Securely Erase Data

If you have contracted data from an external party, or are under a legal compliance requirements to erase data once it is no longer needed, this page is provided as a general how to guide.

Overview


ISO has been tracking changes in contracts and requirements for data sharing for some time. We have noticed a convergence of requirements and standards as information technology matures. As companies, organizations, individuals and governments implement controls to protect data privacy and control the loss of personal information, this trend will continue. One of the controls that has become a standard is the destruction of data after approved use. This control reduces the risk of loss of control of private and confidential data.

Generalized Secure Erasure Standard (NIST 800-88)


The standard for secure erasure of data on storage media provides three methods. All of these methods are intended to make the data unretrievable or useless.

  • Physical destruction – good for removable media or system disposal but not economical for production cloud or premise data storage.
  • Multiple pass overwrite – good for selective erasure but not useful for solid state storage.
  • Encryption with secure destruction of the encryption key – good for any kind of storage, selective erasure and institutional data requires commercial software.

Best Practices: Design your systems and services with security controls from the start


  1. Plan your data disposal requirements as part of the infrastructure planning when designing or purchasing the facility that will be used to store your data.
  2. Do not store contractually restricted or compliance restricted data on removable media without contact your OIT divisional support representative or The Information Security Office for advice.
  3. If storing the data on a local computer, the drive should be a traditional Hard Disk Drive, not a Solid State Drive and should be encrypted using the computers operating systems whole disk encryption tools. Protect the encryption key and do not store in on the system where the drive is connected. Drive encryption is a Rice institutional requirement for all Rice purchased systems.
  4. If you are planning to store your data on a cloud service or an OIT storage service, make sure that the cloud service provider or OIT can meet the contract data destruction requirements.
  5. Control and track where the data is copied to and from during its presence on your systems, or services, including backups which should also be encrypted.
  6. Document your processes and practices so that if and when you are audited, you can show due diligence and attest to such practices at the end of the project or contract.

Selectively Erasing Files or Free Space Securely


For any operating system, there are third party and/or operating system provided tools to erase individual files and folders securely from your systems. Free or empty space erasures tools are mostly from third parties. Free and empty space erasure ensures that data that has already been deleted does not leave traces on your disk drive. IT IS CRITICAL TO NOTE that erasing files or free space on storage systems with free or commercial file shredding tools currently requires that the drive is a traditional spinning hard disk drive (HDD) and NOT a solid state drive (SSD).

For the ISO approved options please visit our KB article here.

Data Destruction Requirements

If you are under a contract requirement such as a Data Use Agreement where your work requires you to acquire data from other parties which restrict its use and require data destruction at the end of the agreement term, you can request a data destruction form from ISO via email to help@rice.edu. The Rice OIT Help Desk will route your request to the Information Security Office.