Slashdot Mirror
Ask Slashdot: Datacenter HDD Wipe Policy?
New submitter socheres (1771002) writes I keep a Slackware server hosted at various datacenters on leased hardware for personal / freelance business use. I have been doing this for the last 10 years and during this time I moved my stuff to several datacenters, some small and some big name companies. No matter the hosting company, since I choose to install my own OS and not take a pre-installed machine, I always got the hardware delivered with the previous guys' data stored on the hard drives. It was also the case with spare drives, which were not installed new if I did not ask specifically for new ones. Has this happened to you? How often?
Seems like the policy is none
I've been in the IT infrastructure business for years, and have always relied on physical destruction (shredding) of hard drives when disposing of old systems.
I can see where that may not be cost effective with leased systems, but I would take your experience as a warning to clean up after yourself and secure-wipe hard drives when your lease is up and not count on the datacenter to do it for you.
IANAL, but I also wonder who owns the data on a leased hard drive when the lease is up? If you improve an apartment or build a building on leased land, those improvements typically become the property of the owner when the lease is up. I wonder if that has been addressed with data in the absence of relevant contractual language?
Thats actually a breach of Security between the Data Center Provider and the previous company... Especially if you can access files on those "new" hard drive.
I would submit a security complaint to the Data Center Provider, and if you can figure out the company, to the company's Infosec people as well. That shouldn't happen at all.
In the company I work, we use a DOD standard Wipe disk, and if anything needs to be decomissioned, we hire a company that will give us a certificate of destruction.
Contract with them. They destroy everything.
...financial services degauss then physically shred the drives. You get a nice certificate too. It's extreme but cheaper than a data leak.
Drill press. 'nuf said.
Pulverisation, preferrably by hammer on concrete slab, in absence of a suitable anvil; maybe Acme brand.
I've worked for companies that sell Refurb drives. No effort is taken to clear drives, just a spin up test... I bought them a drive eraser and told them it would also let them know if the drive was bad, which should cut down on warranties. I'm not sure if they ever used it since they are a different department. In our Department drives were wiped using Boot and Nuke, then bad disks and small disks were physically destroyed then sold for scrap metal, good disks were reused but never left the site or used for other customers.
Get an OS re-image then simply fill the hdds with random data. This works well on HDDs, but SSDs with their 10 or 20% wear space, perhaps not, they need pulling and disposing.
For security purposes, I use a WiebeTech drive eraser to scrub the drive (DoD Sanitize standard), then send them to a physical destruction service.
Paranoid? Yes. Expensive? Yes. Worth it to my employers? Yes.
"They told me it was impossible. I replied with maniacal laughter." http://www.mydailyrant.com/
What I have learned from the news is that the policy has always been "If there has been nothing in the news, don't bother." It costs electricity and labour cost to do it. The previous story on /.
https://www.google.com/search?...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
I would never expect new drives on a leased box as it's a leased box. Nor would I expect them to sanitize my data before handing it to a new customer. I work with a lot of hosting companies and it's not very uniform. One dirt cheap place runs everything through dban before handing it back others not so much. If you need to insure this happens expect to pay for it.
No sir I dont like it.
A good hosting service will either tell you up-front they don't wipe data when they reclaim the drive and that you shouldn't store anything on it you wouldn't want splattered across the front page of Google News (or Slashdot, or ...), OR they will tell you what their policy is.
For setups where you are leasing a dedicated drive, they should offer you the option of buying a brand new drive outright and pre-paying for either certified destruction or returning of the drive to you when it is no longer in service. For certain applications with legal or national-security implications if the data is recovered after you quit being a customer, this may be the only way to go.
For virtual systems, your "virtual machine's" data store should be encrypted using keys controlled by the data center. When you are no longer a customer, the file is deleted and the encryption keys destroyed. Ditto cases where you are the only user of the drive but you haven't bought it outright - destroy the keys and the drive is for all practical purposes sanitized.
For shared-login systems and "virtual hosting" that is not a true VM (e.g. jail-rooted "virtual machines"), "your" data should be encrypted somehow using keys controlled by the data center owner. When you are no longer a customer, your files are deleted and the keys destroyed. The loopback device is one way to accomplish this task.
This method has the added advantage that once the keys are truly destroyed (including all backup copies) any backups the data center may have made are rendered useless. It can also save the data center time in that they don't have to overwrite your data, they can just delete the "container file" and be done with it.
About the only time I can see where it doesn't make sense to erase the data would be if it's a free or nearly-free/dirt-cheap hosting provider where they tell you up front that the drive will not be sanitized and that a future customer may be able to "undelete" your data. This falls under the category of "you get what you pay for, but the vender still has an ethical obligation to tell you what you are getting."
Some things require Old Tech.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Or what they are contracted to do. There is no use arguing with somebody who insists you spend 2 hours+ doing a D.O.D. wipe on a out of warranty drive if they are willing to pay you. Otherwise, 15s through a degausser will do the trick.
Something tells me you didn't make a copy of the last guy's data before you wiped it and installed your stuff. I'm betting no calls to the NSA,or even the local police were made. Nobody cares about this stuff except the people that need to. Finally, there is no machine in a datacenter that has both important data and Slackware on it. Hope you remove your own data before the next lease runs out, because nobody is going to do it for you.
If I remember correctly, Google has a barcode on every HD to track its life. When a drive is to be decommissioned for whatever reason, they secure wipe it, degauss it, then put it through a shredder that mixes the left over of many drives together.
No idea why this hasn't been mentioned yet, but if you don't have physical ownership / access of the media, you should be encrypting the LUNs (crypto-luks). Why are you trusting that the cloud-provider is going to wipe the drives when you are done with them (obviously you shouldn't be).
If you have physical ownership or the disks themselves (in your own DataCenter), then you should have policies in place to deal with the drives already.
I work for a hosting company and we wipe all drives using DBAN when a server is canceled. Volumes for our cloud based VMs also go through a similar process when the server is destroyed. There isn't a universal policy regarding this in the hosting industry so your best option would be to ask your provider what they do with canceled/failed hardware.
If it's ceramic, wipe them three times with 1s and 0s and then smash them to bits with a large hammer, and then cast the resulting powder into a nice art sculpture.
If it's metal, do the same but melt it.
Have to agree - anything that went on the cloud should be assumed to have been copied.
-- Tigger warning: This post may contain tiggers! --
Forget about seven pass wipes or sledgehammers. We just mail our old drives off to the Incriminating Record Shredders, where they are never heard from again.
One of the early comments alluded to this, but didn't quite take it far enough.
If userA leases a drive and fills it with illegal content (child pornography, Snowdon's files, whatever) and then leaves and the hosting company the re-leases the drive to userB without clearing out the drive properly, who gets arrested? Who should get arrested?
userA is long gone. Could potentially be tracked down. Need to prove they put the files there and not userB or hosting company.
userB has access (but potentially not ownership) of said files. This is still arrest-able offence.
Hosting company has ownership of files (possibly) in a leased environment??? If this is the case, should the hosting company be responsible not only for clearing the files from userA before putting userB in jeopardy from the law but also responsible for monitoring their drives for illegal activity and content.
Now we are on a slippery slope...
When all is said and done, nothing changes...
Yes. At least once a year. And every time it happens I post a new torrent with the offending hard disk's contents.
Something tells me you didn't make a copy of the last guy's data before you wiped it and installed your stuff. I'm betting no calls to the NSA,or even the local police were made
These days he might care.... never know when one might find a Bitcoin wallet carelessly left lying around complete with private keys.
If he didn't at least take a deep look at the data to see if there was anything there that he could "use", then it's because he's an honest person, perhaps. Not everyone is like that.
I got a cheap drill press from Harbor Freight for $56 on sale.
Dismantle, keep the magnets (the flat ones are really fun to play with, lots of projects) , and recycle the drive and platters (50 cents/pound), there's even a copper coil in there at 3$/pound
Not much, but once dismantled, data is gonna be pretty hard to recover.
If you really want it gone, Thermite...
I've got better things to do tonight than die.
Build the cost of destruction into the contract with the customer. Drives don't last forever so there is zero reason to try to save even thousands of them.
Ten thousand hard disks would easily fit into one, that's ONE, scrap rolloff container. Millions of cars are shredded every year for recycling so do not be impressed
by relatively tiny hard disks.
Shredding protects all concerned. Were it my tasking I'd give each removed hard disk a shot with a hand sledge on a workbench so it couldn't be recovered without
major expense (in practical reality, not at all), store them under lock and key, then bulk shred the lot.
Hard drives used to be expensive. Those days are over and the attitude that hardware is valuable needs to end. Information security is valuable, but hardware is scrap for the smelter.
Then they can say any illegal files on there were the previous owner's.
I work in a datacenter and we wipe drives on a regular basis using the "secure wipe" feature built into modern drives to securely wipe previous customer data from the drives prior to reusing them, of course as long as the disks are not defective. Unless specifically requested to do a "DoD" wipe, this is how we wipe the drives as a standard.
Some of that involves infrastructure and time. How long does it take to wipe one drive? It is measured in hours and possibly days depending upon capacity and speed (assuming a one time overwrite). A person does not need to sit there and watch it, but that person will need to have a place to store the obsolete computer while it is wiping. It also means that you will need some time to have the technician actually start the wipe. You will need to do something if the wipe failed for some reason (even if that something is declare close enough). You will also need to account for this in logistics. That is, it takes an extra day to dispose of a workstation or an extra week for a server (or whatever the time is). Furthermore, a used hard drive does not have the same level of reliability as a new one. So now you have an extra risk that must be accounted for in terms of cost.
The rule of thumb here is:
If the process you are expecting is not written into your agreement or documented as a matter of company policy, then the process is not done.
Likely you're not using a data center certified under HIPAA, PCI, SOX, SSAE/SAS-70, otherwise it would be documented and you'd already know.
Kriston
Encryption or physical destruction. Failed media replaced under vendor's field service is destroyed. Most vendors will add a surcharge to their service agreements that allow failed media to remain on site for destruction rather be be RMA'd. If not, well then bill me.