ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityMedium
A healthcare organization is decommissioning an old server that stored electronic protected health information (ePHI). The server's hard drives contain sensitive patient data that must be permanently rendered unrecoverable to comply with HIPAA regulations and organizational policy. Which of the following data sanitization techniques provides the HIGHEST level of assurance for permanent data destruction?
- AOverwriting the hard drives with random data multiple times.
- BPhysical destruction of the hard drives.
- CFile deletion and reformatting.
- DDegaussing the hard drives.
Show answer & explanationAnswer & explanation
Correct answer: B. Physical destruction of the hard drives.
Physical destruction (e.g., shredding, pulverizing) is generally considered the most secure and irreversible method for sanitizing sensitive data on hard drives, as it completely destroys the media's ability to store data.
Why the other options are wrong
- A. Multiple overwrites are effective for magnetic media but can be time-consuming and still leave microscopic traces on some drives, and are less effective for SSDs.
- C. File deletion and reformatting only remove pointers to data, which can still be recovered with forensic tools.
- D. Degaussing is effective for magnetic media but may not be effective for solid-state drives (SSDs) and older drives may require specific degausser strength.
Physical Destruction (Data Sanitization)
A data sanitization method that involves physically destroying the storage media to ensure data is absolutely unrecoverable.
- Most secure and irreversible method.
- Examples: shredding, pulverizing, incineration, crushing.
- Applicable to all media types, including SSDs and hard drives.
Memory trick: Delete is weak, overwrite is better, degauss magnetic, but destroy is best.