Examkin

Question

Difficulty: HardData Destruction and Disposal Methods

A healthcare organization is preparing to decommission an array of enterprise Self-Encrypting Drives (SEDs) containing magnetic platters that stored protected health information (PHI). The IT department plans to reassign these physical hard drives to a non-sensitive internal development environment. The compliance policy requires a NIST-compliant purge method that renders all historical data unrecoverable via advanced laboratory techniques while preserving the drive hardware for immediate reuse. Which of the following data disposition methods should the technician perform?

  1. Perform a Cryptographic Erase (CE) to destroy the internal media encryption keys.Answer
  2. B
    Expose the magnetic drives to a high-coercivity degaussing coil.
  3. C
    Run an industrial physical disk shredder to reduce the drives to small particles.
  4. D
    Execute a full format on each drive using the operating system disk management console.

Answer

Performing a Cryptographic Erase (CE) to destroy the internal media encryption keys.
Performing a Cryptographic Erase (CE) on Self-Encrypting Drives (SEDs) permanently erases or overwrites the symmetric media encryption key stored in the controller onboard memory. Without the key, existing encrypted data on the platters becomes unreadable ciphertext that cannot be decrypted even with specialized laboratory recovery techniques. Because the physical magnetic structure of the disk is unaltered, the drive can be re-initialized with a new key and safely redeployed.

Step-by-Step Solution

1
Analyze the organization's requirements for data disposition.
Identified the need for a 'Purge' level sanitization (unrecoverable via laboratory methods) that simultaneously allows hardware redeployment/reuse on Self-Encrypting Drives (SEDs).
Selecting an improper disposition method either leaves sensitive data vulnerable or unnecessarily destroys reusable enterprise hardware.
2
Evaluate the capabilities of Self-Encrypting Drives (SEDs) regarding sanitization.
Determined that SEDs store data encrypted at rest, and destroying the internal cryptographic key instantly renders all underlying ciphertext indecipherable.
Cryptographic Erase (CE) is defined by NIST SP 800-88 as an approved purge technique for self-encrypting media that preserves drive functionality.
3
Eliminate options that fail to preserve hardware or fail security standards.
Degaussing and shredding destroy the drive hardware preventing reuse, while standard OS formatting provides insufficient sanitization (clear only, not purge).
Only Cryptographic Erase meets both constraints: purging sensitive PHI and preserving physical disk functionality.

Key Concept

Data Sanitization Standards (NIST SP 800-88) and Cryptographic Erase
Estimated Time:2m 0s
Rate this question

Topics

Data Destruction and Disposal Methods

More questions from this topic