{"id":16622,"date":"2022-09-07T11:17:19","date_gmt":"2022-09-07T05:47:19","guid":{"rendered":"https:\/\/www.stellarinfo.co.in\/blog\/?p=16622"},"modified":"2023-01-02T15:12:49","modified_gmt":"2023-01-02T09:42:49","slug":"how-to-wipe-hard-drive-with-nist-800-88-compatible-software","status":"publish","type":"post","link":"https:\/\/www.stellarinfo.co.in\/blog\/how-to-wipe-hard-drive-with-nist-800-88-compatible-software\/","title":{"rendered":"How To Wipe Hard Drive With NIST 800-88 Compatible Software?"},"content":{"rendered":"\n\n\n\n
Summary: Data sanitization is now at the top of the list of most CIOs, at par with malware intrusion. You need NIST 800-88 compliant software to ensure data does not fall into wrong hands.<\/strong><\/em><\/th>\n<\/tr>\n
\n

Request A Call Back<\/a><\/p>\n<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n

Every organization needs more storage. And with that, they need better processes to secure their data when in use and wipe their data when it\u2019s not required anymore. Data that used to be securely stored on company servers now finds its way to individual laptops and smart devices due to the increasing use of cloud-based applications.<\/p>\n

Research by Ponemon Institute<\/a>, a premier research institute out of Michigan that is dedicated to privacy and investigation of data breaches, has found that in 2021 data breaches cost businesses over $4 million on average. Further, of the one thousand CIOs interviewed, 60% had suffered data breaches due to third-party service providers.<\/p>\n

Table of Contents<\/strong><\/p>\n

    \n
  1. Understanding NIST 800-88<\/a><\/li>\n
  2. NIST Compliance Requirements<\/a><\/li>\n
  3. Cutting Edge Data Erasure Technology<\/a><\/li>\n
  4. How to Install BitRaser?<\/a><\/li>\n
  5. Don’t Ignore Sanitization<\/a><\/li>\n<\/ol>\n

    What is NIST 800-88?<\/h2>\n

    NIST<\/a> stands for National Institute for Standards and Technology. It is a physical sciences laboratory that is run by the US Department of Commerce.\u00a0Previously, NIST was known as the Bureau of Standards.<\/p>\n

    NIST 800-88<\/a> is a guideline for data sanitization published in 2006 and has become the de facto standard globally.\u00a0The objective of NIST 800-88 is to render data on the targeted device irretrievable.<\/p>\n

    The guidelines issued by NIST 800-88 cover all types of storage media including floppy discs, optical discs (CD\/DVD), HDD, and SSD, and use Clear, Purge and Destroy<\/a> as a three-pronged approach.<\/p>\n

    Clear<\/strong><\/p>\n

    Clear overwrites data with 0 and 1. It is used with HDD, SSD, and other flash-based media (USB, memory card).\u00a0NIST Clear data wiping software<\/strong> offers moderate protection against intrusion. It allows the media to be reused without any trouble.<\/p>\n

    Purge<\/strong><\/p>\n

    Purge includes logical techniques for state-of-the-art overwriting and block erasure as well as deep erasure using cryptographic means. It is used with HDD, SSD, and other flash-based media (USB, memory card).<\/p>\n

    A NIST Purge data wiping tool<\/strong> offers a high level of protection against intrusion. It also allows easy reuse of storage media.<\/p>\n

    Destroy<\/strong><\/p>\n

    The use of physical techniques such as pulverizing, shredding, and smelting render storage media unusable.\u00a0It is the most secure. Clear and Purge cannot be used with optical media but Destroy renders it non-working.<\/p>\n

    The storage media cannot be reused, but to some extent recycling of materials is possible.<\/p>\n

    NIST Compliance Requirements for Data Erasure Software<\/h2>\n

    The first point to note is that NIST does not conduct any validating exercise. It only sets out the standard for data sanitization and conducts testing.\u00a0NIST 800-88 compliant software<\/strong> has to adhere to the guidelines set out in the document.<\/p>\n

    These are the salient points of NIST 800-88 Standard:<\/p>\n

    (page 20-22 of NIST 800-88r1)<\/p>\n

      \n
    1. Overwriting with binary 0s in a single pass is considered satisfactory.<\/li>\n
    2. Multiple passes may be used but they significantly reduce the lifespan of media.<\/li>\n
    3. Cryptographic erase through TCG Opal SSC or Enterprise SSC interface.<\/li>\n
    4. Though NIST acknowledges, and research shows that some signal remains, it is too feeble to be recovered.<\/li>\n
    5. Verifying the sanitization is essential. Full verification of every bit is impossible so sample regions have to be tested.<\/li>\n
    6. The software has to conceptually break up the media into subsections. A sufficient number of these subsections have to be tested so as to cover the entire addressable space.<\/li>\n
    7. At least two locations in each subsection must be verified, e.g. say the media is split into 500 subsections each 250 MB. Then two from the first 250 MB, followed by two from the second 250 MB, and so on, must be verified.<\/li>\n
    8. Each sample location must be at least 5% of the subsection and not overlap with the other location in the same subsection. In a subsection of 250 MB, each location must be at least 12.5 MB in size and at least a total of 25 MB of that subsection must be checked.<\/li>\n
    9. Thus, a verification must cover at least 10% of the entire space on the media.<\/li>\n
    10. The first and last addressable location is always included in the verification.<\/li>\n
    11. The NIST 800-88 compliant software must produce automatic documentation containing<\/li>\n<\/ol>\n