Determine how to treat your unwanted data depending on the classification of the data for your business and the media it is residing on. Don't treat all your data as if it's all equally important - it's not!

1. DATA DESTRUCTION
PROCESS
We’re going to walk you through some of the steps you need to consider
in how to deal with the destruction of your company data depending on
the security level (confidential, top secret) of the data held…
Secure Sanitation Levels (SSL 1-3)
and Impact Levels (IL 0-6)
www.icex.co.uk

2. IMPACT LEVELS
There are 6 IL’s and these determine how
you should destroy the data you’ve collated
once it’s no longer needed to be retained
on the media it currently is…
First you need to consider ‘Impact Levels’
www.icex.co.uk

3. Many businesses ignore
this step and think all their
data is equally important.
It’s not…

4. Generally this would be classed as
‘unclassified’ material and would result
in no adverse effects to an
organisation if it became public
knowledge…
Impact Levels 0-2
PROTECT
www.icex.co.uk

5. This would be considered as material
that would cause ‘undesirable effects’
if it became public knowledge…such
as negative perceptions about your
business or perhaps bad reviews
Impact Level 3
RESTRICTED
www.icex.co.uk

6. This is material that would seriously
cause damage to a businesses
reputation if it became public. This could
lead to a company share price drop or
very negative press coverage…
Impact Level 4
CONFIDENTIAL
www.icex.co.uk

7. Don’t just think government secrets
here, this could be trade secrets about
your business e.g. your special
chocolate mix or a new vehicle design
that will give a competitive advantage
Impact Level 5
SECRET
www.icex.co.uk

8. Ok, we’re on a completely different
level here (think NSA or GCHQ). This
is more likely to be anything to do with
national security…most businesses
won’t have this level of data
Impact Level 6
TOP SECRET
www.icex.co.uk

9. Is the media ok for re-use? Or…
NEXT, DECIDE ON THE PROCESS
Does the media need physically destroying?
1
2
Having decided on the future reuse (or not) of the
media, you can then decide on the Secure
Sanitation Level (SSL) of which there are 3…
www.icex.co.uk

10. SSL 1 – this level is used for sanitising media
types storing data from IL 0 – IL 2
SSL 2 – this level is used for sanitising media
types storing data from IL 3 – IL 4
SSL 2 – this level is used for sanitising media
types storing data from IL 5 – IL 6
SECURE SANITATION LEVELS
www.icex.co.uk

11. Now decide
on the method
of removing
the data…

12. Now decide
on the method
of removing
the data…
…and yes,
there are 3
ways of doing
this as well

13. CLEARING
The process of ‘Overwriting’
This consists of software
overwriting a disc or similar with a
series of 1’s & 0’s randomly and
repeating it
www.icex.co.uk

14. CLEARING
This is suitable for…
• PC Hard Drives
• Network, Printer & Flash Hard Drives
• Zip, USB
• Other Flash Media
www.icex.co.uk

15. CLEARING
Pro’s Con’s
• Provides a digital certificate and
therefore proof of an overwrite
or ‘ wipe’
• Can link each certificate to each
individual IT asset
• Media can be reused
• Only as good as the erasure
software purchased
• Ideally needs to be an assured
product (CESG)
www.icex.co.uk

16. PURGE
The process of ‘Degaussing’
The process of degaussing
involves passing magnetic media
through a strong magnetic field
which disrupts the data patterns
www.icex.co.uk

17. PURGE
This is suitable for…
• PC Hard Drives
• Network, Printer & Flash Hard Drives
• Data Tapes like DAT, DLT, Audio
Video and Cassette
www.icex.co.uk

18. PURGE
Pro’s Con’s
• Very quick process (seconds)
• Able to erase without power
supply if permanent magnets
used
• Magnetic field needs to be
strong enough to penetrate
media casing
• No proof that erasure has
occurred
• Cannot reuse the media

19. DESTROY
The process of ‘Destruction’
Consists of physically destroying
the media holding the data by
shredding, disintegration or
incineration
www.icex.co.uk

20. DESTROY
This is suitable for…
• Hard Drives, Flash media
• Optical media
• Documents - paper based
• Documents - microfiche
www.icex.co.uk

21. DESTROY
Pro’s Con’s
• Visual proof that media is
destroyed
• Higher levels of security
achieved the smaller the
fragment size
• Needs expensive specialist
equipment
• Cannot reuse the media
• Only paper based certification
of destruction possible
www.icex.co.uk

22. Now you just have
to put it all
together…

23. TABLE OF SSL’s and MEDIA TYPES
www.icex.co.uk
Note: This information can change at any time. For further detailed information, view the HMG Infosec Standards as defined by www.cesg.gov.uk
Hard/Data Drives USB memory Sticks, Flash Media CD's - DVD's
1
Overwrite with Unassured Products CESG Manual S (Table 8A) Use CD erase software
2
overwrite with CC EAL 1 or CCT Mark
Products
CESG Manual S (Table 8A) N/A
3
Overwrite with CESG Lower or CC EAL 2
Products
CESG Manual S (Table 8A) N/A
Hard/Data Drives USB memory Sticks, Flash Media CD's - DVD's
1
Overwrite with CC EAL 2 Products CESG Manual S (Table 8A) N/A
2
Overwrite with ATA Secure Erase or CESG
Higher Products
CESG Manual S (Table 8A) N/A
3
Overwrite with CESG Higher Products CESG Manual S (Table 8A) N/A
Hard/Data Drives USB memory Sticks, Flash Media CD's - DVD's
1
2
Degauss at CESG Lower then/or CBP
3
Degauss at CESG Higher Products then
destroy to CESG Guidance
CESG Guidance
SSL
SSL
SSL
CLEAR (Overwrite)
PURGE (Degauss)
DESTROY (Shred, Disintegrate, Incinerate)
CBP
CESG Guidance or CBP

24. Determine the data’s Impact Level
SO IN SUMMARY
Can the media holding the data be reused?
Determine the appropriate SSL based on the
impact level
Determine the appropriate data removal
method depending on the media holding the
data www.icex.co.uk

25. www.icex.co.uk
When my redundant IT & mobile device
assets must be 100% totally data secure
Providing the skills, experience and professional services that my
electrical, IT and mobile device disposal requirements demand