3

I had a discussion with a customer who requires the physical destruction of the PC (a standard laptop) which is holding their data. After clarification, they mean the destruction of the entire laptop, not the disk only (the disk is removable so it would not have been a big deal).

I am putting the cost and ecological aspects aside - is there a standard which encourages, recommends or forces the physical destruction of a complete PC grade device? I could not find anything in my go-to places (ISO, NIST, ISF).

I can understand the case of devices where the data is held in embedded areas not immediately identifiable - destroying everything is a solution to make sure no residual data could be left aside. This is not the case of that standard laptop.

EDIT: Following comments and answers, I would like to clarify that this company is a large, serious one. They know how computers works. They must have some SOP which dictate this, or the security officer on duty had a bad day.
I am not trying to guess why they have such a requirement but whether there is a case where this follows a standard.

  • 3
    I don't think there'll be one, since it makes no sense to do that. Is your client familiar with how computers work? – MiaoHatola Mar 16 '17 at 16:49
  • @MiaoHatola: they perfectly know how they work, this is a huge company. I am not that interested about why they want to proceed like that (I am used to SOPs which do not make much sense), I was rather interested if there is a case where such decisions follow some standards.. – WoJ Mar 16 '17 at 17:47
2

All the documentation I've ever seen on the subject is very clear, you just have to do a certified wipe of the storage medium. RAM, screen, graphics, etc. just generally aren't listed. With that being said, the official DoD Manual regarding the Protection of Classified Information (from 2013, which is latest I could find) prescribes that methods used for

clearing, sanitization, or destruction of classified IT equipment and media

can include

overwriting, degaussing, sanding, and physical destruction of components or media

It goes on to state that

Classified IT storage media (e.g. hard drives) cannot be declassified by overwriting. Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal

But again, that only applies to storage media, I couldn't really see a reason why the complete destruction of the entire equipment would be necessary if they don't even do it with classified materials. But there may be classified procedures that prescribe destruction of the entire unit, I wouldn't know.

-1

It's been a few years since I last had cause to check the standards but I don't believe there is one, as @MiaoHatola says there is no need to do so from a security perspective.

I'd hazard a guess that your customer either:

a) doesn't understand the architecture of a laptop well enough to understand that the data is only on a removable component (the disk),

b) doesn't understand that the disk can be separated, or

c) understands both of these things perfectly well but has no use for the laptop sans hard disk and is merely wishing to avoid the hassle/cost of having the laptop itself disposed of separately.

  • The customer understand how computer works (your points a) and b)). The cost of a laptop is nothing within this contract, this is our laptop so they do not have to dispose of anything (your point c)). I am not trying to guess why they want this (there are plenty of SOPs which do no tmake sense but they are here to stay). I am wondering if such requirement is documented in some standard. – WoJ Mar 16 '17 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.