunnnd (if supported) to erase the media If the User Data Erase rummand is not supported, the Oearprocedure could alternatively be applied.

2. Cryptographic Eme through the TCG Opal SSC or Enterprise SSC inrc:rface by ismiing commands os necessmy to cause nil M EKs to be dumged. Refer lo the TCG and vendors shipping TCG Opul or Enteiprise storage devices for more information. Opliona/ly: After Cryptographic Erase is successfully 11pplied lo a device; use the User Dain Erase commlUld (if supported) to erase the media. lfthc User Dain Erase command is not supported, thcClcarproccdurcis on DCCCplablc ..

Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

VerifiClltion must be performed for each technique within Clear wid Purge.

When Cryptographic Erase is applied, verification must be performed prior to OOditionnl sanitimlion techniques (if applicable), such as a Clear or Purge tcchniquc opp lied following Cryptographic Erase, to ensure that the cryptographic opaation completed successfully. A quick sampling verification should also be performed ofter any additional techniques 11re applied following Cryptographic Erase.

Not all implementations of encryption arc necessarily suitable for reliance upon Cryptographic Erase 11S a Purge mechwiism. The decision regarding whether to use Cryptographic Erase depends upon verification of attn"butes previously identified in this guidance.

Degaussing must not be performed as a snnitimtion technique on flash-based storage devices.

l SB Rl?HUn ahk \ kllia I /11, 111c i11d1 1/\11 / l1 n, 1…