Data sanitization is a process of deliberate, permanent, and irreversible removal or destruction of data stored on a memory device to make it unrecoverable. A device that has been sanitized has no usable residual data, and even with the assistance of advanced forensic tools, the data will never be recovered.

There are three main data sanitization techniques:

1. Physical destruction
2. Cryptographic erasure
3. Data erasure
4. Data masking

Physical Destruction

The most obvious way to disinfect a device is to physically destroy the storage medium or device of which it is part, for example, destroy a hard drive or an old laptop with a built-in hard drive.

Physical destruction is an efficient solution to eliminate data and make it unrecoverable, but it has the disadvantage of damaging the environment and ruining goods, making them unsuitable for reuse or resale.

Cryptographic Erasure

Encryption is a quick and effective way to sanitize storage devices. It is best suited for removable or mobile storage devices, or those that contain highly sensitive information.

This method uses public key encryption, with a strong key of at least 128 bits, to encrypt all data on your device. Without the key, the data cannot be decrypted and becomes unrecoverable. In addition, the private key is discarded, effectively erasing all data on the device.

The challenges of cryptographic deletion are that it relies on encryption features provided with the storage equipment, which may not be suitable for the task. The cryptographic erasure software should generate a tamper-proof certificate, indicating that the key has been properly cleared and providing the device details and standards used.

Cryptographic deletion is a fast and effective method of sanitizing data. It is best to apply it when storage devices are on the go or contain non-sensitive data.

The disadvantages of this technique are that it is based primarily on the manufacturer and is likely implementation errors. Broken keys and errors can potentially affect its success. Cryptographic deletion allows data to remain on the storage device and often does not meet regulatory compliance standards.

Data Erasure

This technique uses software to write random 0 and 1 on each sector of the storage equipment, ensuring that no previous data is retained.

This is a very reliable form of sanitization because it validates that 100% of the data has been replaced, at the byte level. You can also generate verifiable reports that demonstrate that the data has been successfully disinfected. The advantage of this method over physical destruction is that it does not destroy the device and allows you to sell or reuse it.

However, the downside of data deletion is that it is a time-consuming process, it is difficult to perform during the life of the device, and requires that each disabled device goes through a rigorous sanitization process. It also requires companies to create policies and practices for all data storage devices.

Data Masking

Data masking is another widely used technique in compliance strategies and is explicitly required by some compliance standards of companies. Masking involves creating false versions of the data, which retain the structural properties of the original data. Masking techniques include character shuffling, word substitution, and randomization. For example, real customer names are replaced with other randomly selected names.

Data masking is very effective for sanitizing. In fact, it sanitizes data on the device while it is still in use. The main advantages of sanitization compared to other techniques are:

• Quick and easy to implement;
• Complies with most standards and regulations;
• Can be applied on an ongoing basis to existing data;
• Does not require a particular sanitization policy for discontinued devices.

Contact us if you would like to explore this topic and find out which technique can be most appropriate for your business!

Follow us on Linkedin!