Introduction
Sensitive data is confidential, private, personal data on any digital media. Experience has shown that many if not most PC's to be transferred out of production, still contain data which is considered sensitive related to University business. This includes passwords, employee/student private and/or personal data, financial, health, banking information, personnel documents, proposals, contractual records, etc. Thus when a University microcomputer is sent to University Salvage and Surplus, or transferred between departments, sent for repair, or otherwise disposed of, such sensitive data should be permanently and securely overwritten.
Recommendations for Microcomputers
Since manual removal of individual occurrences of sensitive data has been shown to be unreliably incomplete, we recommend using a professional disk sanitation algorithm (http://www.versiontracker.com/php/feedback/article.php?story=20035301448520630144) or wiping tool software that supports the DoD 5220.22-M disk overwriting Standard (http://www.usaid.gov/policy/ads/500/d522022m.doc) to completely overwrite fixed disk(s) of PC's that are being transferred out of production, sold/traded between departments, or sent to University Salvage and Surplus or sent out for repair. Methods (detailed algorithms) to completely securely overwrite fixed disks are well documented. For example, see http://wipe.sourceforge.net/secure_del.html. An excellent overview and list of software is given at IEEE Secure Disk Wiping: http://www.computer.org/security/v1n1/garfinkel3.htm
Hard Disk Data Erasure Product Functionality Test results: http://www.veritest.com/clients/reports/redemtech/redemtech.pdfOther Media and Devices
Finally, in addition to overwriting PC fixed disks, floppy and zip disks, CD's, there are other media that pose privacy/security risks. For example, network devices, like routers, PDA's (hand held Personal Digital Assistants) can have departmental information stored as personal data or configuration information. Prior to transfer or disposal, this data or configuration information should be cleared manually and by someone who understands the device(s) in question.
Related Penn State Policies and References
It is also important to work with departmental computer and data people before overwriting data on any PC. Also review the following Penn State Policies in conjunction with the technical information above:
Some Available Software
Evidence/Local Activity Eliminator (Windows): http://www.harddrivewipe.com/ and for the Macintosh, MacWasher: http://www.newfreeware.com/utils/1518/
The following software completely destroys (overwrites; wipes) ALL data on fixed disk(s), including the operating system. Actual MS Windows and Linux software that support secure (DoD 5220.22-M disk overwriting Standard) complete wiping of fixed disks may be found at commercial disk wiping software:
Summary
Departmental computer professionals have the responsibility to secure departmental and University sensitive data. This responsibility includes following University Policies on Disk Sanitation and data archival, as well as touching base with related department people, and then clearing or overwriting all sensitive data on PC fixed disks and other devices before the they are traded/sold/salvaged/repaired.
For further information see http://ftp.aset.psu.edu/pub/ger/documents/SecureFixedDiskWiping.html
Acknowledgment: thanks to Pete Weiss and Todd Litzinger, Penn State Administrative Information Services, for helping to review and improve this document.