Page 576 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

sequential storage device!

Storage Media Security

We discussed the security problems that surround primary storage
devices in the previous section. There are three main concerns when it

comes to the security of secondary storage devices; all of them mirror
concerns raised for primary storage devices:

Data may remain on secondary storage devices even after it has
been erased. This condition is known as data remanence. Most
technically savvy computer users know that utilities are available
that can retrieve files from a disk even after they have been deleted.

It’s also technically possible to retrieve data from a disk that has
been reformatted. If you truly want to remove data from a
secondary storage device, you must use a specialized utility
designed to destroy all traces of data on the device or damage or
destroy it beyond possible repair (commonly called sanitizing).

SSDs present a unique problem in relation to sanitization. SSD
wear leveling means that there are often blocks of data that are not

marked as “live” but that hold a copy of the data when it was copied
off to lower wear leveled blocks. This means that a traditional zero
wipe is ineffective as a data security measure for SSDs.

Secondary storage devices are also prone to theft. Economic loss is
not the major factor (after all, how much does a backup tape or a
hard drive cost?), but the loss of confidential information poses
great risks. If someone copies your trade secrets onto a removable

media disc and walks out the door with it, it’s worth a lot more
than the cost of the disc itself. For this reason, it is important to use
full disk encryption to reduce the risk of an unauthorized entity
gaining access to your data. It is good security practice to encrypt
SSDs prior to storing any data on them due to their wear leveling
technology. This will minimize the chance of any plaintext data

residing in dormant blocks. Fortunately, many HDD and SSD
devices offer on-device native encryption.

Access to data stored on secondary storage devices is one of the
most critical issues facing computer security professionals. For