Secure IT Asset Disposal For Government

Written By

Namrata Sengupta

Updated on

July 27, 2022

Secure Data Disposal: Indispensable Need in Data Lifecycle

One would think that top government agencies are hard to hack into, but cases like the 2020 United States federal government data breach prove it’s not. With cases like these, data protection for government organizations becomes imminent as even the government facilities can be breached. Also, when government data leaves the facility for disposal, it becomes highly risky. For example, the 2021 Data breach at Maine-based HealthReach Community Health Centers has come to the limelight due to data theft of over 100,000 patient records that were compromised and could lead to a HIPAA penalty of over $1.5 million for willful neglect of privacy, security, and breach notification rules.

Maine Health Center episode was caused by improper disposal of IT assets that was preventable by a well-planned and secure IT asset disposal policy. Government organizations must make provisions to ensure that every hardware not in use is being wiped or physically destroyed with documented proof of sanitization. Additionally, proper care should be taken to ensure that the data in organizational hardware is secured throughout the data lifecycle from acquisition to sanitization. Secure data disposal ensures that no data trace is left, making it hackproof, as even if security is compromised, hackers will have no data-trace to access.

Data Destruction in Government Organizations

Different forms of data have different data destruction requirements. All physical data, like paper reports, are physically destroyed. If the report is classified or top secret, NSA specifications must be met for destruction. Classified data destruction requires the paper to be shredded through an NSA-approved device. The destruction standards are slightly lenient if the paper report contains unclassified information. The classified data destruction gets trickier when it comes to digital media. Currently, many government agencies operate on a physical destruction policy. However, this is not only ineffective but also an expensive method. Physical destruction involves the cost of destroying the drives with the added expenditure of replacing the old drives with new ones.

Unless the shredded drives are reduced dust, which it doesn’t in most cases, physical destruction remains ineffective and unsecure. Larger fragments leave information behind. And if a person wanted to, they could still steal data from a physically destroyed device. Thus physical destruction without permanent sanitization of data will not be considered a secure IT Asset disposal for a government organization. That is why software-based data erasure is needed to secure government assets’ destruction. In addition, government organizations could save millions by recycling and reusing storage drives instead of destroying hardware to protect sensitive data. Software-based erasure and device repurposing also helps reduce e-waste and promotes the cause of a circular economy and a sustainable planet.

Secure IT Asset Disposal For Government

National Institute of Standards and Technology (NIST) guidelines mandate organizations, including the government, to practice secure data erasure while getting rid of the old digital media to mitigate cybersecurity risks and prevent data leakage. The NIST SP 800-88 guidelines are widely adhered to by the US government and act as a benchmark to drive their media sanitization programs with defined techniques and control mechanisms for sanitization, disposal, reuse, or migration of media and information. In addition, government bodies like the US Department of Health and Human Services (HHS) also refer practitioners to employ the NIST 800-88 standard. Therefore, meeting the NIST SP 800-88 guidelines is the best way to ensure that sensitive government data can be wiped in compliance with global norms of data destruction and ensure data security.

Secure IT Asset disposal for government organizations relies on two parameters.

Whether the media will be reused
Whether the storage device will leave the organization’s control

The answer to both questions will decide how the organization will conduct data erasure. The NIST standard has 3 methods that may be used for classified data destruction. Two methods – Clear and Purge – are software-based data destruction methods effectively employed for reusing the devices. The third – Destroy – refers to the physical destruction of the device. The third method should only be used if the first two are implausible. Keeping the storage device under the organization’s control is one of the safest ways to protect from data theft. In these cases, in-house software for data erasure or onsite data destruction is the most efficient cost and safety. When the storage device leaves the organization for disposal, the best practice is to permanently sanitize these devices and drives before leaving government premises to ensure data security and prevent any data leakage.

Erase Data First, Onsite and Under Supervision

The first step when recycling a device should always be data destruction. And preferably, this destruction must happen onsite, if resources permit. Here are some guidelines for government organizations intending to reuse a device.

If the drive is from a privileged system, it should be erased with approved software before physical destruction.
In case of mechanical failures in HDD servers, they may be degaussed. But the storage media should be fully destroyed after degaussing to prevent any leakage, as degaussing does not verify that data destruction was complete.
Mobile devices should be sanitized in line with NIST SP 800–88 crypto erase guidelines.
Onsite Erasure: Data erasure, degaussing, or shredding should preferably be done onsite. If a third-party vendor is hired, a secure chain of custody should be maintained with verification of premises and the IT disposal process.
Under Supervision: Two or more prefecture staff should oversee and verify that data destruction is happening per procedure.

How BitRaser Data Eraser Can Protect Sensitive Data

To protect sensitive data and adhere to international data protection laws, every government organization needs to ensure that confidential information no longer needed is wiped permanently from all storage devices. Whether the government agency needs to reuse the device or destroy the drives and devices, the primary action to be executed is secure data sanitization. BitRaser is a professional data wiping tool that guarantees data erasure beyond recovery using international erasure standards, including NIST 800-88. The certified tool works effectively on networked and off-grid storage media, with the capability to erase/diagnose multiple devices simultaneously. Following the principle of Erase, Verify and Certify, the NIST-approved BitRaser drive eraser software gives your complete control of permanent erasure with verification of every wipe performed. In addition, the tool generates 100% verifiable reports and certificates that serve as handy audit trails for compliance purposes. This advanced software with the capacity to render data retrieval impossible even in a laboratory setting is an ideal solution for a secure IT asset disposal for government organizations.

About The Author

Namrata Sengupta

51 posts

Namrata is a seasoned business leader with a strong background in strategic management, revenue growth, brand building, and nurturing partnerships. She has more than 25 years of experience serving leadership roles in IT / ITES , Telecom & Education industries. In her role as Vice President at Stellar, she has been actively talking about data privacy & erasure solutions through live technology events in the US, Europe & APAC.

Secure IT Asset Disposal For Government Organizations

Let’s get started

Submit Enquiry

Stellar Brings to The World Future-Ready Data Solutions