DoD 52220.22-M (3 Pass wipe) and Virtual Machines

Question

So my place of work, if you can tell by the title is either Gov or Mil, and we recently had a tech refresh where all of our workstations were replaced with VM's. We are running version VMWare Version 14 on ESXi version 6.7. VM's are Windows 10.

A question was posed today that, if an Information Assurance (IA) violation happened on one of the VM work stations, how would you effectively wipe the data? Because with a phyisical machine, you do a 3 Pass wipe on the HDD and then re-image it. But how, if the ESXi hosts share the data stores for the VM's, do you effectively remove that VM's HDD presence without doing a 3 pass wipe on the entire ESXi host?

Any info or other DoD publications you know of, would be greatly benefitial. And before you suggest any third party software or different versions, please know that it is not possible for us to install any tools or versions that have not been tested and approved by both the DoD and by our PMO(Project Management Office).

Answer 1

This answer won’t make you happy because it won’t match government check box security.

First of all, the 3 Pass Wipe derives from a decades obsolete MFM disk technology that no one uses. It makes no sense on modern disk drives. Yes I know – government rules.

The same type of issue occurs with an e-mail “spill”. No one is going to wipe the main email server drive due to an individual “spill”. Instead the affected accounts will be manually sanitized and sometimes if the spill is bad enough, a free-space wipe on the server will be performed.

Similarly to the email server, depending upon the severity of the issue:

• The VM disk file can be manually cleaned and compressed

• The VM disk file can be wiped

• The ESXi hard drive can have free-space wiped after VM deletion/wiping.

3 Pass Wiping of a VM is just security theater, but it may check bureaucratic boxes.

None of this meets Old School remediation standards, but times change and even the government has to change.

Throw in the likely possibility that the VM virtual disks may actually reside on a virtual LUN from a RAID array of physical drives in a SAN and Old School goes right out the window.

Answer 2

If physical erasure of all data that the VM touched if a strong requirement, it should be observed at the low level host. A possible way is to give hard disk partitions to the VM instead of just plain files. It is slightly more complex at VM creation, but physical erasure comes smoothly.

A variant would be to pre-allocate the VM disk files. If you do it for all VMs and only store VM disk files on that disk partition, the host OS will never move blocks and the 3 pass wipe at the VM level will actually rewrite all the data from that VM.

Dynamic allocation (not speaking of cloud type management) is much more cool and modern and better supports requirement changes. But its drawback is that you have less control on where the actual data from a VM lies. I would avoid it if full erasure is a strong requirement.

But as usual, the first question is why (what is the risk, the threat and possible consequences).The level of acceptable risk will give you the acceptable solutions. Said differently if only an administrative rule says that you must use 3 pass wipe, but the actual sensitivity of the data would not require it, just do the 3 pass wipe on where the current disk of the VM is and move along. But is the data has a high sensitivity, you should at least pre-allocate the VM disk to make sure that the will never be moved on the physical underlying disk.