NIST SP 800-88 Guidelines for Media Sanitization
Guidelines for Media Sanitization: Recommendations of the National Institute of Standards and Technology
NIST.org, Monday 04 September 2006 - 00:00:00
Download the entire NIST SP 800-88 PDF (9/2006 Rev 1)You may use the
NIST.org Forum to ask questions or discuss this document.
Description from NIST.gov SP 800-88 (edited):
Information systems capture, process, and store information using a wide variety of media. This information is located not only on the intended storage media but also on devices used to create, process, or transmit this information. This media may require special disposition in order to mitigate the risk of unauthorized disclosure of information and to ensure its confidentiality. Efficient and effective management of information created, processed, and stored by an information technology (IT) system throughout its life (from inception through disposal) is a primary concern of an information system owner.
With the more prevalent use of increasingly sophisticated encryption, an attacker wishing to gain access to an organization’s sensitive information is forced to look outside the system itself for that information. One avenue of attack is the recovery of supposedly deleted data from media. This residual data may allow unauthorized individuals to reconstruct data and thereby gain access to sensitive information. Sanitization, done properly, can be used to thwart this attack by ensuring that deleted data cannot be easily recovered.
When storage media are transferred, become obsolete, or are no longer usable or required by an information system, it is important to ensure that residual magnetic, optical, or electrical representation of data that has been deleted is not easily recoverable. Sanitization refers to the general process of removing data from storage media, such that there is reasonable assurance, in proportion to the confidentiality of the data, that the data may not be retrieved and reconstructed.
This guide will assist organizations and system owners in making practical sanitization decisions based on the level of confidentiality of their information. It does not, and cannot, specifically address all known types of media; however, the described sanitization decision process can be applied universally.
---
The SP 800-88 document was created by the National Institute of Standards and Technology and is public domain (not subject to copyright).
this content item is from NIST IT Security
( http://www.nist.org/nist_plugins/content/content.php?content.52 )
