Is it advisable for a security-minded company (data stored could be client's detailed information, patent pending docs) destroy all replaced HDDs/SSD? Or is it OK to re-sell them online?
Information used in the disk was encrypted.
asked May 13, 2016 at 10:24
-
1If the files on the system were properly encrypted, you could sell the disks. However, I would rather destroy them than getting in trouble later because a disk with unencrypted yet sensitive data was sold.– LukasMay 13, 2016 at 10:39
Add a comment
|
4 Answers
Disk is cheap, peace of mind isn't. Shred the disks and you won't have to worry about them.
"But it's encrypted..." - is it? Are all your disks encrypted? If not, how confident are you that your asset management never ever confuses encrypted and unencrypted disks? Are you willing to sink the necessary effort into tracking assets that closely?
Disk is cheap. You won't earn that much from selling them, and people buying the rest of the hardware can backfill a disk pretty cheaply. Just shred them.
answered May 13, 2016 at 11:45
Things that are encrypted are potentially decryptable. A pile of disk dust is less so.
Physical destruction has a few other advantages - its relatively fast. A drill press could render a platter unreadable fairly quickly, and a shredder can be used to destroy disks in bulk. Wiping might take an hour or more depending on the size of the disk. It can be done on disks that won't read on your systems (but could be fixed by professional recovery services or $attacker). Its a relatively unskilled task that needs minimal babysitting, and is easy to verify.
Unusable media is safe media.
Consider disk as a paper which contains some sensitive information. Would you like to crumple them and sell them off for some monetary gain, or would you rather use a shredder machine so that the data becomes irrecoverable?
Disks can be bought, data leaked cannot be. There are many people out there who are eager and ready to accept the challenge of breaking your encryption, and selling off the data.
Even if you wipe the data, or rewrite it over and over, still there would be chances of getting the data(or some of it) back.
Best solution? Shred the disk. Consider it as an investment towards securing your sensitive/confidential data.
Well ask yourself what would you do. Lets say you have a hard disk with all your credit card info etc. Do you think encryption is enough? Personally I would forensically wipe the drive and then destroy it before i throw it in the garbage.
