media sanitization nist 800-88 guidance terms defined when is media under/not under your control?...

Media SanitizationMedia Sanitization

NIST 800-88 GuidanceNIST 800-88 Guidance Terms DefinedTerms Defined When is media undernot under your When is media undernot under your

controlcontrol Flowchart for decision makingFlowchart for decision making Spreadsheet of methods for media Spreadsheet of methods for media

sanitizationsanitization Quick way to reduce large inventoriesQuick way to reduce large inventories

TermsTerms Clearing ndash protection against a Clearing ndash protection against a

keyboard attackkeyboard attack Purging ndash protection against Purging ndash protection against

laboratory attacklaboratory attack Destroying ndash media cannot be reusedDestroying ndash media cannot be reused

ATA disk drives manufactured afterATA disk drives manufactured after

2001 (over 15 GB) the terms clearing and purging 2001 (over 15 GB) the terms clearing and purging have converged have converged

NIST Guidance - ControlNIST Guidance - Control

Under Organization ControlUnder Organization Control 10487081048708Media being turned over for maintenance are still considered underMedia being turned over for maintenance are still considered under organization control if contractual agreements are in place with theorganization control if contractual agreements are in place with the organization and the maintenance provider specifically provides for theorganization and the maintenance provider specifically provides for the confidentiality of the informationconfidentiality of the information 10487081048708Maintenance being performed on an organizationrsquos site under theMaintenance being performed on an organizationrsquos site under the organizationrsquos supervision by a maintenance provider is also consideredorganizationrsquos supervision by a maintenance provider is also considered under the control of the organizationunder the control of the organization Not Under Organization ControlNot Under Organization Control 10487081048708Media that are being exchanged for warranty cost rebate or otherMedia that are being exchanged for warranty cost rebate or other purposes and where the specific purposes and where the specific media will not be returnedmedia will not be returned to the to the organization are considered to be out of organizational controlorganization are considered to be out of organizational control

Helpful TipsHelpful Tips Document the serial number of both the Document the serial number of both the

Hard Drive and host computerHard Drive and host computer SCSI drives once removed from host SCSI drives once removed from host

overwriting becomes difficult to impossibleoverwriting becomes difficult to impossible Degaussers are rated by ORSTEDS they Degaussers are rated by ORSTEDS they

produce - your drive may require higher produce - your drive may require higher Many modern Degaussersrsquos chamber Many modern Degaussersrsquos chamber

height is approx 1rdquo highheight is approx 1rdquo high Pre-destruction may be permissible at Pre-destruction may be permissible at

your facilityyour facility Consider chain of custody if using an Consider chain of custody if using an

offsite service provideroffsite service provider

Chain of Custody Chain of Custody improvementsimprovements

Pre-DestructionPre-Destruction

Methods of preparing hard drives for shipment to Intelligent Decisions for Certification of DestructionModel MfgrSpecification Capacity WeightTime to prepare Type Technology Cost

HD-3w Garner Products 8500 Oe 13 H 75lbs 10 secs Degausser Magnetic $897500HDTD-8300Garner Products 7500 Oe 165 83lbs wCase 45 secs Degausser Magnetic $1195000PD-8700 Garner Products 10000 Oe 166 178 LBS 120 secs DegauseampDestroy Magnetic amp Hydralic $2595000PD-8500 Garner Products NA 166 80lbs 70 secs Destroy (folds HD) Hydralic $895000DD9000 Norazza NA 166 80lbs 10 secs Destroys(Punches 4 holes) Hydralic $1299900HDCrushereDR Solutions NA 166 80lbs 10 secs Destroys(drills spindle) Hydralic $800000HD-6600 Data Security Inc 4200 Oe 35 420 Lbs 60 secs Degausser Magnetic $3999000

Methods of preparing hard drives for reuseshipment to Intelligent Decisions for Certification of ReuseModel Manufacturer Speed Capacity Drive TypesCompletion Times Type Cost

6007SAS-ImageMASSterICS 4-5Gbmin 8 drives SASSATAIDE 1-8 hrs per 8DOD Overwriteamp SinglePass HW and Software $805000

FG-4000-001CICS 3Gbmin 8 drives P-ATA S-ATAampLapTop 1-8 hrs per 8DOD Overwriteamp SinglePass HW and Software $250000WipeDrive ProWhite Canyon 1-4GbMin 1drive SASSATASCSIIDERAID 1-8 hrs DOD Overwriteamp SinglePass Software $15900WipeDrive ProWhite Canyon 1-6 Gbmin36-64DrivesSASSATASCSIIDERAID 1-8 hrs DOD Overwriteamp SinglePass PXE Boot Software TBD Volume License

Degausser capacityDegausser capacity(NSA DEPL ndash March 2008 Pg9)(NSA DEPL ndash March 2008 Pg9)

QuestionsContact infoQuestionsContact info

Perry Dollar CISSP VACSPPerry Dollar CISSP VACSP Media Sanitization Program ManagerMedia Sanitization Program Manager Department of Veterans AffairsDepartment of Veterans Affairs 410-962-7950 Xt254410-962-7950 Xt254 PerryDollarVagovPerryDollarVagov

Media Sanitization

Terms

NIST Guidance - Control

Slide 4

Helpful Tips

Chain of Custody improvements

Slide 7

Pre-Destruction

Slide 9

Degausser capacity (NSA DEPL ndash March 2008 Pg9)

QuestionsContact info

TermsTerms Clearing ndash protection against a Clearing ndash protection against a

keyboard attackkeyboard attack Purging ndash protection against Purging ndash protection against

laboratory attacklaboratory attack Destroying ndash media cannot be reusedDestroying ndash media cannot be reused

ATA disk drives manufactured afterATA disk drives manufactured after

2001 (over 15 GB) the terms clearing and purging 2001 (over 15 GB) the terms clearing and purging have converged have converged




















Media Sanitization

Terms


Slide 4

Helpful Tips


Slide 7

Pre-Destruction

Slide 9






















Media Sanitization

Terms


Slide 4

Helpful Tips


Slide 7

Pre-Destruction

Slide 9



media sanitization nist 800-88 guidance terms defined when is media under/not under your control?...

Documents