Haxoris Wiki

Insecure Media Disposal And Decommissioning

How Insecure Media Disposal And Decommissioning works

Insecure media disposal is data walking out of the building on hardware that was retired but never sanitised. The residue lives in retired server and laptop disks, the hidden hard drives inside printers and multifunction devices, backup tapes, USB media in a drawer, and the paper going into an unlocked recycling bin. Decommissioning treats these as a logistics task - wipe it when there is time, stack it in a cupboard, hand the pallet to a vendor - so the media leaves with its contents intact.

Whoever ends up with the hardware reads it at leisure, off the network, with no lockout and no alert, and recovers exactly what the live system held: domain-joined machine secrets, cached credentials, database files, an MFP’s scan-to-file spool of everything copied that year. It is easy to miss because the risk moves the moment the asset is powered off, when it also drops off the monitoring and patch tooling and becomes invisible to security while remaining perfectly readable. A quick-format or a factory reset leaves the blocks intact; the finding is that “wiped” was asserted, never verified.

Insecure Media Disposal And Decommissioning in practice

Inventory what is staged for disposal and reconcile it

Start at the staging area and the CMDB together. The gap between “assets marked retired” and “media physically present with a disposal record” is the first finding.

Reconciliation for the current disposal batch
---------------------------------------------------------------
Assets marked 'retired' in CMDB (last 12 months) ......... 214
Serials physically present in staging ....................  190
Serials with a sanitisation record ......................   131
Serials with vendor destruction certificate .............   118

Unaccounted-for media (retired, not present, no cert) ...   24  <-- finding
Present but no sanitisation evidence ....................   59  <-- finding

Twenty-four assets are retired in the record and cannot be located: that is data of unknown disposition, which is the worst state to be in.

Sample staged media and read it back

Pick a sample across device types, attach each read-only, and check whether the blocks still hold data. Read-only is the point: you are proving the leak, not creating one.

# Attach the sampled disk via a write-blocker; confirm it is read-only first
blockdev --getro /dev/sdb        # expect 1

# Is there still a recognisable filesystem, or was it actually wiped?
sudo fdisk -l /dev/sdb
sudo file -s /dev/sdb1

# Sample the raw device for recoverable content, without imaging the whole disk
sudo dd if=/dev/sdb bs=1M count=512 status=none | strings -n 8 \
  | grep -i -E 'BEGIN .*PRIVATE KEY|password|\.lab\.internal|NTLM|Administrator'

# Recover deleted files from a sample as proof of remanence
sudo photorec /log /d /opt/audit/recovered /cmd /dev/sdb search

Any recovered hostname, credential or document from media labelled “wiped” is the finding. Record hashes and counts, not the recovered content itself.

Pull the drives the inventory forgets

Printers, MFPs, thin clients, cameras and networking gear hold storage that asset records rarely list. These leave the building with everyone else’s disks and nobody sanitises them.

Device class            Hidden storage           Typical residue
----------------------  -----------------------  --------------------------
MFP / copier            Internal HDD or SSD       Scan-to-file, print spool,
                                                  address book, SMB creds
Enterprise printer      NVRAM / flash             Stored jobs, LDAP config
Thin client             eMMC                      Cached profile, VPN config
IP camera / NVR         SD card / disk            Footage, RTSP credentials
Router / firewall       Flash config partition    Plaintext or reversible
                                                  admin and VPN secrets

For an MFP, invoke the vendor’s own disk-wipe or overwrite function from the service menu and capture the completion screen; the finding is any device sent for disposal with that step never run.

Verify sanitisation evidence against the standard claimed

A certificate is only worth the method it names. Check that the evidence matches an accepted standard and that the method suits the media type, because an ATA Secure Erase is meaningless on a shredded requirement and a single overwrite is not purge-level on an SSD.

Claimed on cert     Media       Accepted?   Note
------------------  ----------  ----------  ---------------------------------
"Quick format"      HDD         No          Leaves all data blocks intact
"3-pass overwrite"  HDD         Yes         Purge for magnetic media
"3-pass overwrite"  SSD         No          Wear-levelling hides blocks;
                                            use crypto-erase or vendor purge
ATA Secure Erase    SSD/HDD     Yes         Verify the drive reported success
Crypto-erase        SED         Yes         Only if key was truly destroyed
Physical shred      Any         Yes         Particle size must match policy

Cross-check each certificate serial against the staging inventory: a certificate for a serial that was never in the batch, or a batch serial with no certificate, both break the chain of custody.

How to fix and prevent Insecure Media Disposal And Decommissioning

  1. Make verified sanitisation a gate on retirement
    • No asset changes state to disposed until a record names its serial, the method used and the verification result. The default state of unverified media is “still live”.
  2. Encrypt at rest so disposal becomes key destruction
    • Full-disk encryption on every server, laptop and, where supported, MFP means decommissioning is destroying the escrow key, which is fast and verifiable for both magnetic and solid-state media.
    • Partial control: it only helps if the key was never stored alongside the media and the encryption covered the whole device.
  3. Match the method to the media
    • Overwrite or degauss magnetic disks; use crypto-erase or the vendor purge routine for SSDs and self-encrypting drives; physically destroy anything that failed to verify. Follow a recognised standard such as NIST 800-88 and keep the certificate.
  4. Enumerate hidden storage before the device leaves
    • Maintain a per-device-class checklist for printers, MFPs, thin clients, cameras and network gear, and run the vendor wipe on their internal storage as a decommissioning step.
  5. Hold third-party vendors to per-serial chain of custody
    • Require a certificate of destruction listing each serial, reconcile it against your staging inventory, and treat any missing serial as an unresolved leak until it is accounted for.

Last updated

References