Conventional wisdom tells us that deleting data is an insufficient means of protecting your sensitive information from being obtained from discarded media. However, recently upon reviewing an NIST publication from last month, I ran across an interesting paragraph that reads as follows:


This is a signficant change in stance from the often quoted U.S. Department of Defense 5220.22-M disk erasing standard that suggests a minimum of 3 overwrites and a verify is necesarry to properly sanitize data. Now before rushing out and changing all of your purging applications to single pass only, please notice the quoted paragraph from the NIST article is fairly specific about a type of hard drive, size and manufacture date. Nonetheless, this points to what we will hopefully see as a trend as time passes that it will hopefully require less passes to properly sanitize our media.

As a related issue, let's talk a moment about the last time your media sanitization policies were updated. Do they take into account media sources other than hard drives? It is becoming increasingly more difficult to contain and identify all sources where data is stored, but a thorough security program should consider all of these devices in their protection and sanitization routines. Examples of often overlooked devices include cell phones, PDAs, USB thumb drives and digital cameras. Appendix A of the NIST article mentioned above provides a fairly good list of places where data is stored along with the recommended action for sanitizing or destroying them.

Related to the topic of considering other places where sensitive data is stored electronically, reader Cornelius from Australia offers this recent article from The Sydney Morning Herald: http://www.smh.com.au/news/phones--pdas/secrets-spill-from-secondhand-mobiles/2006/08/31/1156817011704.html